raccoon | 64dc2b5958fe37dd9733928c156e0c75ab544e2e0169f9f796c3f3db809bcbe5

Target

toolspab2 (1).exe
Size

315KB
MD5

585c257e0b345b762e7cdc407d8f9da2
SHA1

ffee403d97b76c3460fc166b9d5ce1205cd216a5
SHA256

4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
SHA512

14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

Score

10^/10

raccoon redline smokeloader 1 backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Extracted

Family

redline

Botnet

45.32.235.238:45555

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/memory/3880-146-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/3880-147-0x0000000000417E96-mapping.dmp	family_redline
behavioral2/files/0x000300000001ab7f-173.dat	family_redline
behavioral2/files/0x000300000001ab7f-172.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
2236	E69D.exe
1284	E853.exe
4060	EAB6.exe
2132	EE9F.exe
2016	F0E2.exe
2192	F884.exe
3880	EAB6.exe
2468	FD38.exe
3080	A29.exe
2648	hfJIcPfHZp.exe
1196	hfJIcPfHZp.exe
960	sqlcmd.exe
2088	sqlcmd.exe
2648	sqlcmd.exe
2172	sqlcmd.exe
3592	sqlcmd.exe
3596	sqlcmd.exe
2356	sqlcmd.exe
704	sqlcmd.exe
216	sqlcmd.exe
3968	sqlcmd.exe
2032	sqlcmd.exe
3884	sqlcmd.exe
1576	sqlcmd.exe
1876	sqlcmd.exe
4084	sqlcmd.exe
1288	sqlcmd.exe
1604	sdajfeg
188	sdajfeg
2132	sqlcmd.exe
3704	sqlcmd.exe
2192	sqlcmd.exe
956	sqlcmd.exe
4056	sqlcmd.exe
2104	sqlcmd.exe
1444	sqlcmd.exe
204	sqlcmd.exe
600	sqlcmd.exe
2100	sqlcmd.exe
1948	sqlcmd.exe
3044	sqlcmd.exe
752	sqlcmd.exe
3696	sqlcmd.exe
3268	sqlcmd.exe
1932	sqlcmd.exe
3692	sqlcmd.exe
3548	sqlcmd.exe
2188	sdajfeg
1944	sqlcmd.exe
3984	sqlcmd.exe
492	sdajfeg
4088	sqlcmd.exe
2284	sqlcmd.exe
2224	sqlcmd.exe
1208	sqlcmd.exe
2292	sqlcmd.exe
1872	sqlcmd.exe
1252	sqlcmd.exe
3220	sqlcmd.exe
2956	sqlcmd.exe
3668	sqlcmd.exe
3580	sqlcmd.exe
3300	sqlcmd.exe
1128	sqlcmd.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A29.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A29.exe

Deletes itself 1 IoCs

pid	Process
3020	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
2584	toolspab2 (1).exe
2132	EE9F.exe
2132	EE9F.exe
2132	EE9F.exe
2132	EE9F.exe
2132	EE9F.exe
492	sdajfeg
2808	sdajfeg

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000300000001ab7f-173.dat	themida
behavioral2/files/0x000300000001ab7f-172.dat	themida
behavioral2/memory/3080-178-0x00000000000C0000-0x00000000000C1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A29.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3080	A29.exe

Suspicious use of SetThreadContext 35 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 2584	656	toolspab2 (1).exe	77
PID 4060 set thread context of 3880	4060	EAB6.exe	83
PID 2648 set thread context of 1196	2648	hfJIcPfHZp.exe	92
PID 960 set thread context of 2088	960	sqlcmd.exe	107
PID 2648 set thread context of 2172	2648	sqlcmd.exe	111
PID 3592 set thread context of 3596	3592	sqlcmd.exe	113
PID 2356 set thread context of 704	2356	sqlcmd.exe	115
PID 216 set thread context of 3968	216	sqlcmd.exe	117
PID 2032 set thread context of 3884	2032	sqlcmd.exe	119
PID 1576 set thread context of 1876	1576	sqlcmd.exe	121
PID 4084 set thread context of 1288	4084	sqlcmd.exe	123
PID 1604 set thread context of 188	1604	sdajfeg	125
PID 2132 set thread context of 3704	2132	sqlcmd.exe	127
PID 2192 set thread context of 956	2192	sqlcmd.exe	129
PID 4056 set thread context of 2104	4056	sqlcmd.exe	131
PID 1444 set thread context of 204	1444	sqlcmd.exe	133
PID 600 set thread context of 2100	600	sqlcmd.exe	135
PID 1948 set thread context of 3044	1948	sqlcmd.exe	137
PID 752 set thread context of 3696	752	sqlcmd.exe	139
PID 3268 set thread context of 1932	3268	sqlcmd.exe	141
PID 3692 set thread context of 3548	3692	sqlcmd.exe	143
PID 1944 set thread context of 3984	1944	sqlcmd.exe	146
PID 2188 set thread context of 492	2188	sdajfeg	147
PID 4088 set thread context of 2284	4088	sqlcmd.exe	149
PID 2224 set thread context of 1208	2224	sqlcmd.exe	151
PID 2292 set thread context of 1872	2292	sqlcmd.exe	153
PID 1252 set thread context of 3220	1252	sqlcmd.exe	155
PID 2956 set thread context of 3668	2956	sqlcmd.exe	157
PID 3580 set thread context of 3300	3580	sqlcmd.exe	159
PID 1128 set thread context of 2872	1128	sqlcmd.exe	161
PID 3120 set thread context of 2796	3120	sqlcmd.exe	163
PID 2652 set thread context of 3164	2652	sqlcmd.exe	165
PID 1876 set thread context of 824	1876	sqlcmd.exe	168
PID 2164 set thread context of 2808	2164	sdajfeg	169
PID 1060 set thread context of 3320	1060	sqlcmd.exe	171

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (1).exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sdajfeg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (1).exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab2 (1).exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3592	schtasks.exe
3256	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3572	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	toolspab2 (1).exe
2584	toolspab2 (1).exe
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
2584	toolspab2 (1).exe
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
492	sdajfeg
2808	sdajfeg

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	3880	EAB6.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	3080	A29.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2236	E69D.exe
1284	E853.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3020	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 656 wrote to memory of 2584	656	toolspab2 (1).exe	77
PID 3020 wrote to memory of 2236	3020	Process not Found	79
PID 3020 wrote to memory of 2236	3020	Process not Found	79
PID 3020 wrote to memory of 2236	3020	Process not Found	79
PID 3020 wrote to memory of 1284	3020	Process not Found	80
PID 3020 wrote to memory of 1284	3020	Process not Found	80
PID 3020 wrote to memory of 1284	3020	Process not Found	80
PID 3020 wrote to memory of 4060	3020	Process not Found	81
PID 3020 wrote to memory of 4060	3020	Process not Found	81
PID 3020 wrote to memory of 4060	3020	Process not Found	81
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 3020 wrote to memory of 2132	3020	Process not Found	84
PID 3020 wrote to memory of 2132	3020	Process not Found	84
PID 3020 wrote to memory of 2132	3020	Process not Found	84
PID 3020 wrote to memory of 2016	3020	Process not Found	85
PID 3020 wrote to memory of 2016	3020	Process not Found	85
PID 3020 wrote to memory of 2016	3020	Process not Found	85
PID 3020 wrote to memory of 2192	3020	Process not Found	86
PID 3020 wrote to memory of 2192	3020	Process not Found	86
PID 3020 wrote to memory of 2192	3020	Process not Found	86
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 4060 wrote to memory of 3880	4060	EAB6.exe	83
PID 3020 wrote to memory of 2468	3020	Process not Found	87
PID 3020 wrote to memory of 2468	3020	Process not Found	87
PID 3020 wrote to memory of 2468	3020	Process not Found	87
PID 3020 wrote to memory of 3080	3020	Process not Found	88
PID 3020 wrote to memory of 3080	3020	Process not Found	88
PID 3020 wrote to memory of 3080	3020	Process not Found	88
PID 3020 wrote to memory of 4004	3020	Process not Found	89
PID 3020 wrote to memory of 4004	3020	Process not Found	89
PID 3020 wrote to memory of 4004	3020	Process not Found	89
PID 3020 wrote to memory of 4004	3020	Process not Found	89
PID 3020 wrote to memory of 1996	3020	Process not Found	90
PID 3020 wrote to memory of 1996	3020	Process not Found	90
PID 3020 wrote to memory of 1996	3020	Process not Found	90
PID 2132 wrote to memory of 2648	2132	EE9F.exe	91
PID 2132 wrote to memory of 2648	2132	EE9F.exe	91
PID 2132 wrote to memory of 2648	2132	EE9F.exe	91
PID 2132 wrote to memory of 2772	2132	EE9F.exe	93
PID 2132 wrote to memory of 2772	2132	EE9F.exe	93
PID 2132 wrote to memory of 2772	2132	EE9F.exe	93
PID 2648 wrote to memory of 1196	2648	hfJIcPfHZp.exe	92
PID 2648 wrote to memory of 1196	2648	hfJIcPfHZp.exe	92
PID 2648 wrote to memory of 1196	2648	hfJIcPfHZp.exe	92
PID 2648 wrote to memory of 1196	2648	hfJIcPfHZp.exe	92
PID 2648 wrote to memory of 1196	2648	hfJIcPfHZp.exe	92
PID 1196 wrote to memory of 3592	1196	hfJIcPfHZp.exe	95
PID 1196 wrote to memory of 3592	1196	hfJIcPfHZp.exe	95
PID 1196 wrote to memory of 3592	1196	hfJIcPfHZp.exe	95
PID 2772 wrote to memory of 3572	2772	cmd.exe	97
PID 2772 wrote to memory of 3572	2772	cmd.exe	97
PID 2772 wrote to memory of 3572	2772	cmd.exe	97
PID 3020 wrote to memory of 1700	3020	Process not Found	98
PID 3020 wrote to memory of 1700	3020	Process not Found	98

C:\Users\Admin\AppData\Local\Temp\toolspab2 (1).exe
"C:\Users\Admin\AppData\Local\Temp\toolspab2 (1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\toolspab2 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\toolspab2 (1).exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2584

C:\Users\Admin\AppData\Local\Temp\E69D.exe
C:\Users\Admin\AppData\Local\Temp\E69D.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Users\Admin\AppData\Local\Temp\E853.exe
C:\Users\Admin\AppData\Local\Temp\E853.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1284

C:\Users\Admin\AppData\Local\Temp\EAB6.exe
C:\Users\Admin\AppData\Local\Temp\EAB6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\EAB6.exe
  C:\Users\Admin\AppData\Local\Temp\EAB6.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3880

C:\Users\Admin\AppData\Local\Temp\EE9F.exe
C:\Users\Admin\AppData\Local\Temp\EE9F.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\hfJIcPfHZp.exe
  "C:\Users\Admin\AppData\Local\Temp\hfJIcPfHZp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\hfJIcPfHZp.exe
    "C:\Users\Admin\AppData\Local\Temp\hfJIcPfHZp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:3592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\EE9F.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3572

C:\Users\Admin\AppData\Local\Temp\F0E2.exe
C:\Users\Admin\AppData\Local\Temp\F0E2.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Users\Admin\AppData\Local\Temp\F884.exe
C:\Users\Admin\AppData\Local\Temp\F884.exe
1⤵
- Executes dropped EXE
PID:2192

C:\Users\Admin\AppData\Local\Temp\FD38.exe
C:\Users\Admin\AppData\Local\Temp\FD38.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Users\Admin\AppData\Local\Temp\A29.exe
C:\Users\Admin\AppData\Local\Temp\A29.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4004

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1996

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1700

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:224

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3988

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3956

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:960
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3256

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2648
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2172

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3592
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3596

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2356
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:704

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:216
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3968

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2032
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1576
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1876

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4084
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1288

C:\Users\Admin\AppData\Roaming\sdajfeg
C:\Users\Admin\AppData\Roaming\sdajfeg
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1604
- C:\Users\Admin\AppData\Roaming\sdajfeg
  C:\Users\Admin\AppData\Roaming\sdajfeg
  2⤵
  - Executes dropped EXE
  PID:188

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2132
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3704

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:956

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4056
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2104

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1444
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:204

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:600
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2100

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1948
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3044

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:752
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3696

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3268
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1932

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3692
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3548

C:\Users\Admin\AppData\Roaming\sdajfeg
C:\Users\Admin\AppData\Roaming\sdajfeg
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188
- C:\Users\Admin\AppData\Roaming\sdajfeg
  C:\Users\Admin\AppData\Roaming\sdajfeg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:492

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1944
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3984

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:2284

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2224
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1208

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2292
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:1872

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1252
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3220

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2956
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3580
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:3300

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1128
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2872

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:3120
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:2796

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:2652
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3164

C:\Users\Admin\AppData\Roaming\sdajfeg
C:\Users\Admin\AppData\Roaming\sdajfeg
1⤵
- Suspicious use of SetThreadContext
PID:2164
- C:\Users\Admin\AppData\Roaming\sdajfeg
  C:\Users\Admin\AppData\Roaming\sdajfeg
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2808

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:1876
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:824

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Suspicious use of SetThreadContext
PID:1060
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-211-0x00000000004B0000-0x00000000004BF000-memory.dmp

Filesize
60KB

Download
memory/224-210-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/656-117-0x0000000000460000-0x00000000005AA000-memory.dmp

Filesize
1.3MB

Download
memory/872-225-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/872-226-0x0000000000100000-0x0000000000109000-memory.dmp

Filesize
36KB

Download
memory/1196-201-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1196-195-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1604-270-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1700-202-0x0000000003250000-0x0000000003257000-memory.dmp

Filesize
28KB

Download
memory/1700-203-0x0000000003240000-0x000000000324B000-memory.dmp

Filesize
44KB

Download
memory/1996-189-0x0000000000980000-0x000000000098C000-memory.dmp

Filesize
48KB

Download
memory/1996-188-0x0000000000990000-0x0000000000997000-memory.dmp

Filesize
28KB

Download
memory/2016-157-0x00000000005F0000-0x000000000073A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-158-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2132-156-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2132-154-0x0000000002170000-0x0000000002201000-memory.dmp

Filesize
580KB

Download
memory/2164-333-0x00000000004B0000-0x000000000055E000-memory.dmp

Filesize
696KB

Download
memory/2188-309-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/2192-166-0x0000000001FA0000-0x0000000002031000-memory.dmp

Filesize
580KB

Download
memory/2584-114-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2824-217-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

Filesize
48KB

Download
memory/2824-216-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Filesize
24KB

Download
memory/2832-228-0x0000000000520000-0x0000000000525000-memory.dmp

Filesize
20KB

Download
memory/2832-229-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/3020-310-0x0000000000930000-0x0000000000947000-memory.dmp

Filesize
92KB

Download
memory/3020-118-0x00000000008E0000-0x00000000008F7000-memory.dmp

Filesize
92KB

Download
memory/3020-334-0x0000000000950000-0x0000000000967000-memory.dmp

Filesize
92KB

Download
memory/3080-183-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/3080-177-0x00000000773C0000-0x000000007754E000-memory.dmp

Filesize
1.6MB

Download
memory/3080-178-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/3080-180-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3080-187-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/3880-164-0x00000000052E0000-0x00000000058E6000-memory.dmp

Filesize
6.0MB

Download
memory/3880-165-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3880-205-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/3880-206-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/3880-159-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3880-155-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/3880-153-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/3880-204-0x0000000006850000-0x0000000006851000-memory.dmp

Filesize
4KB

Download
memory/3880-146-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3880-152-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/3956-220-0x00000000032F0000-0x00000000032F9000-memory.dmp

Filesize
36KB

Download
memory/3956-219-0x0000000003300000-0x0000000003304000-memory.dmp

Filesize
16KB

Download
memory/3988-214-0x00000000032F0000-0x00000000032F9000-memory.dmp

Filesize
36KB

Download
memory/3988-213-0x0000000003300000-0x0000000003305000-memory.dmp

Filesize
20KB

Download
memory/4004-175-0x0000000000A40000-0x0000000000AB4000-memory.dmp

Filesize
464KB

Download
memory/4004-176-0x00000000009D0000-0x0000000000A3B000-memory.dmp

Filesize
428KB

Download
memory/4060-135-0x0000000001860000-0x0000000001861000-memory.dmp

Filesize
4KB

Download
memory/4060-139-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/4060-134-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/4060-132-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download