9d80eb02ef8ce14dc9d911920068bcaddf464663256592293c0e8fcfe4f4c745

Analysis

user interaction
yes
max time kernel
96s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fm_protected (2).exe
Size 6.5MB
Sample260930-rlatmavclb
SHA256 9d80eb02ef8ce14dc9d911920068bcaddf464663256592293c0e8fcfe4f4c745
MD5 7c5000b5e8db7d69ed8447ef8d560c31
SHA1 e4b1c612a246579c1e3b5970299c93a39cc4b80a
SHA512 43da451c9f78f2a9ffc14f93d92df935bbf446f6a93303b5d51258609c0f265d13bc217f69dfe1d534ae4ccfd8f5bac8a7068437ec89d42a6a73f06a7557b1fa
SSDEEP 98304:DHyCNy3/7sfkc6VuOuFkcFtHOnWvgf0OBhHmA7irr0NbmmUynKs2JmufXlRzUYTB:DSCNyTLcD8tt+61NKs2JxfP7Tl/P
TLSH
T17966332E71D9E881ED6520FC4637A89B3D437E6C3193B00461243ED94E3737AA9A53E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4816	powershell.exe
1892	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
688	najfk.exe
2592	r2uxhr0s.2su.exe
4824	wlanext.exe
4548	wqqhrefw.5n0.exe
3788	wlanext.exe
3964	sjla4caw.jex.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Masonwlanext.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Tasks\Masonnajfk.exe	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCoreUAC{78F388DB-0303-40AJ-A80B-51537E33362A}	svchost.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3168	sc.exe
1432	sc.exe
5732	sc.exe
3740	sc.exe
2184	sc.exe
4020	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fm_protected (2).exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790777820"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 28 Sep 2026 14:12:01 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={E2530C13-D31D-4268-9DDE-4CB2A1D79137}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4236	SCHTASKS.exe
3580	SCHTASKS.exe
1856	SCHTASKS.exe
2140	SCHTASKS.exe
4720	SCHTASKS.exe
3712	SCHTASKS.exe
4640	SCHTASKS.exe
4176	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
4816	powershell.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
4816	powershell.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2592	r2uxhr0s.2su.exe
2316	wmiprvse.exe
2316	wmiprvse.exe
2592	r2uxhr0s.2su.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1060	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	najfk.exe
Token: SeDebugPrivilege	2592	r2uxhr0s.2su.exe
Token: SeShutdownPrivilege	1060	explorer.exe
Token: SeCreatePagefilePrivilege	1060	explorer.exe
Token: SeShutdownPrivilege	1060	explorer.exe
Token: SeCreatePagefilePrivilege	1060	explorer.exe
Token: SeShutdownPrivilege	1060	explorer.exe
Token: SeCreatePagefilePrivilege	1060	explorer.exe
Token: SeShutdownPrivilege	1060	explorer.exe
Token: SeCreatePagefilePrivilege	1060	explorer.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeIncreaseQuotaPrivilege	4816	powershell.exe
Token: SeSecurityPrivilege	4816	powershell.exe
Token: SeTakeOwnershipPrivilege	4816	powershell.exe
Token: SeLoadDriverPrivilege	4816	powershell.exe
Token: SeSystemProfilePrivilege	4816	powershell.exe
Token: SeSystemtimePrivilege	4816	powershell.exe
Token: SeProfSingleProcessPrivilege	4816	powershell.exe
Token: SeIncBasePriorityPrivilege	4816	powershell.exe
Token: SeCreatePagefilePrivilege	4816	powershell.exe
Token: SeBackupPrivilege	4816	powershell.exe
Token: SeRestorePrivilege	4816	powershell.exe
Token: SeShutdownPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeSystemEnvironmentPrivilege	4816	powershell.exe
Token: SeRemoteShutdownPrivilege	4816	powershell.exe
Token: SeUndockPrivilege	4816	powershell.exe
Token: SeManageVolumePrivilege	4816	powershell.exe
Token: 33	4816	powershell.exe
Token: 34	4816	powershell.exe
Token: 35	4816	powershell.exe
Token: 36	4816	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3596	svchost.exe
Token: SeIncreaseQuotaPrivilege	3596	svchost.exe
Token: SeSecurityPrivilege	3596	svchost.exe
Token: SeTakeOwnershipPrivilege	3596	svchost.exe
Token: SeLoadDriverPrivilege	3596	svchost.exe
Token: SeSystemtimePrivilege	3596	svchost.exe
Token: SeBackupPrivilege	3596	svchost.exe
Token: SeRestorePrivilege	3596	svchost.exe
Token: SeShutdownPrivilege	3596	svchost.exe
Token: SeSystemEnvironmentPrivilege	3596	svchost.exe
Token: SeUndockPrivilege	3596	svchost.exe
Token: SeManageVolumePrivilege	3596	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3596	svchost.exe
Token: SeIncreaseQuotaPrivilege	3596	svchost.exe
Token: SeSecurityPrivilege	3596	svchost.exe
Token: SeTakeOwnershipPrivilege	3596	svchost.exe
Token: SeLoadDriverPrivilege	3596	svchost.exe
Token: SeSystemtimePrivilege	3596	svchost.exe
Token: SeBackupPrivilege	3596	svchost.exe
Token: SeRestorePrivilege	3596	svchost.exe
Token: SeShutdownPrivilege	3596	svchost.exe
Token: SeSystemEnvironmentPrivilege	3596	svchost.exe
Token: SeUndockPrivilege	3596	svchost.exe
Token: SeManageVolumePrivilege	3596	svchost.exe
Token: SeShutdownPrivilege	1060	explorer.exe
Token: SeCreatePagefilePrivilege	1060	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3596	svchost.exe
Token: SeIncreaseQuotaPrivilege	3596	svchost.exe
Token: SeSecurityPrivilege	3596	svchost.exe
Token: SeTakeOwnershipPrivilege	3596	svchost.exe
Token: SeLoadDriverPrivilege	3596	svchost.exe
Token: SeSystemtimePrivilege	3596	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	Conhost.exe
2576	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 688	2392	fm_protected (2).exe	89
PID 688 wrote to memory of 2592	688	najfk.exe	90
PID 688 wrote to memory of 1856	688	najfk.exe	91
PID 2592 wrote to memory of 744	2592	r2uxhr0s.2su.exe	5
PID 2592 wrote to memory of 964	2592	r2uxhr0s.2su.exe	9
PID 2592 wrote to memory of 972	2592	r2uxhr0s.2su.exe	10
PID 2592 wrote to memory of 1012	2592	r2uxhr0s.2su.exe	11
PID 2592 wrote to memory of 1028	2592	r2uxhr0s.2su.exe	13
PID 2592 wrote to memory of 1124	2592	r2uxhr0s.2su.exe	14
PID 2592 wrote to memory of 1176	2592	r2uxhr0s.2su.exe	15
PID 2592 wrote to memory of 1228	2592	r2uxhr0s.2su.exe	16
PID 2592 wrote to memory of 1312	2592	r2uxhr0s.2su.exe	17
PID 2592 wrote to memory of 1328	2592	r2uxhr0s.2su.exe	18
PID 2592 wrote to memory of 1372	2592	r2uxhr0s.2su.exe	19
PID 2592 wrote to memory of 1472	2592	r2uxhr0s.2su.exe	22
PID 2592 wrote to memory of 1588	2592	r2uxhr0s.2su.exe	23
PID 2592 wrote to memory of 1612	2592	r2uxhr0s.2su.exe	24
PID 2592 wrote to memory of 1708	2592	r2uxhr0s.2su.exe	25
PID 2592 wrote to memory of 1732	2592	r2uxhr0s.2su.exe	26
PID 2592 wrote to memory of 1744	2592	r2uxhr0s.2su.exe	27
PID 2592 wrote to memory of 1976	2592	r2uxhr0s.2su.exe	28
PID 2592 wrote to memory of 1288	2592	r2uxhr0s.2su.exe	29
PID 2592 wrote to memory of 1888	2592	r2uxhr0s.2su.exe	30
PID 2592 wrote to memory of 2096	2592	r2uxhr0s.2su.exe	31
PID 2592 wrote to memory of 2112	2592	r2uxhr0s.2su.exe	32
PID 2592 wrote to memory of 2248	2592	r2uxhr0s.2su.exe	33
PID 2592 wrote to memory of 2288	2592	r2uxhr0s.2su.exe	34
PID 2592 wrote to memory of 2352	2592	r2uxhr0s.2su.exe	35
PID 2592 wrote to memory of 2496	2592	r2uxhr0s.2su.exe	36
PID 2592 wrote to memory of 2528	2592	r2uxhr0s.2su.exe	37
PID 2592 wrote to memory of 2620	2592	r2uxhr0s.2su.exe	38
PID 2592 wrote to memory of 2632	2592	r2uxhr0s.2su.exe	39
PID 2592 wrote to memory of 2768	2592	r2uxhr0s.2su.exe	40
PID 2592 wrote to memory of 2780	2592	r2uxhr0s.2su.exe	41
PID 2592 wrote to memory of 2792	2592	r2uxhr0s.2su.exe	42
PID 2592 wrote to memory of 3004	2592	r2uxhr0s.2su.exe	43
PID 2592 wrote to memory of 3064	2592	r2uxhr0s.2su.exe	44
PID 2592 wrote to memory of 2952	2592	r2uxhr0s.2su.exe	45
PID 2592 wrote to memory of 3084	2592	r2uxhr0s.2su.exe	46
PID 2592 wrote to memory of 3216	2592	r2uxhr0s.2su.exe	48
PID 2592 wrote to memory of 3440	2592	r2uxhr0s.2su.exe	49
PID 2592 wrote to memory of 3508	2592	r2uxhr0s.2su.exe	50
PID 2592 wrote to memory of 3532	2592	r2uxhr0s.2su.exe	51
PID 2592 wrote to memory of 3572	2592	r2uxhr0s.2su.exe	52
PID 2592 wrote to memory of 3588	2592	r2uxhr0s.2su.exe	53
PID 2592 wrote to memory of 3596	2592	r2uxhr0s.2su.exe	54
PID 2592 wrote to memory of 3620	2592	r2uxhr0s.2su.exe	55
PID 2592 wrote to memory of 3180	2592	r2uxhr0s.2su.exe	56
PID 2592 wrote to memory of 472	2592	r2uxhr0s.2su.exe	57
PID 2592 wrote to memory of 4352	2592	r2uxhr0s.2su.exe	58
PID 2592 wrote to memory of 4396	2592	r2uxhr0s.2su.exe	59
PID 2592 wrote to memory of 4440	2592	r2uxhr0s.2su.exe	60
PID 2592 wrote to memory of 4624	2592	r2uxhr0s.2su.exe	61
PID 2592 wrote to memory of 4672	2592	r2uxhr0s.2su.exe	62
PID 2592 wrote to memory of 4924	2592	r2uxhr0s.2su.exe	63
PID 2592 wrote to memory of 5140	2592	r2uxhr0s.2su.exe	64
PID 2592 wrote to memory of 5240	2592	r2uxhr0s.2su.exe	65
PID 2592 wrote to memory of 5460	2592	r2uxhr0s.2su.exe	67
PID 2592 wrote to memory of 5920	2592	r2uxhr0s.2su.exe	70
PID 2592 wrote to memory of 832	2592	r2uxhr0s.2su.exe	71
PID 2592 wrote to memory of 4600	2592	r2uxhr0s.2su.exe	73
PID 2592 wrote to memory of 1068	2592	r2uxhr0s.2su.exe	76
PID 2592 wrote to memory of 4468	2592	r2uxhr0s.2su.exe	77
PID 2592 wrote to memory of 5652	2592	r2uxhr0s.2su.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1176

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d254216f-1dc6-460b-a51b-e2cd92dc4cf3 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6d67ed3a-8a64-4b12-9b13-e6a08af720f7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-02e282a4-2ace-4c6f-a301-3cbd769b7ad7 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-38e88dd4-bb0f-4466-9c26-15a9737b74e5 -LifetimeId:c4da851e-5101-4683-b2e7-5b6cd3bcfeaa -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1708
- C:\Users\Admin\AppData\Roaming\wlanext.exe
  "C:\Users\Admin\AppData\Roaming\wlanext.exe"
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\sjla4caw.jex.exe
    "C:\Users\Admin\AppData\Local\Temp\sjla4caw.jex.exe"
    3⤵
    - Executes dropped EXE
    PID:3964
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4240
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4408
- C:\Users\Admin\AppData\Roaming\wlanext.exe
  "C:\Users\Admin\AppData\Roaming\wlanext.exe"
  2⤵
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\ibaw42pf.xvv.exe
    "C:\Users\Admin\AppData\Local\Temp\ibaw42pf.xvv.exe"
    3⤵
    PID:1780
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1976
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5652
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\fm_protected (2).exe
      "C:\Users\Admin\AppData\Local\Temp\fm_protected (2).exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\najfk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\najfk.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\r2uxhr0s.2su.exe
        
        "C:\Users\Admin\AppData\Local\Temp\r2uxhr0s.2su.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
      - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonnajfk.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\najfk.exe'" /sc onlogon /rl HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1856
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5668
      - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonnajfk.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\najfk.exe'" /sc onlogon /rl HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2140
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\wlanext.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wlanext.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1892
  - - C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      4⤵
      PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2620
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3216

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:472

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4672

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5140

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1068

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4468

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5968

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2408

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:904

C:\Users\Admin\AppData\Roaming\wlanext.exe
C:\Users\Admin\AppData\Roaming\wlanext.exe
1⤵
- Executes dropped EXE
PID:4824
- C:\Users\Admin\AppData\Local\Temp\wqqhrefw.5n0.exe
  "C:\Users\Admin\AppData\Local\Temp\wqqhrefw.5n0.exe"
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4720
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masonwlanext.exe" /tr "'C:\Users\Admin\AppData\Roaming\wlanext.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3128
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop wlanext
  2⤵
  - Launches sc.exe
  PID:3168
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete wlanext
  2⤵
  - Launches sc.exe
  PID:1432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5736
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create wlanext binPath= "C:\Windows\System32\wlanext.exe /service" type= own start= auto
  2⤵
  - Launches sc.exe
  PID:5732
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description wlanext "Windows Security Update Service"
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure wlanext reset= 3600 actions= restart/10000
  2⤵
  - Launches sc.exe
  PID:2184
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start wlanext
  2⤵
  - Launches sc.exe
  PID:4020

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5104

C:\Windows\System32\wlanext.exe
C:\Windows\System32\wlanext.exe /service
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4viorkrr.mo3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4viorkrr.mo3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

najfk.exe

Path C:\Users\Admin\AppData\Local\Temp\najfk.exe
Size 6.4MB
SHA256 7af47b649dc442f6caa4ae8d90129c594f8954848924045013942d4b5e6fd7dd
MD5 fc7b1eda0ec28c137fa4e772225c9ae2
SHA1 03dbf78e862d1dd8fc02e5bebc8ec613b1bbf0cb
SHA512 eac731f7b4b438cd0e0500cf6558b51e6b9cb94e65936e7150dd90fff9f8d77a43ed79366226a6b2ba03fd4ca3e6bcaf819e10c8f71faec312c388bf9e3768d9
SSDEEP 196608:nLxSXRgIRximMnUWxBJ/BH5icKqvXnyUFkvB:kgIRximMnLrJ/BH5icKqv37kv
TLSH
T1EC661262FBB0C24ACD5C17FB9B326252A978B0754920DCF83698F0E46D73781950BBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r2uxhr0s.2su.exe

Path C:\Users\Admin\AppData\Local\Temp\r2uxhr0s.2su.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 69KB
SHA256 b8221a2417150b6f1caa4c5a4c56a9ab76db2c2c6d0461d038f708d38d942da2
MD5 efd116151b204eb171e56b179401d1d8
SHA1 8de7ad81490806c83b230f873be37d3a57f39efd
SHA512 f3b6bbee8f21811c36f8b43387247dc0a28709321f9046ef1c8539ef05c5c3d23e018c4622a94220fc8a5e946750ddee822f7bb46f306fb1f4f2ab1891db053f
SSDEEP 1536:r8LgGkPGaXlJAz2YzJQrGANEOoDfXastjCcIyCWCUc3oYm2K2dWDjTaonS5WDTF0:AVPSp
TLSH
T1D1635D0580DCC509D9B609B27267FEB2C57A659A731F4EEB30ED6304D9C2F042F7A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-20-0x00007FFAEF64F000-0x00007FFAEF650000-memory.dmp

Download

memory/688-25-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-333-0x000001FBAAD30000-0x000001FBAB366000-memory.dmp

Download

memory/688-405-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-577-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-23-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-24-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-762-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-26-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/688-21-0x000001FB92050000-0x000001FB9207C000-memory.dmp

Download

memory/688-17-0x000001FB8FDB0000-0x000001FB90416000-memory.dmp

Download

memory/744-38-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/744-36-0x000001AE1FDC0000-0x000001AE1FDE5000-memory.dmp

Download

memory/744-37-0x000001AE1FDF0000-0x000001AE1FE1B000-memory.dmp

Download

memory/916-882-0x000001D562780000-0x000001D562DE6000-memory.dmp

Download

memory/1012-119-0x0000020A3C150000-0x0000020A3C17B000-memory.dmp

Download

memory/1012-120-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1028-122-0x0000028948340000-0x000002894836B000-memory.dmp

Download

memory/1028-123-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1060-112-0x0000000003E80000-0x0000000003EAB000-memory.dmp

Download

memory/1060-113-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1124-126-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1124-125-0x00000269EC090000-0x00000269EC0BB000-memory.dmp

Download

memory/1176-47-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1176-46-0x0000026F62830000-0x0000026F6285B000-memory.dmp

Download

memory/1228-128-0x0000015676040000-0x000001567606B000-memory.dmp

Download

memory/1228-130-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1288-158-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1288-157-0x000001FE7CFD0000-0x000001FE7CFFB000-memory.dmp

Download

memory/1312-132-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1312-129-0x00000253F4880000-0x00000253F48AB000-memory.dmp

Download

memory/1328-134-0x000002AD93820000-0x000002AD9384B000-memory.dmp

Download

memory/1328-135-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1372-138-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1372-137-0x0000020F47DF0000-0x0000020F47E1B000-memory.dmp

Download

memory/1472-54-0x0000021C27120000-0x0000021C2714B000-memory.dmp

Download

memory/1472-55-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1588-141-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1588-140-0x0000020DB35F0000-0x0000020DB361B000-memory.dmp

Download

memory/1612-143-0x0000011C634A0000-0x0000011C634CB000-memory.dmp

Download

memory/1612-144-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1708-146-0x00000158B2E20000-0x00000158B2E4B000-memory.dmp

Download

memory/1708-147-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1732-150-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1732-149-0x0000017A93650000-0x0000017A9367B000-memory.dmp

Download

memory/1744-152-0x00000180D5B90000-0x00000180D5BBB000-memory.dmp

Download

memory/1744-153-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1888-160-0x00000178363E0000-0x000001783640B000-memory.dmp

Download

memory/1888-161-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/1976-155-0x0000020741BC0000-0x0000020741BEB000-memory.dmp

Download

memory/1976-156-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2096-164-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2096-163-0x000001B987560000-0x000001B98758B000-memory.dmp

Download

memory/2112-167-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2112-166-0x0000025952E20000-0x0000025952E4B000-memory.dmp

Download

memory/2248-169-0x0000014007A70000-0x0000014007A9B000-memory.dmp

Download

memory/2248-171-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2288-173-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2288-170-0x0000024DD3C00000-0x0000024DD3C2B000-memory.dmp

Download

memory/2352-175-0x00000185FB4D0000-0x00000185FB4FB000-memory.dmp

Download

memory/2352-176-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2392-19-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/2392-5-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/2392-18-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2392-0-0x00000000747F2000-0x00000000747F3000-memory.dmp

Download

memory/2392-1-0x0000000002800000-0x0000000002E74000-memory.dmp

Download

memory/2392-2-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/2392-3-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/2392-4-0x00000000747E0000-0x0000000074F9C000-memory.dmp

Download

memory/2496-179-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2496-178-0x0000023D056D0000-0x0000023D056FB000-memory.dmp

Download

memory/2528-181-0x000001DB9B640000-0x000001DB9B66B000-memory.dmp

Download

memory/2528-182-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2592-34-0x00007FFB12340000-0x00007FFB125A3000-memory.dmp

Download

memory/2592-35-0x00007FFB11560000-0x00007FFB11627000-memory.dmp

Download

memory/2620-184-0x000001AACAF20000-0x000001AACAF4B000-memory.dmp

Download

memory/2620-185-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2632-188-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/2632-187-0x000002003D410000-0x000002003D43B000-memory.dmp

Download

memory/2768-190-0x0000022A15730000-0x0000022A1575B000-memory.dmp

Download

memory/2768-191-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/4816-350-0x0000018168CE0000-0x0000018168D92000-memory.dmp

Download

memory/4816-351-0x0000018168950000-0x000001816895A000-memory.dmp

Download

memory/4816-349-0x0000018168930000-0x000001816894E000-memory.dmp

Download

memory/4816-346-0x00000181688A0000-0x00000181688C2000-memory.dmp

Download

memory/4824-404-0x0000027BFC8E0000-0x0000027BFCF46000-memory.dmp

Download

memory/4824-763-0x0000027B98000000-0x0000027B98606000-memory.dmp

Download

memory/4924-98-0x00007FFAD2480000-0x00007FFAD2490000-memory.dmp

Download

memory/4924-97-0x000001CF282A0000-0x000001CF282CB000-memory.dmp

Download