7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
Size 6.0MB
Sample260707-e9ca5sez8m
SHA256 7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a
MD5 f17af9ad6ea4e11d1c2316703e1fea36
SHA1 9f8a915b70f36059c12764b55b9f81a91953003d
SHA512 3a44625211760eac3395374df0ea3e40fc256748e74660e81f39bb5cdbcf1313e3b8afeaa56e66f9eba687335f9c876c83f619b958b8a281a4827172a1086275
SSDEEP 98304:1zgGE4MS0GGRiEHwCK/uk9HceVpup5dyq7rY9fgLfFL2N4F4GRMtvgMtWO:mQGQEHfK//HLVQp5rXyfE12NTGAvN
TLSH
T18B56335B3A0EB04DCA687279A6EB3FAC37534537015A87F91A4F71CD1A72069CC85CA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence upx vmprotect

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

Loads dropped DLL 2 IoCs

pid	Process
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

VMProtect packed file 15 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2332-10-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-61-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-62-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-64-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-65-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-70-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-71-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-72-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-73-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-74-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-75-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-76-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-77-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-86-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect
behavioral1/memory/2332-88-0x0000000000400000-0x00000000012B4000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2332-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	312	WMIC.exe
Token: SeSecurityPrivilege	312	WMIC.exe
Token: SeTakeOwnershipPrivilege	312	WMIC.exe
Token: SeLoadDriverPrivilege	312	WMIC.exe
Token: SeSystemProfilePrivilege	312	WMIC.exe
Token: SeSystemtimePrivilege	312	WMIC.exe
Token: SeProfSingleProcessPrivilege	312	WMIC.exe
Token: SeIncBasePriorityPrivilege	312	WMIC.exe
Token: SeCreatePagefilePrivilege	312	WMIC.exe
Token: SeBackupPrivilege	312	WMIC.exe
Token: SeRestorePrivilege	312	WMIC.exe
Token: SeShutdownPrivilege	312	WMIC.exe
Token: SeDebugPrivilege	312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	312	WMIC.exe
Token: SeRemoteShutdownPrivilege	312	WMIC.exe
Token: SeUndockPrivilege	312	WMIC.exe
Token: SeManageVolumePrivilege	312	WMIC.exe
Token: 33	312	WMIC.exe
Token: 34	312	WMIC.exe
Token: 35	312	WMIC.exe
Token: 36	312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1780	WMIC.exe
Token: SeSecurityPrivilege	1780	WMIC.exe
Token: SeTakeOwnershipPrivilege	1780	WMIC.exe
Token: SeLoadDriverPrivilege	1780	WMIC.exe
Token: SeSystemProfilePrivilege	1780	WMIC.exe
Token: SeSystemtimePrivilege	1780	WMIC.exe
Token: SeProfSingleProcessPrivilege	1780	WMIC.exe
Token: SeIncBasePriorityPrivilege	1780	WMIC.exe
Token: SeCreatePagefilePrivilege	1780	WMIC.exe
Token: SeBackupPrivilege	1780	WMIC.exe
Token: SeRestorePrivilege	1780	WMIC.exe
Token: SeShutdownPrivilege	1780	WMIC.exe
Token: SeDebugPrivilege	1780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1780	WMIC.exe
Token: SeRemoteShutdownPrivilege	1780	WMIC.exe
Token: SeUndockPrivilege	1780	WMIC.exe
Token: SeManageVolumePrivilege	1780	WMIC.exe
Token: 33	1780	WMIC.exe
Token: 34	1780	WMIC.exe
Token: 35	1780	WMIC.exe
Token: 36	1780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	312	WMIC.exe
Token: SeSecurityPrivilege	312	WMIC.exe
Token: SeTakeOwnershipPrivilege	312	WMIC.exe
Token: SeLoadDriverPrivilege	312	WMIC.exe
Token: SeSystemProfilePrivilege	312	WMIC.exe
Token: SeSystemtimePrivilege	312	WMIC.exe
Token: SeProfSingleProcessPrivilege	312	WMIC.exe
Token: SeIncBasePriorityPrivilege	312	WMIC.exe
Token: SeCreatePagefilePrivilege	312	WMIC.exe
Token: SeBackupPrivilege	312	WMIC.exe
Token: SeRestorePrivilege	312	WMIC.exe
Token: SeShutdownPrivilege	312	WMIC.exe
Token: SeDebugPrivilege	312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	312	WMIC.exe
Token: SeRemoteShutdownPrivilege	312	WMIC.exe
Token: SeUndockPrivilege	312	WMIC.exe
Token: SeManageVolumePrivilege	312	WMIC.exe
Token: 33	312	WMIC.exe
Token: 34	312	WMIC.exe
Token: 35	312	WMIC.exe
Token: 36	312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3632	WMIC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2228	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	93
PID 2332 wrote to memory of 3304	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	95
PID 2228 wrote to memory of 312	2228	cmd.exe	97
PID 2332 wrote to memory of 1832	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	98
PID 3304 wrote to memory of 1780	3304	cmd.exe	100
PID 1832 wrote to memory of 3632	1832	cmd.exe	101
PID 2332 wrote to memory of 3300	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	102
PID 3300 wrote to memory of 1388	3300	cmd.exe	104
PID 2332 wrote to memory of 4324	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	105
PID 4324 wrote to memory of 4616	4324	cmd.exe	107
PID 2332 wrote to memory of 2656	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	109
PID 2656 wrote to memory of 4620	2656	cmd.exe	111
PID 2332 wrote to memory of 5096	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	112
PID 5096 wrote to memory of 5020	5096	cmd.exe	114
PID 2332 wrote to memory of 3584	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	115
PID 3584 wrote to memory of 3816	3584	cmd.exe	117
PID 2332 wrote to memory of 5040	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	118
PID 5040 wrote to memory of 824	5040	cmd.exe	120
PID 2332 wrote to memory of 564	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	121
PID 564 wrote to memory of 2416	564	cmd.exe	123
PID 2332 wrote to memory of 4632	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	124
PID 4632 wrote to memory of 2980	4632	cmd.exe	126
PID 2332 wrote to memory of 2456	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	129
PID 2456 wrote to memory of 4640	2456	cmd.exe	131
PID 2332 wrote to memory of 4196	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	133
PID 4196 wrote to memory of 4800	4196	cmd.exe	135
PID 2332 wrote to memory of 3196	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	137
PID 3196 wrote to memory of 5104	3196	cmd.exe	139
PID 2332 wrote to memory of 4920	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	141
PID 4920 wrote to memory of 980	4920	cmd.exe	143
PID 2332 wrote to memory of 2092	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	144
PID 2092 wrote to memory of 64	2092	cmd.exe	146
PID 2332 wrote to memory of 2892	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	147
PID 2892 wrote to memory of 4084	2892	cmd.exe	149
PID 2332 wrote to memory of 4928	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	150
PID 4928 wrote to memory of 1780	4928	cmd.exe	152
PID 2332 wrote to memory of 2140	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	153
PID 2140 wrote to memory of 4692	2140	cmd.exe	155
PID 2332 wrote to memory of 4296	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	156
PID 4296 wrote to memory of 4356	4296	cmd.exe	158
PID 2332 wrote to memory of 4152	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	159
PID 4152 wrote to memory of 1400	4152	cmd.exe	161
PID 2332 wrote to memory of 816	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	162
PID 816 wrote to memory of 5004	816	cmd.exe	164
PID 2332 wrote to memory of 824	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	165
PID 824 wrote to memory of 1580	824	cmd.exe	167
PID 2332 wrote to memory of 4600	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	168
PID 4600 wrote to memory of 964	4600	cmd.exe	170
PID 2332 wrote to memory of 2012	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	172
PID 2012 wrote to memory of 4680	2012	cmd.exe	174
PID 2332 wrote to memory of 4392	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	175
PID 4392 wrote to memory of 3184	4392	cmd.exe	177
PID 2332 wrote to memory of 5116	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	178
PID 5116 wrote to memory of 2588	5116	cmd.exe	180
PID 2332 wrote to memory of 4116	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	181
PID 4116 wrote to memory of 2208	4116	cmd.exe	183
PID 2332 wrote to memory of 3860	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	184
PID 3860 wrote to memory of 3736	3860	cmd.exe	186
PID 2332 wrote to memory of 780	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	187
PID 780 wrote to memory of 1756	780	cmd.exe	189
PID 2332 wrote to memory of 1284	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	190
PID 1284 wrote to memory of 440	1284	cmd.exe	192
PID 2332 wrote to memory of 1084	2332	7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe	193
PID 1084 wrote to memory of 2344	1084	cmd.exe	195

C:\Users\Admin\AppData\Local\Temp\7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe
"C:\Users\Admin\AppData\Local\Temp\7c96c0ca6a172ff4fda397c54e13c59ec19870b5792d0aaf399c2ba23667169a.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:64
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3532
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3628
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3816
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4936
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2384
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:364
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:872
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:932
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2536
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4608
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1908
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4652
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4160
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3328
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1904
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:924
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1228
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:796
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4800
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4604
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3864
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic COMPUTERSYSTEM get Manufacturer,Model,OEMStringArray
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libeay32.dll

Path C:\Users\Admin\AppData\Local\Temp\libeay32.dll
Size 1.1MB
SHA256 c548cd69756d2ce83bb7d2d372257111b158b8d6f167d4a7ccecd6f7d3b4d394
MD5 d5405dd640e870b1dd4f5b4bd08865bb
SHA1 bc73ae7346e125ffd53dd456c711d2cbb8f9ee34
SHA512 355bb4de5ea820ed0b260ac3302f3116b729fbf8bc72e82a11398439f8a926100ea48e08e5fc5daa8c1842e72a9e09a04bdf2db30a37d10e77b77825f9a16e36
SSDEEP 24576:A1dxBPCNuIDyCldvK5Yc6RMpMXwmIwYS:GkhyClJciRMpMXwmILS
TLSH
T1BA35AE06FB96CDB1F88D417D10B772BB4A337612536AD6D38BA22981DC211E1A73E3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-0-0x00000000008EE000-0x0000000000CB8000-memory.dmp

Download

memory/2332-7-0x00000000031D0000-0x00000000031D1000-memory.dmp

Download

memory/2332-6-0x00000000031C0000-0x00000000031C1000-memory.dmp

Download

memory/2332-10-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-5-0x00000000031B0000-0x00000000031B1000-memory.dmp

Download

memory/2332-4-0x0000000003190000-0x0000000003191000-memory.dmp

Download

memory/2332-3-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/2332-2-0x00000000015A0000-0x00000000015A1000-memory.dmp

Download

memory/2332-1-0x0000000001590000-0x0000000001591000-memory.dmp

Download

memory/2332-12-0x0000000050000000-0x0000000050109000-memory.dmp

Download

memory/2332-36-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-52-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-60-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-61-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-62-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-58-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-56-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-54-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-50-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-48-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-46-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-44-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-42-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-40-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-38-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-34-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-32-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-30-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-28-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-26-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-24-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-22-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-20-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-19-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-18-0x0000000010000000-0x000000001003E000-memory.dmp

Download

memory/2332-64-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-65-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-70-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-71-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-72-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-73-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-74-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-75-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-76-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-77-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-81-0x00000000075A0000-0x00000000076B7000-memory.dmp

Download

memory/2332-85-0x00000000008EE000-0x0000000000CB8000-memory.dmp

Download

memory/2332-86-0x0000000000400000-0x00000000012B4000-memory.dmp

Download

memory/2332-87-0x00000000008EE000-0x0000000000CB8000-memory.dmp

Download

memory/2332-88-0x0000000000400000-0x00000000012B4000-memory.dmp

Download