0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LetsPRO.exe
Size 243KB
Sample260704-plefpsfs9v
SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
MD5 fb49018cd616909b9581551e7913535e
SHA1 2074d4eead8d3f637649c44042b70f6894ff64a3
SHA512 e5d8a4d65cc439cbca9d7fb3f9a8b4f5444a096e12197c840dea8c5b2b588049453a04a5f2554328208021ad31eb21d20671378a438d6aa47c7c0b39765b1054
SSDEEP 6144:xZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQwuU7pI2:xJ+2Z4nShVY5JUUU1p
TLSH
T1B2348B1175D38472E5B30A3008F4E6B5AA7DFC710E659E7B63D9072E0F702C29A35EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET54C2.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET54C2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	53	119.29.29.29	2240	LetsPRO.exe
Destination IP	15	119.29.29.29	2240	LetsPRO.exe
Destination IP	33	119.29.29.29	2240	LetsPRO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\" /silent"	LetsPRO.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1720	cmd.exe
3172	ARP.EXE

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531E.tmp	DrvInst.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	tapinstall.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2932	ipconfig.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\",1"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\" \"%1\""	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol"	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe"	LetsPRO.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	LetsPRO.exe
2240	LetsPRO.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	LetsPRO.exe
Token: SeAuditPrivilege	4368	svchost.exe
Token: SeSecurityPrivilege	4368	svchost.exe
Token: SeLoadDriverPrivilege	4652	tapinstall.exe
Token: SeRestorePrivilege	3132	DrvInst.exe
Token: SeBackupPrivilege	3132	DrvInst.exe
Token: SeLoadDriverPrivilege	3132	DrvInst.exe
Token: SeLoadDriverPrivilege	3132	DrvInst.exe
Token: SeLoadDriverPrivilege	3132	DrvInst.exe
Token: SeIncreaseQuotaPrivilege	2240	LetsPRO.exe
Token: SeSecurityPrivilege	2240	LetsPRO.exe
Token: SeTakeOwnershipPrivilege	2240	LetsPRO.exe
Token: SeLoadDriverPrivilege	2240	LetsPRO.exe
Token: SeSystemProfilePrivilege	2240	LetsPRO.exe
Token: SeSystemtimePrivilege	2240	LetsPRO.exe
Token: SeProfSingleProcessPrivilege	2240	LetsPRO.exe
Token: SeIncBasePriorityPrivilege	2240	LetsPRO.exe
Token: SeCreatePagefilePrivilege	2240	LetsPRO.exe
Token: SeBackupPrivilege	2240	LetsPRO.exe
Token: SeRestorePrivilege	2240	LetsPRO.exe
Token: SeShutdownPrivilege	2240	LetsPRO.exe
Token: SeDebugPrivilege	2240	LetsPRO.exe
Token: SeSystemEnvironmentPrivilege	2240	LetsPRO.exe
Token: SeRemoteShutdownPrivilege	2240	LetsPRO.exe
Token: SeUndockPrivilege	2240	LetsPRO.exe
Token: SeManageVolumePrivilege	2240	LetsPRO.exe
Token: 33	2240	LetsPRO.exe
Token: 34	2240	LetsPRO.exe
Token: 35	2240	LetsPRO.exe
Token: 36	2240	LetsPRO.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe
2240	LetsPRO.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2240	696	LetsPRO.exe	85
PID 2240 wrote to memory of 3784	2240	LetsPRO.exe	89
PID 3784 wrote to memory of 4652	3784	cmd.exe	91
PID 4368 wrote to memory of 3056	4368	svchost.exe	93
PID 4368 wrote to memory of 3132	4368	svchost.exe	94
PID 2240 wrote to memory of 896	2240	LetsPRO.exe	103
PID 896 wrote to memory of 2932	896	cmd.exe	106
PID 2240 wrote to memory of 2236	2240	LetsPRO.exe	111
PID 2236 wrote to memory of 3428	2236	cmd.exe	113
PID 2240 wrote to memory of 1720	2240	LetsPRO.exe	115
PID 1720 wrote to memory of 3172	1720	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\LetsPRO.exe
"C:\Users\Admin\AppData\Local\Temp\LetsPRO.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe
  "C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe"
  2⤵
  - Unexpected DNS network traffic destination
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Temp\driver\oemVista.inf" tap0901"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe
      "C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Temp\driver\oemVista.inf" tap0901
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C route print
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d2e4af68-a473-994a-b279-d3c33bee39af}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\users\admin\appdata\local\temp\driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3056
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:3132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4328

C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe
"C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe" /silent
1⤵
- System Location Discovery: System Language Discovery
PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_0511edjt.0r3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0511edjt.0r3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LetsPRO.INI

Path C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.INI
Size 1KB
SHA256 de5e478326ef40549c2b9dee246f8b8b602b488c9e48b5daaefe9f9f431b5b71
MD5 85d93f64554a7fad5b6bd21919566e40
SHA1 d2308ae5696a20175dbcd1749b06dc78f33b0ffa
SHA512 1508ca772e16df264b73f2e140f4057f7a42981cd22989dd7b24910d016b71f59a97de9d6ce286f09984745d73c6d6e88e4c77f56e7c3e93f20eabaa59287446
TLSH
T17631335B46702B3194532107191FEBE3B32469AC226B54B1347C8B843703D29D33BEE9
MD5 SHA1 SHA512 TLSH

Submit Download

tap0901.sys

Path C:\Users\Admin\AppData\Local\Temp\{D2E4A~1\tap0901.sys
Size 38KB
SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
MD5 c10ccdec5d7af458e726a51bb3cdc732
SHA1 0553aab8c2106abb4120353360d747b0a2b4c94f
SHA512 7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981
SSDEEP 768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
TLSH
T1BA037E91A7A81896E4AA947483E7DF67FBB8B1431310DBDF0364E6591F23BD41237328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oemvista.inf

Path C:\Users\Admin\AppData\Local\Temp\{d2e4af68-a473-994a-b279-d3c33bee39af}\oemvista.inf
Size 7KB
SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
MD5 26009f092ba352c1a64322268b47e0e3
SHA1 e1b2220cd8dcaef6f7411a527705bd90a5922099
SHA512 c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363
SSDEEP 192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
TLSH
T17EF150641C83EE3A31FEE58407565EC7E25611823A172800355CFC549BBDD9FE73C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET531D.tmp

Path C:\Windows\System32\DriverStore\Temp\{46e2364f-965e-de45-b716-c957819913c6}\SET531D.tmp
Size 10KB
SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
MD5 f73ac62e8df97faf3fc8d83e7f71bf3f
SHA1 619a6e8f7a9803a4c71f73060649903606beaf4e
SHA512 f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe
SSDEEP 192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
TLSH
T17F22F7A289AC44C3E8A3AC3013E8FC977D3D67CB1C50455925AEF6291EA73C5F31526D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2240-122-0x00000000557E0000-0x0000000055846000-memory.dmp

Download

memory/2240-4-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-7-0x00000000063E0000-0x0000000006492000-memory.dmp

Download

memory/2240-8-0x00000000064A0000-0x00000000064C2000-memory.dmp

Download

memory/2240-9-0x00000000064D0000-0x0000000006824000-memory.dmp

Download

memory/2240-10-0x0000000006BC0000-0x0000000006BDE000-memory.dmp

Download

memory/2240-11-0x0000000006BE0000-0x0000000006BFA000-memory.dmp

Download

memory/2240-12-0x0000000006C20000-0x0000000006C36000-memory.dmp

Download

memory/2240-14-0x0000000006C50000-0x0000000006C5A000-memory.dmp

Download

memory/2240-15-0x0000000006C90000-0x0000000006CB6000-memory.dmp

Download

memory/2240-17-0x0000000006C80000-0x0000000006C8A000-memory.dmp

Download

memory/2240-134-0x0000000056630000-0x000000005664E000-memory.dmp

Download

memory/2240-13-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-19-0x0000000007010000-0x0000000007032000-memory.dmp

Download

memory/2240-18-0x00000000074A0000-0x00000000079CC000-memory.dmp

Download

memory/2240-20-0x0000000006FE0000-0x0000000006FEC000-memory.dmp

Download

memory/2240-22-0x0000000007FF0000-0x0000000007FFE000-memory.dmp

Download

memory/2240-30-0x0000000051760000-0x00000000517F2000-memory.dmp

Download

memory/2240-31-0x0000000052360000-0x0000000052368000-memory.dmp

Download

memory/2240-33-0x0000000006A30000-0x0000000006A3E000-memory.dmp

Download

memory/2240-34-0x0000000052350000-0x0000000052351000-memory.dmp

Download

memory/2240-32-0x0000000052590000-0x00000000525C8000-memory.dmp

Download

memory/2240-36-0x0000000054A60000-0x0000000054AE2000-memory.dmp

Download

memory/2240-37-0x0000000054960000-0x0000000054992000-memory.dmp

Download

memory/2240-39-0x0000000054B10000-0x0000000054B26000-memory.dmp

Download

memory/2240-41-0x0000000054B00000-0x0000000054B0A000-memory.dmp

Download

memory/2240-42-0x0000000054B60000-0x0000000054B72000-memory.dmp

Download

memory/2240-40-0x0000000054AF0000-0x0000000054AFA000-memory.dmp

Download

memory/2240-35-0x00000000549B0000-0x0000000054A60000-memory.dmp

Download

memory/2240-5-0x0000000005F00000-0x0000000005FA2000-memory.dmp

Download

memory/2240-125-0x00000000560E0000-0x000000005612C000-memory.dmp

Download

memory/2240-3-0x0000000005D60000-0x0000000005D6A000-memory.dmp

Download

memory/2240-106-0x00000000559E0000-0x0000000056008000-memory.dmp

Download

memory/2240-2-0x0000000005DA0000-0x0000000005DE6000-memory.dmp

Download

memory/2240-115-0x0000000054C20000-0x0000000054C56000-memory.dmp

Download

memory/2240-114-0x0000000054BC0000-0x0000000054BDA000-memory.dmp

Download

memory/2240-117-0x0000000054C00000-0x0000000054C1E000-memory.dmp

Download

memory/2240-116-0x0000000056690000-0x0000000056D0A000-memory.dmp

Download

memory/2240-118-0x00000000552E0000-0x0000000055376000-memory.dmp

Download

memory/2240-121-0x0000000055600000-0x000000005564A000-memory.dmp

Download

memory/2240-120-0x0000000052180000-0x000000005219E000-memory.dmp

Download

memory/2240-123-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-0-0x0000000000E80000-0x0000000001046000-memory.dmp

Download

memory/2240-119-0x0000000056D10000-0x00000000572B4000-memory.dmp

Download

memory/2240-6-0x0000000005FB0000-0x0000000006016000-memory.dmp

Download

memory/2240-1-0x0000000003410000-0x0000000003436000-memory.dmp

Download

memory/2240-16-0x0000000006C60000-0x0000000006C68000-memory.dmp

Download

memory/2240-135-0x00000000572C0000-0x0000000057363000-memory.dmp

Download

memory/2240-136-0x0000000057370000-0x000000005737A000-memory.dmp

Download

memory/2240-137-0x00000000573D0000-0x00000000573E0000-memory.dmp

Download

memory/2240-139-0x00000000577D0000-0x00000000577D8000-memory.dmp

Download

memory/2240-141-0x0000000057B00000-0x0000000057B1E000-memory.dmp

Download

memory/2240-140-0x00000000577E0000-0x00000000577F0000-memory.dmp

Download

memory/2240-142-0x0000000057840000-0x0000000057848000-memory.dmp

Download

memory/2240-138-0x0000000057800000-0x000000005783A000-memory.dmp

Download

memory/2240-145-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-152-0x0000000051A20000-0x0000000051A31000-memory.dmp

Download

memory/2240-155-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-153-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-154-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-156-0x00000000562B0000-0x00000000562E2000-memory.dmp

Download

memory/2240-159-0x0000000057A50000-0x0000000057A66000-memory.dmp

Download

memory/2240-158-0x0000000056180000-0x000000005618A000-memory.dmp

Download

memory/2240-157-0x0000000056340000-0x0000000056352000-memory.dmp

Download

memory/2240-164-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2240-165-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-166-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-169-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-168-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-171-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-170-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-173-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-172-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-175-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-174-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-177-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-176-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-179-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-178-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-181-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-180-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-183-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-182-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-185-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-184-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-187-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-186-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-189-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-188-0x000000006DA80000-0x000000006E806000-memory.dmp

Download

memory/2240-191-0x000000006C890000-0x000000006D050000-memory.dmp

Download

memory/2240-190-0x000000006DA80000-0x000000006E806000-memory.dmp

Download