danabot | c06b079814ab52484292497631819acdb667cadd9c2a58cae97f5dc19d79e1c5

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
20-07-2021 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c34c3173ec9350b98c8eb041881b7e58.exe
Size

1.2MB
MD5

c34c3173ec9350b98c8eb041881b7e58
SHA1

eeea61972fba068e1bd010354555cda9c4802c79
SHA256

c06b079814ab52484292497631819acdb667cadd9c2a58cae97f5dc19d79e1c5
SHA512

67629e18128c73810e75ef92b21f788a9506024d960f73d823f6ee4173c8240969b2b10b1a6d60db027401ab442753845853a24929d31142ad399edbfc9f78cc

Score

10^/10

danabot 4 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 6 IoCs

Processes:

WScript.exerundll32.exeRUNDLL32.EXE

flow pid process

31 2252 WScript.exe
33 2252 WScript.exe
35 2252 WScript.exe
37 2252 WScript.exe
40 1968 rundll32.exe
41 1312 RUNDLL32.EXE
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

vpn.exe4.exeCheope.exe.comCheope.exe.comSmartClock.exemakwlos.exe

pid process

2200 vpn.exe
2396 4.exe
3084 Cheope.exe.com
3740 Cheope.exe.com
1272 SmartClock.exe
4016 makwlos.exe
Drops startup file 1 IoCs

Processes:

4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4.exe
Loads dropped DLL 4 IoCs

Processes:

c34c3173ec9350b98c8eb041881b7e58.exerundll32.exeRUNDLL32.EXE

pid process

3424 c34c3173ec9350b98c8eb041881b7e58.exe
1968 rundll32.exe
1312 RUNDLL32.EXE
1312 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com

flow	pid	process
31	2252	WScript.exe
33	2252	WScript.exe
35	2252	WScript.exe
37	2252	WScript.exe
40	1968	rundll32.exe
41	1312	RUNDLL32.EXE

pid	process
2200	vpn.exe
2396	4.exe
3084	Cheope.exe.com
3740	Cheope.exe.com
1272	SmartClock.exe
4016	makwlos.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

pid	process
3424	c34c3173ec9350b98c8eb041881b7e58.exe
1968	rundll32.exe
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE

flow	ioc
15	ip-api.com

Drops file in Program Files directory 4 IoCs

Processes:

c34c3173ec9350b98c8eb041881b7e58.exerundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	c34c3173ec9350b98c8eb041881b7e58.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	c34c3173ec9350b98c8eb041881b7e58.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	c34c3173ec9350b98c8eb041881b7e58.exe
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXECheope.exe.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Cheope.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Cheope.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	RUNDLL32.EXE

Modifies registry class 1 IoCs

Processes:

Cheope.exe.com

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings Cheope.exe.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	Cheope.exe.com

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

WScript.exeRUNDLL32.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3FF7C77ABB1B1258D067135E1A10768D66D88F5D	RUNDLL32.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3FF7C77ABB1B1258D067135E1A10768D66D88F5D\Blob = 0300000001000000140000003ff7c77abb1b1258d067135e1a10768d66d88f5d2000000001000000a20200003082029e30820207a003020102020842b9fe16683b51f4300d06092a864886f70d01010b050030753120301e06035504030c17546838617774652054696d657374616d70696e67204341311d301b060355040b0c145468617774652043657274696669636174696f6e310f300d060355040a0c06546861777465310b3009060355040613025a413114301206035504070c0b44757262616e76696c6c65301e170d3139303732313132333735375a170d3233303732303132333735375a30753120301e06035504030c17546838617774652054696d657374616d70696e67204341311d301b060355040b0c145468617774652043657274696669636174696f6e310f300d060355040a0c06546861777465310b3009060355040613025a413114301206035504070c0b44757262616e76696c6c6530819f300d06092a864886f70d010101050003818d0030818902818100d46697ee191f61d14a50f1f575cf31e54aebdd65a8cc84d0042f6ba02de319396a1a804271a59ebbf7b51cd10af6c9b6511fbd2be71d30af2bd49d5d33f22a66c91bb68dec740dacab967d5c39aa8ff780b768d1621f07887056935f5d4d796357116495b81e33b6e7d962b2d36b3174ed2f9b2aca3df413554c991f4991b1b30203010001a3373035300f0603551d130101ff040530030101ff30220603551d11041b30198217546838617774652054696d657374616d70696e67204341300d06092a864886f70d01010b0500038181001c4b6d821e362088c0b1fb38d20f2f6de4d391912119cd91020a6b6e924503c761a024fedd3f43a53b244e55499ef13b2734991a72987bb030e5482463b1b81b61159d231099c431ef07a60f355f1da951614394ca215a9055b2b6c40a8123977a216680d6a4e5229058faca054245f03be671ad705c6277ba69a1d5951f5545	RUNDLL32.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3464 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SmartClock.exe

pid process

1272 SmartClock.exe

pid	process
3464	PING.EXE

pid	process
1272	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

pid	process
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
188	powershell.exe
188	powershell.exe
188	powershell.exe
1312	RUNDLL32.EXE
1312	RUNDLL32.EXE
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1312 RUNDLL32.EXE
Token: SeDebugPrivilege 188 powershell.exe
Token: SeDebugPrivilege 3284 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

1312 RUNDLL32.EXE

description	pid	process
Token: SeDebugPrivilege	1312	RUNDLL32.EXE
Token: SeDebugPrivilege	188	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

c34c3173ec9350b98c8eb041881b7e58.exevpn.execmd.execmd.exeCheope.exe.com4.exeCheope.exe.commakwlos.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 3424 wrote to memory of 2200	3424	c34c3173ec9350b98c8eb041881b7e58.exe	vpn.exe
PID 3424 wrote to memory of 2200	3424	c34c3173ec9350b98c8eb041881b7e58.exe	vpn.exe
PID 3424 wrote to memory of 2200	3424	c34c3173ec9350b98c8eb041881b7e58.exe	vpn.exe
PID 3424 wrote to memory of 2396	3424	c34c3173ec9350b98c8eb041881b7e58.exe	4.exe
PID 3424 wrote to memory of 2396	3424	c34c3173ec9350b98c8eb041881b7e58.exe	4.exe
PID 3424 wrote to memory of 2396	3424	c34c3173ec9350b98c8eb041881b7e58.exe	4.exe
PID 2200 wrote to memory of 4040	2200	vpn.exe	cmd.exe
PID 2200 wrote to memory of 4040	2200	vpn.exe	cmd.exe
PID 2200 wrote to memory of 4040	2200	vpn.exe	cmd.exe
PID 4040 wrote to memory of 192	4040	cmd.exe	cmd.exe
PID 4040 wrote to memory of 192	4040	cmd.exe	cmd.exe
PID 4040 wrote to memory of 192	4040	cmd.exe	cmd.exe
PID 192 wrote to memory of 2252	192	cmd.exe	findstr.exe
PID 192 wrote to memory of 2252	192	cmd.exe	findstr.exe
PID 192 wrote to memory of 2252	192	cmd.exe	findstr.exe
PID 192 wrote to memory of 3084	192	cmd.exe	Cheope.exe.com
PID 192 wrote to memory of 3084	192	cmd.exe	Cheope.exe.com
PID 192 wrote to memory of 3084	192	cmd.exe	Cheope.exe.com
PID 192 wrote to memory of 3464	192	cmd.exe	PING.EXE
PID 192 wrote to memory of 3464	192	cmd.exe	PING.EXE
PID 192 wrote to memory of 3464	192	cmd.exe	PING.EXE
PID 3084 wrote to memory of 3740	3084	Cheope.exe.com	Cheope.exe.com
PID 3084 wrote to memory of 3740	3084	Cheope.exe.com	Cheope.exe.com
PID 3084 wrote to memory of 3740	3084	Cheope.exe.com	Cheope.exe.com
PID 2396 wrote to memory of 1272	2396	4.exe	SmartClock.exe
PID 2396 wrote to memory of 1272	2396	4.exe	SmartClock.exe
PID 2396 wrote to memory of 1272	2396	4.exe	SmartClock.exe
PID 3740 wrote to memory of 4016	3740	Cheope.exe.com	makwlos.exe
PID 3740 wrote to memory of 4016	3740	Cheope.exe.com	makwlos.exe
PID 3740 wrote to memory of 4016	3740	Cheope.exe.com	makwlos.exe
PID 3740 wrote to memory of 2612	3740	Cheope.exe.com	WScript.exe
PID 3740 wrote to memory of 2612	3740	Cheope.exe.com	WScript.exe
PID 3740 wrote to memory of 2612	3740	Cheope.exe.com	WScript.exe
PID 4016 wrote to memory of 1968	4016	makwlos.exe	rundll32.exe
PID 4016 wrote to memory of 1968	4016	makwlos.exe	rundll32.exe
PID 4016 wrote to memory of 1968	4016	makwlos.exe	rundll32.exe
PID 3740 wrote to memory of 2252	3740	Cheope.exe.com	WScript.exe
PID 3740 wrote to memory of 2252	3740	Cheope.exe.com	WScript.exe
PID 3740 wrote to memory of 2252	3740	Cheope.exe.com	WScript.exe
PID 1968 wrote to memory of 1312	1968	rundll32.exe	RUNDLL32.EXE
PID 1968 wrote to memory of 1312	1968	rundll32.exe	RUNDLL32.EXE
PID 1968 wrote to memory of 1312	1968	rundll32.exe	RUNDLL32.EXE
PID 1312 wrote to memory of 188	1312	RUNDLL32.EXE	powershell.exe
PID 1312 wrote to memory of 188	1312	RUNDLL32.EXE	powershell.exe
PID 1312 wrote to memory of 188	1312	RUNDLL32.EXE	powershell.exe
PID 1312 wrote to memory of 3284	1312	RUNDLL32.EXE	powershell.exe
PID 1312 wrote to memory of 3284	1312	RUNDLL32.EXE	powershell.exe
PID 1312 wrote to memory of 3284	1312	RUNDLL32.EXE	powershell.exe
PID 3284 wrote to memory of 3768	3284	powershell.exe	nslookup.exe
PID 3284 wrote to memory of 3768	3284	powershell.exe	nslookup.exe
PID 3284 wrote to memory of 3768	3284	powershell.exe	nslookup.exe
PID 1312 wrote to memory of 2492	1312	RUNDLL32.EXE	schtasks.exe
PID 1312 wrote to memory of 2492	1312	RUNDLL32.EXE	schtasks.exe
PID 1312 wrote to memory of 2492	1312	RUNDLL32.EXE	schtasks.exe
PID 1312 wrote to memory of 2272	1312	RUNDLL32.EXE	schtasks.exe
PID 1312 wrote to memory of 2272	1312	RUNDLL32.EXE	schtasks.exe
PID 1312 wrote to memory of 2272	1312	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\c34c3173ec9350b98c8eb041881b7e58.exe
"C:\Users\Admin\AppData\Local\Temp\c34c3173ec9350b98c8eb041881b7e58.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3424

C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Narcotico.mpg
3⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
- Suspicious use of WriteProcessMemory
PID:192

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^hPzBSAzErWqivIhideydXrkRLKibeyeZLrCfJgdYSSNmkzflOaKfcWKpDCPozVBXTwvauYbeMubyfLGaxWJKcMEOzaLinoFWsPGpXXrPUIDgnFURVbNvjQCuvHZOhd$" Sua.mpg
5⤵
PID:2252

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com
Cheope.exe.com T
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com T
6⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3740

C:\Users\Admin\AppData\Local\Temp\makwlos.exe
"C:\Users\Admin\AppData\Local\Temp\makwlos.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP,S C:\Users\Admin\AppData\Local\Temp\makwlos.exe
8⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP,Ohkh
9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp2E4F.tmp.ps1"
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp3F39.tmp.ps1"
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe" -type=any localhost
11⤵
PID:3768

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
10⤵
PID:2492

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
10⤵
PID:2272

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\iolfsmwrvne.vbs"
7⤵
PID:2612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gyerpdderiol.vbs"
7⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:2252

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
5⤵
- Runs ping.exe
PID:3464

C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
"C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Jvgzbfh.tmp
MD5
8303b2caddfa02d1e3bd7796fc8f36e0

SHA1
b1b02156710b146139620b5fb8bf90ab8a3de615

SHA256
b1228441b57de321998f4697c8d62dd7ad676e032b52a7539171f10dafe7765d

SHA512
09f16b9281154f91c68b3609fe4468786be41005b3ce3af6997f11b7610a73ef61b8168ff093a375cae439f5231f1708bc33b05a9d566bdf5c74a590681773df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
49bd48ee8467af7478d1134bfcae2f4d

SHA1
ff673838120439f8e7d0081fd1443514f95092c8

SHA256
a80eaa40ba1c47e5dbe2339918a90981fd3b1254ec6bd453917765086462d1b9

SHA512
ec9b51d869da6cd1c126ff698fbbf5a7e2eb44d86efd7e26ec63ed6d02796977b0e299521366d8af6676b7ae8681a728b97e581d9ab0827d46f6ab1519cc656f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.exe.com
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Chi.mpg
MD5
9ded2c093bd49c32b9f1f06265aad843

SHA1
3c0c5581544628f6c47fd54dc21189f7a6999c5b

SHA256
f815800751e3b1be3be88e4a586654fac0bc459cf85080c3eccfad8395472fa5

SHA512
8ac2b6bc0dbdf7858fc8a92c1d2c2cdf17deb92ebcffd2ce7cdebbee35c2683a0e706843d0a4daa4f069614b55e06799c9d47e121aabae6ad32551fa630fa12a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Narcotico.mpg
MD5
7435f0e8e46ca0dc11d2a3d7ed31a2ea

SHA1
a74f19d3e59d6c1c6a7812b1f3a7beaae1af4a9d

SHA256
c7ec9ee50643fe5757eb476e391bc30ee5bcb2b5c6537bdf29a05e8ce3b17ef5

SHA512
2f158c1ad931ea784ee6e52c1997875cad44666c61763ce3388780f806664eee31aa528d0bcdf067f978ff65500d11725312baf3f4c1a0c1de4eb09d6f444816

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sua.mpg
MD5
15db6ccd633040cf4269f4a5daa60267

SHA1
7a8af5e0756cccf7928a3d933159088c00548dbb

SHA256
41f682dc4f24157205acf41d09080db3fcc8e85e8bc54b356125a6f90c2806e1

SHA512
6e32668bb461ea1115070c4a1dd67e85252fb375bef80a34a9eceb11d9680dc3b97e912e849d551983f195d23c2301e1120193445364861746304a1c6d084783

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\T
MD5
9ded2c093bd49c32b9f1f06265aad843

SHA1
3c0c5581544628f6c47fd54dc21189f7a6999c5b

SHA256
f815800751e3b1be3be88e4a586654fac0bc459cf85080c3eccfad8395472fa5

SHA512
8ac2b6bc0dbdf7858fc8a92c1d2c2cdf17deb92ebcffd2ce7cdebbee35c2683a0e706843d0a4daa4f069614b55e06799c9d47e121aabae6ad32551fa630fa12a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Voto.mpg
MD5
3283e74b35b87067c626c6debc4c647c

SHA1
25aa5813f536679b608be59cb83c49f1ddc45355

SHA256
304e165665671e909c9bd719acef33b3d6029462aa0079f075b1effc5b58ed01

SHA512
3a1b73cb5162fb697d74db74be4613a3c195a45adf6f17a5df6ed1a2fc4923cafbf349f053f9c8fbebce356503df4270e8ba94f621ae9931e550185dc44d26b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP
MD5
7421975d09f0de9fc505ba95c37e5794

SHA1
052e5981f44c5451d896f6383df93bcdf5235fe5

SHA256
643138b1767f6d5bb05ca771238afc2b2e6d70594d5c5d4b027d20c8c1b733bd

SHA512
7fb6e065e98a0f4c2f919e675ef2daa8932b575329965a6c1034340c7d1c219ea9500d032006346617975399e3b6f2fbf90054f9f135dccf6d1de170d753b2ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
MD5
4b2bc14babae706a01fbfde4dac783cb

SHA1
7b2c3e3a5f9c31fcf0c0977e80fd7e342c6d284d

SHA256
1684abbf0e34b3c8d0a5097c5d2f31a98049c55e8e5f1ea16a0c50b7ebb52e25

SHA512
a8c949a20b8f72dd5d479b756eed532d8e27b419c1a7cf539ea9d5abefb962805f1ef8f6d53fff69e7a170fa6ce1dd80fe5e4406bfdcd0e6bad7db2c399b91b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
MD5
4b2bc14babae706a01fbfde4dac783cb

SHA1
7b2c3e3a5f9c31fcf0c0977e80fd7e342c6d284d

SHA256
1684abbf0e34b3c8d0a5097c5d2f31a98049c55e8e5f1ea16a0c50b7ebb52e25

SHA512
a8c949a20b8f72dd5d479b756eed532d8e27b419c1a7cf539ea9d5abefb962805f1ef8f6d53fff69e7a170fa6ce1dd80fe5e4406bfdcd0e6bad7db2c399b91b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
MD5
4fad87e905527200767b4d75a67475a2

SHA1
3c6ed14acd0e3500e1a732891db335c14160f94a

SHA256
873574405be6ca9e0c85ec516a1736c9a85ffe6f185f7113102763fe52fbd767

SHA512
14e3ea68ea1a8fc1966c3cd416fb9275f8b7b34cfaec5a29a5e2c1d95439a2a03a11d4071b05aa6264c263d0459be4cd00a42853ae8a4fc9729580000c725d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
MD5
4fad87e905527200767b4d75a67475a2

SHA1
3c6ed14acd0e3500e1a732891db335c14160f94a

SHA256
873574405be6ca9e0c85ec516a1736c9a85ffe6f185f7113102763fe52fbd767

SHA512
14e3ea68ea1a8fc1966c3cd416fb9275f8b7b34cfaec5a29a5e2c1d95439a2a03a11d4071b05aa6264c263d0459be4cd00a42853ae8a4fc9729580000c725d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyerpdderiol.vbs
MD5
1a8c79733fe97fcb8b1231cdfc0ea47f

SHA1
787b88ba53c778b47f349e0925e6b5f7d1c57452

SHA256
5af15c13dec3a36cd9ee21b92f0eb996ad9e3df100642b6cccdf5df9ea6f5330

SHA512
3ac8ce5fb8ec280b862623b1d67d6a6f7ce5dc72231d8b55ccde9385f380dc5b97ef85d22dc9f9ab911028cd7a6907a4239f3cbfc73a693563549c7af499eca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolfsmwrvne.vbs
MD5
6f2e8c1552ffbcc36688b0b6b195bf44

SHA1
1f883d48ed80d29b7d757c5a4a7d78eedf99d076

SHA256
36b08a2cfb80f381714fa8505ee68c34176d273f808ed65a60acb895274dc753

SHA512
1068787648312ddcf33cc9b2e315fdfc60f9c4ade9c672520546901cc8748b94be11dce8f680d8f10fdd6c79604bb8afa288edfea62d3b98d7f3d3f972a4841d

Download Submit
C:\Users\Admin\AppData\Local\Temp\makwlos.exe
MD5
beaf0a675545d76f6393f0e92656639b

SHA1
d7444795cfdedc9ae3381b60e6bbe91bd8a470e1

SHA256
d4f252125ce1b59def2ae9a8bed16302c4c4c13f54eb41217ef189cccce06a72

SHA512
78f0c8b52d4afdc2d559c7e996621b9e7b7f0a25ecc1342e548e4b5c97a8ef45956435331842fb3cf4c64877e5ec49d0b821374f0d781f0d85a0abd0fe0c04e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\makwlos.exe
MD5
beaf0a675545d76f6393f0e92656639b

SHA1
d7444795cfdedc9ae3381b60e6bbe91bd8a470e1

SHA256
d4f252125ce1b59def2ae9a8bed16302c4c4c13f54eb41217ef189cccce06a72

SHA512
78f0c8b52d4afdc2d559c7e996621b9e7b7f0a25ecc1342e548e4b5c97a8ef45956435331842fb3cf4c64877e5ec49d0b821374f0d781f0d85a0abd0fe0c04e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E4F.tmp.ps1
MD5
af127a0c76d272f68209388a2d0e35f3

SHA1
ce92d87aee8f8b5e88bc51b57874b7b2cd1e80db

SHA256
9680ed1d23527005f0ff01ba5d0eca414e93d1fe84ad6a2c9d0b31dbf246501e

SHA512
7b057c9f9db96a0ef9ddaf6c55f3f8627ecdb6217f903f52e6c0d45962a08b244c60e5f818ec5abcf45cb096eef3e354b5adac07c971d8b006d43a8e82626ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E50.tmp
MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3F39.tmp.ps1
MD5
63d1a8bcbb922b9d3e34bec5fd32d7cf

SHA1
cf95c757eea0cb37afbf76741c2c35612893ae22

SHA256
d3858dc947d701000cf2cd715909988a527f744888021b7ac73c8fb2d8c88039

SHA512
1c431b1231d16e845f38faee014d8176d2be1ed03cb19d1a72266f7dfeca472cae966b52afa0974af48cf07ca2ade10970e532315272b58eb99b7f6a4eb43849

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3F3A.tmp
MD5
3154d454e465e6ac556a3da9d73e139f

SHA1
56633038f8372c0a639ad75f378edd0864e5d228

SHA256
e4a0eb823868d3c8288f3709c9ed230f90d3b4160e30b77d3a4faeb7902782be

SHA512
36179359ff1f72e8b856e6947d23e86817fe5c107500c713dfa92158ef75ec342e3f67416107990a2164309e4300e53ff630d1148230454d592a2a015085b262

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
4b2bc14babae706a01fbfde4dac783cb

SHA1
7b2c3e3a5f9c31fcf0c0977e80fd7e342c6d284d

SHA256
1684abbf0e34b3c8d0a5097c5d2f31a98049c55e8e5f1ea16a0c50b7ebb52e25

SHA512
a8c949a20b8f72dd5d479b756eed532d8e27b419c1a7cf539ea9d5abefb962805f1ef8f6d53fff69e7a170fa6ce1dd80fe5e4406bfdcd0e6bad7db2c399b91b4

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
MD5
4b2bc14babae706a01fbfde4dac783cb

SHA1
7b2c3e3a5f9c31fcf0c0977e80fd7e342c6d284d

SHA256
1684abbf0e34b3c8d0a5097c5d2f31a98049c55e8e5f1ea16a0c50b7ebb52e25

SHA512
a8c949a20b8f72dd5d479b756eed532d8e27b419c1a7cf539ea9d5abefb962805f1ef8f6d53fff69e7a170fa6ce1dd80fe5e4406bfdcd0e6bad7db2c399b91b4

Download Submit
\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP
MD5
7421975d09f0de9fc505ba95c37e5794

SHA1
052e5981f44c5451d896f6383df93bcdf5235fe5

SHA256
643138b1767f6d5bb05ca771238afc2b2e6d70594d5c5d4b027d20c8c1b733bd

SHA512
7fb6e065e98a0f4c2f919e675ef2daa8932b575329965a6c1034340c7d1c219ea9500d032006346617975399e3b6f2fbf90054f9f135dccf6d1de170d753b2ec

Download Submit
\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP
MD5
7421975d09f0de9fc505ba95c37e5794

SHA1
052e5981f44c5451d896f6383df93bcdf5235fe5

SHA256
643138b1767f6d5bb05ca771238afc2b2e6d70594d5c5d4b027d20c8c1b733bd

SHA512
7fb6e065e98a0f4c2f919e675ef2daa8932b575329965a6c1034340c7d1c219ea9500d032006346617975399e3b6f2fbf90054f9f135dccf6d1de170d753b2ec

Download Submit
\Users\Admin\AppData\Local\Temp\MAKWLO~1.TMP
MD5
7421975d09f0de9fc505ba95c37e5794

SHA1
052e5981f44c5451d896f6383df93bcdf5235fe5

SHA256
643138b1767f6d5bb05ca771238afc2b2e6d70594d5c5d4b027d20c8c1b733bd

SHA512
7fb6e065e98a0f4c2f919e675ef2daa8932b575329965a6c1034340c7d1c219ea9500d032006346617975399e3b6f2fbf90054f9f135dccf6d1de170d753b2ec

Download Submit
\Users\Admin\AppData\Local\Temp\nsx19D8.tmp\UAC.dll
MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
memory/188-177-0x0000000006EF2000-0x0000000006EF3000-memory.dmp

Filesize
4KB

Download
memory/188-172-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/188-176-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/188-178-0x00000000084E0000-0x00000000084E1000-memory.dmp

Filesize
4KB

Download
memory/188-175-0x00000000085D0000-0x00000000085D1000-memory.dmp

Filesize
4KB

Download
memory/188-180-0x0000000008660000-0x0000000008661000-memory.dmp

Filesize
4KB

Download
memory/188-165-0x0000000000000000-mapping.dmp

Download
memory/188-174-0x0000000007D30000-0x0000000007D31000-memory.dmp

Filesize
4KB

Download
memory/188-173-0x0000000007E20000-0x0000000007E21000-memory.dmp

Filesize
4KB

Download
memory/188-168-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/188-185-0x0000000009CD0000-0x0000000009CD1000-memory.dmp

Filesize
4KB

Download
memory/188-171-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/188-186-0x0000000009250000-0x0000000009251000-memory.dmp

Filesize
4KB

Download
memory/188-187-0x0000000007070000-0x0000000007071000-memory.dmp

Filesize
4KB

Download
memory/188-170-0x0000000007460000-0x0000000007461000-memory.dmp

Filesize
4KB

Download
memory/188-190-0x0000000006EF3000-0x0000000006EF4000-memory.dmp

Filesize
4KB

Download
memory/188-169-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/192-123-0x0000000000000000-mapping.dmp

Download
memory/1272-132-0x0000000000000000-mapping.dmp

Download
memory/1272-140-0x0000000000400000-0x000000000089E000-memory.dmp

Filesize
4.6MB

Download
memory/1272-139-0x00000000008A0000-0x000000000094E000-memory.dmp

Filesize
696KB

Download
memory/1312-157-0x0000000000000000-mapping.dmp

Download
memory/1312-162-0x0000000005F90000-0x0000000005F91000-memory.dmp

Filesize
4KB

Download
memory/1312-160-0x0000000004360000-0x00000000044BC000-memory.dmp

Filesize
1.4MB

Download
memory/1312-164-0x0000000004AC0000-0x0000000005D56000-memory.dmp

Filesize
18.6MB

Download
memory/1968-148-0x0000000000000000-mapping.dmp

Download
memory/1968-163-0x0000000004F60000-0x00000000061F6000-memory.dmp

Filesize
18.6MB

Download
memory/2200-115-0x0000000000000000-mapping.dmp

Download
memory/2252-124-0x0000000000000000-mapping.dmp

Download
memory/2252-153-0x0000000000000000-mapping.dmp

Download
memory/2272-219-0x0000000000000000-mapping.dmp

Download
memory/2396-117-0x0000000000000000-mapping.dmp

Download
memory/2396-137-0x0000000000400000-0x000000000089E000-memory.dmp

Filesize
4.6MB

Download
memory/2396-136-0x0000000000970000-0x0000000000996000-memory.dmp

Filesize
152KB

Download
memory/2492-217-0x0000000000000000-mapping.dmp

Download
memory/2612-146-0x0000000000000000-mapping.dmp

Download
memory/3084-127-0x0000000000000000-mapping.dmp

Download
memory/3284-205-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/3284-191-0x0000000000000000-mapping.dmp

Download
memory/3284-200-0x00000000084E0000-0x00000000084E1000-memory.dmp

Filesize
4KB

Download
memory/3284-218-0x00000000075E3000-0x00000000075E4000-memory.dmp

Filesize
4KB

Download
memory/3284-203-0x0000000008C00000-0x0000000008C01000-memory.dmp

Filesize
4KB

Download
memory/3284-206-0x00000000075E2000-0x00000000075E3000-memory.dmp

Filesize
4KB

Download
memory/3464-130-0x0000000000000000-mapping.dmp

Download
memory/3740-131-0x0000000000000000-mapping.dmp

Download
memory/3740-142-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/3768-214-0x0000000000000000-mapping.dmp

Download
memory/4016-143-0x0000000000000000-mapping.dmp

Download
memory/4016-151-0x0000000000F90000-0x000000000108F000-memory.dmp

Filesize
1020KB

Download
memory/4016-152-0x0000000000400000-0x0000000000970000-memory.dmp

Filesize
5.4MB

Download
memory/4040-121-0x0000000000000000-mapping.dmp

Download