Overview

overview

10

Static

static

3

2026-08-17...ry.exe

windows10-2004-x64

10

2026-08-17...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 02:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_80e3af78a4ced6635f7d43a4321bf9a8_coinminer_elex_floxif_wannacry.exe
  • Size 731KB
  • Sample260817-ch8txs1fmg
  • SHA256 a1a97714529ebbfe9f761199d742a0fbcd30aa1392cf3f679a23f220c49b82ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionfloxifpersistenceprivilege_escalationspywaretrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • UPX dump on OEP (original entry point) 64 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Manipulates Digital Signatures 1 TTPs 5 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 17 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 44 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_80e3af78a4ced6635f7d43a4321bf9a8_coinminer_elex_floxif_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_80e3af78a4ced6635f7d43a4321bf9a8_coinminer_elex_floxif_wannacry.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AutoKMS\AutoKMS_VL_ALL.cmd" "
      2⤵
      • Badlisted process makes network request
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ver
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5648
      • C:\Windows\SysWOW64\reg.exe
        reg.exe query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1448
      • C:\Windows\SysWOW64\find.exe
        find /i "amd64"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1248
      • C:\Windows\SysWOW64\ROUTE.EXE
        route print
        3⤵
          PID:5424
        • C:\Windows\SysWOW64\find.exe
          find /i "TAP-Windows Adapter V9"
          3⤵
            PID:2688
          • C:\Windows\SysWOW64\certutil.exe
            certutil.exe -addstore -f "TrustedPublisher" tap0901.cer
            3⤵
            • Manipulates Digital Signatures
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3656
          • C:\Users\Admin\AppData\Local\Temp\AutoKMS\x64\devcon.exe
            x64\devcon.exe install x64\OemWin2k.inf tap0901
            3⤵
            • Manipulates Digital Signatures
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c route print | find /i "TAP-Windows Adapter V9"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1128
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3188
            • C:\Windows\SysWOW64\find.exe
              find /i "TAP-Windows Adapter V9"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5484
          • C:\Users\Admin\AppData\Local\Temp\AutoKMS\TunMirror.exe
            TunMirror.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2040
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 976
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:3428
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="KMSServer" dir=in program="C:\Users\Admin\AppData\Local\Temp\AutoKMS\KMS Server.exe" localport=1688 protocol=TCP action=allow remoteip=localsubnet
            3⤵
            • Modifies Windows Firewall
            • Loads dropped DLL
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3612
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="KMSServer" dir=out program="C:\Users\Admin\AppData\Local\Temp\AutoKMS\KMS Server.exe" localport=1688 protocol=TCP action=allow remoteip=localsubnet
            3⤵
            • Modifies Windows Firewall
            • Loads dropped DLL
            • Event Triggered Execution: Netsh Helper DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:240
          • C:\Users\Admin\AppData\Local\Temp\AutoKMS\KMS Server.exe
            "KMS Server.exe" 1688 RandomKMSPID 43200 43200 KillProcessOnPort
            3⤵
            • Executes dropped EXE
            PID:4856
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 3 /nobreak
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:3608
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ver
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:4152
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4104
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i Office
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:6128
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5224
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i Windows
            3⤵
            • Loads dropped DLL
            PID:5364
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingService get version /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6060
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingService get version /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1108
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call SetKeyManagementServiceMachine MachineName="10.3.0.3"
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3148
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call SetKeyManagementServicePort 1688
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1460
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get ID /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4568
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get ID /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5704
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' get Name /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' get Name /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4424
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' get LicenseStatus /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3856
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' get LicenseStatus /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4860
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%VOLUME_MAK%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2576
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            PID:2296
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%OEM%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4784
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:6124
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%System, RETAIL%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5464
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3252
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%7, RETAIL%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:5320
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2852
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c cscript /nologo "C:\Users\Admin\AppData\Local\Temp\key.vbs"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\Windows\SysWOW64\cscript.exe
              cscript /nologo "C:\Users\Admin\AppData\Local\Temp\key.vbs"
              4⤵
              • Loads dropped DLL
              • Executes a VBScript file via the Windows Script Host.
              • System Location Discovery: System Language Discovery
              PID:2648
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call InstallProductKey ProductKey=""
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4936
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' call ClearKeyManagementServiceMachine
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3376
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' call ClearKeyManagementServicePort
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5032
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee' call Activate
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2028
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' get Name /format:list"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3640
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' get Name /format:list
              4⤵
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:2432
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' get LicenseStatus /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2472
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' get LicenseStatus /format:list
              4⤵
              • Loads dropped DLL
              PID:1048
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%VOLUME_MAK%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3500
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5424
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%OEM%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2604
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4448
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%System, RETAIL%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            PID:2412
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2268
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where (Description like '%7, RETAIL%') get LicenseStatus /format:list
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3408
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i 1
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3556
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c cscript /nologo "C:\Users\Admin\AppData\Local\Temp\key.vbs"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2860
            • C:\Windows\SysWOW64\cscript.exe
              cscript /nologo "C:\Users\Admin\AppData\Local\Temp\key.vbs"
              4⤵
              • Loads dropped DLL
              • Executes a VBScript file via the Windows Script Host.
              PID:5524
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call InstallProductKey ProductKey=""
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5912
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' call ClearKeyManagementServiceMachine
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2648
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' call ClearKeyManagementServicePort
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1668
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='59eb965c-9150-42b7-a0ec-22151b9897c5' call Activate
            3⤵
            • Loads dropped DLL
            PID:5116
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' get Name /format:list"
            3⤵
            • Executes a command shell one-liner
            PID:5260
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' get Name /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:5820
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' get LicenseStatus /format:list"
            3⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:2456
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' get LicenseStatus /format:list
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3236
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call ClearKeyManagementServiceMachine
            3⤵
            • Loads dropped DLL
            PID:4424
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call ClearKeyManagementServicePort
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3308
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call Activate
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2688
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call ClearKeyManagementServiceMachine
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2412
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 856
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:1772
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 908
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:4108
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path SoftwareLicensingService where version='10.0.26100.1742' call ClearKeyManagementServicePort
            3⤵
              PID:1296
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 816
                4⤵
                • Program crash
                PID:3256
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 924
                4⤵
                • Program crash
                PID:464
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingService where version='10.0.26100.1742' call DisableKeyManagementServiceDnsPublishing 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:976
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 860
                4⤵
                • Program crash
                PID:3316
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 928
                4⤵
                • Program crash
                PID:1376
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path SoftwareLicensingService where version='10.0.26100.1742' call DisableKeyManagementServiceHostCaching 1
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4888
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 860
                4⤵
                • Program crash
                PID:5332
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 924
                4⤵
                • Program crash
                PID:4692
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\55c92734-d682-4d71-983e-d6ec3f16059f /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1108
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"\0ff1ce15-a989-479d-af46-f275c6370663 /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2376
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ver
              3⤵
              • Executes a command shell one-liner
              PID:5724
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic path OfficeSoftwareProtectionService get version /format:list
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5700
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 860
                4⤵
                • Program crash
                PID:3516
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 932
                4⤵
                • Program crash
                PID:1636
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /t /f /IM "KMS Server.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4904
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /t /f /IM tunmirror.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:3008
            • C:\Users\Admin\AppData\Local\Temp\AutoKMS\x64\devcon.exe
              x64\devcon.exe remove tap0901
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:3436
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="KMSServer"
              3⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:4560
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{494a089f-2e7d-3a47-914d-e7434f6d5113}\oemwin2k.inf" "9" "4d14a44ff" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\users\admin\appdata\local\temp\autokms\x64"
          1⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4880
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.9:tap0901," "4d14a44ff" "0000000000000180" "f06e"
          1⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4412
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2040 -ip 2040
          1⤵
          • Loads dropped DLL
          PID:2764
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:6052
          • C:\Windows\system32\SppExtComObj.exe
            C:\Windows\system32\SppExtComObj.exe -Embedding
            1⤵
              PID:5424
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2412 -ip 2412
              1⤵
              • Loads dropped DLL
              PID:5756
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2412 -ip 2412
              1⤵
              • Loads dropped DLL
              PID:3652
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1296 -ip 1296
              1⤵
                PID:1260
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1296 -ip 1296
                1⤵
                  PID:5780
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 976 -ip 976
                  1⤵
                    PID:1504
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 976 -ip 976
                    1⤵
                      PID:4228
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4888 -ip 4888
                      1⤵
                        PID:716
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4888 -ip 4888
                        1⤵
                          PID:5572
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5700 -ip 5700
                          1⤵
                            PID:4136
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5700 -ip 5700
                            1⤵
                              PID:5704

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  2
                                  T1059

                                  Visual Basic

                                  1
                                  T1059.005

                                  Windows Command Shell

                                  1
                                  T1059.003

                                  Persistence

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  2
                                  T1546

                                  AppInit DLLs

                                  1
                                  T1546.010

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Privilege Escalation

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  2
                                  T1546

                                  AppInit DLLs

                                  1
                                  T1546.010

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Defense Evasion

                                  Impair Defenses

                                  1
                                  T1562

                                  Disable or Modify System Firewall

                                  1
                                  T1562.004

                                  Modify Registry

                                  1
                                  T1112

                                  Subvert Trust Controls

                                  2
                                  T1553

                                  Install Root Certificate

                                  1
                                  T1553.004

                                  SIP and Trust Provider Hijacking

                                  1
                                  T1553.003

                                  Credential Access

                                  Discovery

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  2
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  symsrv.dll
                                  • Path C:\Program Files\Common Files\System\symsrv.dll
                                  • Size 67KB
                                  • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AutoKMS_VL_ALL.cmd
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\AutoKMS_VL_ALL.cmd
                                  • Size 20KB
                                  • SHA256 1d9bbf959afd261866ff8e0043043d19728b5b6ee1d630cd968500cdec55db06
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  KMS Server.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\KMS Server.exe
                                  • Size 231KB
                                  • SHA256 794dcf1d4777307ac7519cf61209a7893f438f3cb7b960697b371fb686e8671d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  KMS Server.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\KMS Server.exe
                                  • Size 307KB
                                  • SHA256 706974325d151f76d62552dc7491e8020f33b7ceb44737593816b65557c8b09d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  TunMirror.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\TunMirror.exe
                                  • Size 10KB
                                  • SHA256 cf206430de1df9d47e964c0658807076362416d9e890c596a2bc7861c78882f7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  tap0901.cer
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\tap0901.cer
                                  • Size 1KB
                                  • SHA256 669c56db590c0308ea25c4508375bb88611b06b1ae689a895dc6b19f4df5619c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  OemWin2k.inf
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\x64\OemWin2k.inf
                                  • Size 7KB
                                  • SHA256 a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  devcon.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\AutoKMS\x64\devcon.exe
                                  • Size 80KB
                                  • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  key.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\key.vbs
                                  • Size 4KB
                                  • SHA256 bbdf49dff52e5a39a54689ce500766f84f2725f67255303086f317e610c0bf82
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  key.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\key.vbs
                                  • Size 7KB
                                  • SHA256 523ca8a759b67cbaa8dae0a2169958fd5f272927ab20999c8e06466b40257cb1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  key.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\key.vbs
                                  • Size 4KB
                                  • SHA256 d6576ba910b203b0e0fb421cb5e7f161773eb398ef2672e8fe89187de32be27d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  key.vbs
                                  • Path C:\Users\Admin\AppData\Local\Temp\key.vbs
                                  • Size 7KB
                                  • SHA256 edf222448ae511b9200cdbac4bc6d450441dcbbc16929d6ccb21696dad25d609
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  oemwin2k.inf_amd64_5a1fec2fbbccefcc.ini
                                  • Path C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc.ini
                                  • Size 418B
                                  • SHA256 6400744fd04b597fe93cb26ec3460905ba34abe9cb87e0206cae7602a3c67541
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  symsrv.dll.000
                                  • Path \??\c:\progra~1\common~1\system\symsrv.dll.000
                                  • Size 114B
                                  • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tap0901.cat
                                  • Path \??\c:\users\admin\appdata\local\temp\autokms\x64\tap0901.cat
                                  • Size 10KB
                                  • SHA256 6f997d53abfc991e23f08256fbde3eb21a1680af2e504b7accfef0f1d8909503
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  tap0901.sys
                                  • Path \??\c:\users\admin\appdata\local\temp\autokms\x64\tap0901.sys
                                  • Size 39KB
                                  • SHA256 55cfcec7f026c6e2e96a2fbe846ab513bb12bb0348735274fe1b71af019c837b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  memory/240-79-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/240-77-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/976-479-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/976-478-0x0000000003030000-0x0000000003060000-memory.dmp
                                  Download

                                  memory/976-480-0x0000000003030000-0x000000000303C000-memory.dmp
                                  Download

                                  memory/976-477-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1048-294-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1048-292-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1108-112-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1108-110-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1296-475-0x0000000003000000-0x0000000003030000-memory.dmp
                                  Download

                                  memory/1296-476-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1296-474-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1460-121-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1460-118-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1668-434-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/1668-432-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2028-282-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2028-284-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2040-68-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2040-85-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2040-71-0x00000000005F0000-0x00000000005F8000-memory.dmp
                                  Download

                                  memory/2268-311-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2268-317-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2296-136-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2296-142-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2412-313-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2412-473-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2412-472-0x0000000003900000-0x0000000003930000-memory.dmp
                                  Download

                                  memory/2412-471-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2412-315-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2432-286-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2432-288-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2576-140-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2576-138-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2604-307-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2604-305-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2648-431-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2648-268-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2648-265-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2648-430-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2688-469-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2688-450-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2688-464-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2852-166-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/2852-162-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3148-116-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3148-114-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3236-444-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3236-442-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3252-154-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3252-160-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3308-448-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3376-275-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3376-277-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3408-322-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3408-321-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3500-298-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3500-300-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3556-319-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3556-324-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3608-83-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3608-91-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3612-70-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3612-75-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3656-46-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/3656-49-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4104-97-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4104-100-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-93-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-4-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-504-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-135-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-461-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4144-439-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4424-447-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4424-446-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4424-129-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4424-127-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4448-309-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4448-304-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4560-496-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4784-148-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4784-149-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4856-456-0x0000000000AD0000-0x0000000000B0E000-memory.dmp
                                  Download

                                  memory/4860-131-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4860-133-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4888-483-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4888-482-0x0000000003690000-0x00000000036C0000-memory.dmp
                                  Download

                                  memory/4888-481-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4904-489-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4936-273-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/4936-270-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5032-279-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5032-280-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5116-438-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5116-435-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5224-104-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5224-107-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5320-164-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5320-165-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5364-106-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5364-108-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5424-296-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5424-301-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5464-156-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5464-158-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5524-423-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5524-425-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-445-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-43-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-153-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-497-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-96-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-494-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5616-462-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5700-485-0x0000000003820000-0x0000000003850000-memory.dmp
                                  Download

                                  memory/5700-484-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5700-486-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5704-123-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5704-125-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5820-440-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5820-441-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5912-429-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/5912-427-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/6124-146-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/6124-151-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/6128-102-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download

                                  memory/6128-94-0x0000000010000000-0x0000000010030000-memory.dmp
                                  Download