raccoon | 64dc2b5958fe37dd9733928c156e0c75ab544e2e0169f9f796c3f3db809bcbe5

Target

toolspab2 (13).exe
Size

315KB
MD5

1d20e1f65938e837ef1b88f10f1bd6c3
SHA1

703d7098dbfc476d2181b7fc041cc23e49c368f1
SHA256

05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d
SHA512

f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Score

10^/10

raccoon redline smokeloader 1 backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Extracted

Family

redline

Botnet

45.32.235.238:45555

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral10/memory/1448-148-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral10/memory/1448-149-0x0000000000417E96-mapping.dmp	family_redline
behavioral10/files/0x000200000001ab79-159.dat	family_redline
behavioral10/files/0x000200000001ab79-158.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
3544	B6D2.exe
3932	B82B.exe
2164	BC24.exe
2560	C05B.exe
2808	C2FC.exe
3828	C88B.exe
1448	BC24.exe
3176	CD9C.exe
3792	D30C.exe
3508	b2EP0a91ph.exe
3856	b2EP0a91ph.exe
4064	sqlcmd.exe
3156	sqlcmd.exe
3224	dbrieih
2128	dbrieih
2228	sqlcmd.exe
2744	sqlcmd.exe
3400	sqlcmd.exe
1844	sqlcmd.exe
2332	sqlcmd.exe
2152	sqlcmd.exe
656	sqlcmd.exe
3828	sqlcmd.exe
3848	sqlcmd.exe
3444	sqlcmd.exe
3496	sqlcmd.exe
3792	sqlcmd.exe
752	sqlcmd.exe
2764	sqlcmd.exe
2792	sqlcmd.exe
2496	sqlcmd.exe
3608	sqlcmd.exe
3920	sqlcmd.exe
188	sqlcmd.exe
3168	sqlcmd.exe
3924	dbrieih
1860	dbrieih
1164	sqlcmd.exe
1908	sqlcmd.exe
3472	sqlcmd.exe
3852	sqlcmd.exe
192	sqlcmd.exe
3592	sqlcmd.exe
1268	sqlcmd.exe
2260	sqlcmd.exe
2332	sqlcmd.exe
820	sqlcmd.exe
2296	sqlcmd.exe
1444	sqlcmd.exe
360	sqlcmd.exe
1168	sqlcmd.exe
912	sqlcmd.exe
3320	sqlcmd.exe
1048	sqlcmd.exe
1044	sqlcmd.exe
3416	sqlcmd.exe
2492	sqlcmd.exe
2344	dbrieih
1744	dbrieih
2016	sqlcmd.exe
1704	sqlcmd.exe
3192	sqlcmd.exe
3216	sqlcmd.exe
3668	sqlcmd.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	D30C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	D30C.exe

Deletes itself 1 IoCs

pid	Process
2984	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
948	toolspab2 (13).exe
2560	C05B.exe
2560	C05B.exe
2560	C05B.exe
2560	C05B.exe
2560	C05B.exe
1860	dbrieih
1744	dbrieih

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral10/files/0x000200000001ab79-159.dat	themida
behavioral10/files/0x000200000001ab79-158.dat	themida
behavioral10/memory/3792-161-0x0000000000150000-0x0000000000151000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	D30C.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
110	ipinfo.io
111	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3792	D30C.exe

Suspicious use of SetThreadContext 35 IoCs

description	pid	Process	procid_target
PID 3164 set thread context of 948	3164	toolspab2 (13).exe	78
PID 2164 set thread context of 1448	2164	BC24.exe	84
PID 3508 set thread context of 3856	3508	b2EP0a91ph.exe	97
PID 4064 set thread context of 3156	4064	sqlcmd.exe	110
PID 3224 set thread context of 2128	3224	dbrieih	114
PID 2228 set thread context of 2744	2228	sqlcmd.exe	116
PID 3400 set thread context of 1844	3400	sqlcmd.exe	118
PID 2332 set thread context of 2152	2332	sqlcmd.exe	120
PID 656 set thread context of 3828	656	sqlcmd.exe	122
PID 3848 set thread context of 3444	3848	sqlcmd.exe	124
PID 3496 set thread context of 3792	3496	sqlcmd.exe	126
PID 752 set thread context of 2764	752	sqlcmd.exe	128
PID 2792 set thread context of 2496	2792	sqlcmd.exe	130
PID 3608 set thread context of 3920	3608	sqlcmd.exe	132
PID 188 set thread context of 3168	188	sqlcmd.exe	134
PID 3924 set thread context of 1860	3924	dbrieih	136
PID 1164 set thread context of 1908	1164	sqlcmd.exe	138
PID 3472 set thread context of 3852	3472	sqlcmd.exe	140
PID 192 set thread context of 3592	192	sqlcmd.exe	142
PID 1268 set thread context of 2260	1268	sqlcmd.exe	144
PID 2332 set thread context of 820	2332	sqlcmd.exe	146
PID 2296 set thread context of 1444	2296	sqlcmd.exe	148
PID 360 set thread context of 1168	360	sqlcmd.exe	150
PID 912 set thread context of 3320	912	sqlcmd.exe	152
PID 1048 set thread context of 1044	1048	sqlcmd.exe	154
PID 3416 set thread context of 2492	3416	sqlcmd.exe	156
PID 2344 set thread context of 1744	2344	dbrieih	158
PID 2016 set thread context of 1704	2016	sqlcmd.exe	160
PID 3192 set thread context of 3216	3192	sqlcmd.exe	162
PID 3668 set thread context of 3372	3668	sqlcmd.exe	164
PID 3240 set thread context of 512	3240	sqlcmd.exe	166
PID 3868 set thread context of 2324	3868	sqlcmd.exe	168
PID 3164 set thread context of 1664	3164	sqlcmd.exe	170
PID 752 set thread context of 3988	752	sqlcmd.exe	172
PID 2552 set thread context of 3712	2552	sqlcmd.exe	174

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	1448	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (13).exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (13).exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (13).exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dbrieih

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1296	schtasks.exe
1124	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2812	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
948	toolspab2 (13).exe
948	toolspab2 (13).exe
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
948	toolspab2 (13).exe
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
2984	Process not Found
1860	dbrieih
1744	dbrieih

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeRestorePrivilege	3124	WerFault.exe
Token: SeBackupPrivilege	3124	WerFault.exe
Token: SeDebugPrivilege	3124	WerFault.exe
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeDebugPrivilege	3792	D30C.exe
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found
Token: SeShutdownPrivilege	2984	Process not Found
Token: SeCreatePagefilePrivilege	2984	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3544	B6D2.exe
3932	B82B.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2984	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 3164 wrote to memory of 948	3164	toolspab2 (13).exe	78
PID 2984 wrote to memory of 3544	2984	Process not Found	80
PID 2984 wrote to memory of 3544	2984	Process not Found	80
PID 2984 wrote to memory of 3544	2984	Process not Found	80
PID 2984 wrote to memory of 3932	2984	Process not Found	81
PID 2984 wrote to memory of 3932	2984	Process not Found	81
PID 2984 wrote to memory of 3932	2984	Process not Found	81
PID 2984 wrote to memory of 2164	2984	Process not Found	82
PID 2984 wrote to memory of 2164	2984	Process not Found	82
PID 2984 wrote to memory of 2164	2984	Process not Found	82
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2984 wrote to memory of 2560	2984	Process not Found	85
PID 2984 wrote to memory of 2560	2984	Process not Found	85
PID 2984 wrote to memory of 2560	2984	Process not Found	85
PID 2984 wrote to memory of 2808	2984	Process not Found	86
PID 2984 wrote to memory of 2808	2984	Process not Found	86
PID 2984 wrote to memory of 2808	2984	Process not Found	86
PID 2984 wrote to memory of 3828	2984	Process not Found	87
PID 2984 wrote to memory of 3828	2984	Process not Found	87
PID 2984 wrote to memory of 3828	2984	Process not Found	87
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2164 wrote to memory of 1448	2164	BC24.exe	84
PID 2984 wrote to memory of 3176	2984	Process not Found	90
PID 2984 wrote to memory of 3176	2984	Process not Found	90
PID 2984 wrote to memory of 3176	2984	Process not Found	90
PID 2984 wrote to memory of 3792	2984	Process not Found	91
PID 2984 wrote to memory of 3792	2984	Process not Found	91
PID 2984 wrote to memory of 3792	2984	Process not Found	91
PID 2984 wrote to memory of 2284	2984	Process not Found	92
PID 2984 wrote to memory of 2284	2984	Process not Found	92
PID 2984 wrote to memory of 2284	2984	Process not Found	92
PID 2984 wrote to memory of 2284	2984	Process not Found	92
PID 2984 wrote to memory of 3944	2984	Process not Found	93
PID 2984 wrote to memory of 3944	2984	Process not Found	93
PID 2984 wrote to memory of 3944	2984	Process not Found	93
PID 2984 wrote to memory of 784	2984	Process not Found	94
PID 2984 wrote to memory of 784	2984	Process not Found	94
PID 2984 wrote to memory of 784	2984	Process not Found	94
PID 2984 wrote to memory of 784	2984	Process not Found	94
PID 2984 wrote to memory of 2748	2984	Process not Found	95
PID 2984 wrote to memory of 2748	2984	Process not Found	95
PID 2984 wrote to memory of 2748	2984	Process not Found	95
PID 2560 wrote to memory of 3508	2560	C05B.exe	96
PID 2560 wrote to memory of 3508	2560	C05B.exe	96
PID 2560 wrote to memory of 3508	2560	C05B.exe	96
PID 2560 wrote to memory of 2740	2560	C05B.exe	102
PID 2560 wrote to memory of 2740	2560	C05B.exe	102
PID 2560 wrote to memory of 2740	2560	C05B.exe	102
PID 3508 wrote to memory of 3856	3508	b2EP0a91ph.exe	97
PID 3508 wrote to memory of 3856	3508	b2EP0a91ph.exe	97
PID 3508 wrote to memory of 3856	3508	b2EP0a91ph.exe	97
PID 3508 wrote to memory of 3856	3508	b2EP0a91ph.exe	97
PID 3508 wrote to memory of 3856	3508	b2EP0a91ph.exe	97
PID 3856 wrote to memory of 1296	3856	b2EP0a91ph.exe	99

C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:948

C:\Users\Admin\AppData\Local\Temp\B6D2.exe
C:\Users\Admin\AppData\Local\Temp\B6D2.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3544

C:\Users\Admin\AppData\Local\Temp\B82B.exe
C:\Users\Admin\AppData\Local\Temp\B82B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3932

C:\Users\Admin\AppData\Local\Temp\BC24.exe
C:\Users\Admin\AppData\Local\Temp\BC24.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\BC24.exe
  C:\Users\Admin\AppData\Local\Temp\BC24.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 160
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3124

C:\Users\Admin\AppData\Local\Temp\C05B.exe
C:\Users\Admin\AppData\Local\Temp\C05B.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\b2EP0a91ph.exe
  "C:\Users\Admin\AppData\Local\Temp\b2EP0a91ph.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Users\Admin\AppData\Local\Temp\b2EP0a91ph.exe
    "C:\Users\Admin\AppData\Local\Temp\b2EP0a91ph.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:1296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\C05B.exe"
  2⤵
  PID:2740

C:\Users\Admin\AppData\Local\Temp\C2FC.exe
C:\Users\Admin\AppData\Local\Temp\C2FC.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Users\Admin\AppData\Local\Temp\C88B.exe
C:\Users\Admin\AppData\Local\Temp\C88B.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Users\Admin\AppData\Local\Temp\CD9C.exe
C:\Users\Admin\AppData\Local\Temp\CD9C.exe
1⤵
- Executes dropped EXE
PID:3176

C:\Users\Admin\AppData\Local\Temp\D30C.exe
C:\Users\Admin\AppData\Local\Temp\D30C.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:784

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2748

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
1⤵
- Delays execution with timeout.exe
PID:2812

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3572

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:212

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3932

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1292

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4064
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1124

C:\Users\Admin\AppData\Roaming\dbrieih
C:\Users\Admin\AppData\Roaming\dbrieih
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3224
- C:\Users\Admin\AppData\Roaming\dbrieih
  C:\Users\Admin\AppData\Roaming\dbrieih
  2⤵
  - Executes dropped EXE
  PID:2128

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2228
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2744

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3400
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1844

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2332
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2152

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:656
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3828

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3848
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3444

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3496
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3792

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:752
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2764

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2792
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2496

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3608
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3920

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:188
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3168

C:\Users\Admin\AppData\Roaming\dbrieih
C:\Users\Admin\AppData\Roaming\dbrieih
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3924
- C:\Users\Admin\AppData\Roaming\dbrieih
  C:\Users\Admin\AppData\Roaming\dbrieih
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1860

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1164
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1908

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3852

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:192
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3592

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1268
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2260

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2332
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:820

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2296
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:360
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1168

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:912
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3320

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1048
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1044

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3416
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2492

C:\Users\Admin\AppData\Roaming\dbrieih
C:\Users\Admin\AppData\Roaming\dbrieih
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2344
- C:\Users\Admin\AppData\Roaming\dbrieih
  C:\Users\Admin\AppData\Roaming\dbrieih
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1744

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2016
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3192
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3216

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3668
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3372

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:3240
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:512

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:3868
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2324

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:3164
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:1664

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:752
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:2552
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-205-0x0000000000440000-0x0000000000449000-memory.dmp

Filesize
36KB

Download
memory/212-204-0x0000000000450000-0x0000000000454000-memory.dmp

Filesize
16KB

Download
memory/784-183-0x00000000005F0000-0x00000000005FB000-memory.dmp

Filesize
44KB

Download
memory/784-182-0x0000000000800000-0x0000000000807000-memory.dmp

Filesize
28KB

Download
memory/948-114-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1292-211-0x0000000000700000-0x0000000000709000-memory.dmp

Filesize
36KB

Download
memory/1292-210-0x0000000000710000-0x0000000000715000-memory.dmp

Filesize
20KB

Download
memory/1448-148-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2164-132-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2164-134-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/2164-135-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/2164-139-0x0000000004AF0000-0x0000000004B66000-memory.dmp

Filesize
472KB

Download
memory/2280-201-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2280-202-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/2284-166-0x00000000004F0000-0x0000000000564000-memory.dmp

Filesize
464KB

Download
memory/2284-167-0x0000000000480000-0x00000000004EB000-memory.dmp

Filesize
428KB

Download
memory/2560-147-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2560-146-0x0000000001FA0000-0x0000000002031000-memory.dmp

Filesize
580KB

Download
memory/2748-194-0x0000000000E10000-0x0000000000E19000-memory.dmp

Filesize
36KB

Download
memory/2748-195-0x0000000000E00000-0x0000000000E0F000-memory.dmp

Filesize
60KB

Download
memory/2808-154-0x0000000002070000-0x0000000002101000-memory.dmp

Filesize
580KB

Download
memory/2808-155-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2984-271-0x0000000001320000-0x0000000001337000-memory.dmp

Filesize
92KB

Download
memory/2984-118-0x00000000010E0000-0x00000000010F7000-memory.dmp

Filesize
92KB

Download
memory/2984-302-0x0000000001390000-0x00000000013A7000-memory.dmp

Filesize
92KB

Download
memory/3164-116-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/3572-199-0x00000000007E0000-0x00000000007E9000-memory.dmp

Filesize
36KB

Download
memory/3572-198-0x00000000007F0000-0x00000000007F5000-memory.dmp

Filesize
20KB

Download
memory/3792-164-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/3792-172-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/3792-163-0x0000000005900000-0x0000000005901000-memory.dmp

Filesize
4KB

Download
memory/3792-161-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/3792-169-0x0000000077110000-0x000000007729E000-memory.dmp

Filesize
1.6MB

Download
memory/3792-178-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/3792-165-0x0000000006410000-0x0000000006411000-memory.dmp

Filesize
4KB

Download
memory/3792-177-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/3792-170-0x0000000005F30000-0x0000000005F31000-memory.dmp

Filesize
4KB

Download
memory/3792-212-0x0000000008060000-0x0000000008061000-memory.dmp

Filesize
4KB

Download
memory/3792-168-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/3856-189-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3856-196-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3924-270-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/3932-207-0x0000000000320000-0x0000000000325000-memory.dmp

Filesize
20KB

Download
memory/3932-208-0x0000000000310000-0x0000000000319000-memory.dmp

Filesize
36KB

Download
memory/3944-180-0x0000000000FB0000-0x0000000000FBC000-memory.dmp

Filesize
48KB

Download
memory/3944-179-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

Filesize
28KB

Download