glupteba | 7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed

Target

setup_x86_x64_install.exe
Size

6.5MB
MD5

064f0d6900675bed580da1291a566cfa
SHA1

f81699a68c901d190842de735dbda28a3fb52292
SHA256

7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed
SHA512

41dc5c444afd6b5dc0947cf9950acb5aa1081ee9921c748195325b5cfcb23532cea1802959baa59a0c41ed998ba20b509ec107da882d5d8b3bf0b1d17f892738

Score

10^/10

glupteba metasploit redline smokeloader socelars ani aspackv2 backdoor dropper evasion infostealer loader spyware stealer trojan vmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

ANI

45.142.215.47:27643

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2812-268-0x0000000002B90000-0x00000000034AE000-memory.dmp	family_glupteba
behavioral1/memory/2812-269-0x0000000000400000-0x0000000000D39000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2464	rundll32.exe	61

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2480-235-0x000000000041C5CA-mapping.dmp	family_redline
behavioral1/memory/2480-234-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2480-237-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130d6-116.dat	family_socelars
behavioral1/files/0x00030000000130d6-162.dat	family_socelars
behavioral1/files/0x00030000000130d6-169.dat	family_socelars

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130cf-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cf-77.dat	aspack_v212_v242
behavioral1/files/0x00040000000130ca-78.dat	aspack_v212_v242
behavioral1/files/0x00040000000130ca-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-83.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 22 IoCs

pid	Process
1616	setup_installer.exe
1452	setup_install.exe
1628	Thu20c467678e2c.exe
1160	Thu20a5f7ccaa78.exe
976	Thu20f2cf5e0c.exe
1588	Thu20bc9ea26f.exe
1696	Thu2094524d5e5b.exe
1976	Thu20fdd9ac35a68.exe
1948	Thu203b503b429e68.exe
1940	Thu2090b5515d63b2.exe
1072	Thu203cdb52ef3c6580d.exe
692	Thu20dae7c52bc0856.exe
1132	Chrome 5.exe
1960	PublicDwlBrowser1100.exe
1644	2.exe
2240	1697881.scr
2084	setup.exe
2284	BearVpn 3.exe
2480	Thu20a5f7ccaa78.exe
2692	2663541.exe
2812	LzmwAqmV.exe
2864	6527531.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00030000000130dd-107.dat	vmprotect
behavioral1/memory/692-191-0x0000000140000000-0x0000000140650000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6527531.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6527531.exe

Loads dropped DLL 59 IoCs

pid	Process
1088	setup_x86_x64_install.exe
1616	setup_installer.exe
1616	setup_installer.exe
1616	setup_installer.exe
1616	setup_installer.exe
1616	setup_installer.exe
1616	setup_installer.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
1452	setup_install.exe
684	cmd.exe
580	cmd.exe
1784	cmd.exe
1784	cmd.exe
1628	Thu20c467678e2c.exe
1628	Thu20c467678e2c.exe
1728	cmd.exe
1444	cmd.exe
1728	cmd.exe
1160	Thu20a5f7ccaa78.exe
1160	Thu20a5f7ccaa78.exe
1140	cmd.exe
384	cmd.exe
1696	Thu2094524d5e5b.exe
1696	Thu2094524d5e5b.exe
536	cmd.exe
1976	Thu20fdd9ac35a68.exe
1976	Thu20fdd9ac35a68.exe
536	cmd.exe
1520	cmd.exe
1716	cmd.exe
1588	Thu20bc9ea26f.exe
1588	Thu20bc9ea26f.exe
1948	Thu203b503b429e68.exe
1948	Thu203b503b429e68.exe
1628	Thu20c467678e2c.exe
1628	Thu20c467678e2c.exe
1628	Thu20c467678e2c.exe
1628	Thu20c467678e2c.exe
1628	Thu20c467678e2c.exe
2084	setup.exe
2284	BearVpn 3.exe
2284	BearVpn 3.exe
1160	Thu20a5f7ccaa78.exe
2480	Thu20a5f7ccaa78.exe
2480	Thu20a5f7ccaa78.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2656	rundll32.exe
2812	LzmwAqmV.exe
2812	LzmwAqmV.exe
2864	6527531.exe
2864	6527531.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6527531.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
48	ipinfo.io
49	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2864	6527531.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 2480	1160	Thu20a5f7ccaa78.exe	62

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	1948	WerFault.exe	47

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Thu20bc9ea26f.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2520	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2548	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Thu203b503b429e68.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Thu203b503b429e68.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Thu20f2cf5e0c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Thu20f2cf5e0c.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1588	Thu20bc9ea26f.exe
1588	Thu20bc9ea26f.exe
1420	powershell.exe
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found
1352	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1588	Thu20bc9ea26f.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	Thu20f2cf5e0c.exe
Token: SeCreateTokenPrivilege	1948	Thu203b503b429e68.exe
Token: SeAssignPrimaryTokenPrivilege	1948	Thu203b503b429e68.exe
Token: SeLockMemoryPrivilege	1948	Thu203b503b429e68.exe
Token: SeIncreaseQuotaPrivilege	1948	Thu203b503b429e68.exe
Token: SeMachineAccountPrivilege	1948	Thu203b503b429e68.exe
Token: SeTcbPrivilege	1948	Thu203b503b429e68.exe
Token: SeSecurityPrivilege	1948	Thu203b503b429e68.exe
Token: SeTakeOwnershipPrivilege	1948	Thu203b503b429e68.exe
Token: SeLoadDriverPrivilege	1948	Thu203b503b429e68.exe
Token: SeSystemProfilePrivilege	1948	Thu203b503b429e68.exe
Token: SeSystemtimePrivilege	1948	Thu203b503b429e68.exe
Token: SeProfSingleProcessPrivilege	1948	Thu203b503b429e68.exe
Token: SeIncBasePriorityPrivilege	1948	Thu203b503b429e68.exe
Token: SeCreatePagefilePrivilege	1948	Thu203b503b429e68.exe
Token: SeCreatePermanentPrivilege	1948	Thu203b503b429e68.exe
Token: SeBackupPrivilege	1948	Thu203b503b429e68.exe
Token: SeRestorePrivilege	1948	Thu203b503b429e68.exe
Token: SeShutdownPrivilege	1948	Thu203b503b429e68.exe
Token: SeDebugPrivilege	1948	Thu203b503b429e68.exe
Token: SeAuditPrivilege	1948	Thu203b503b429e68.exe
Token: SeSystemEnvironmentPrivilege	1948	Thu203b503b429e68.exe
Token: SeChangeNotifyPrivilege	1948	Thu203b503b429e68.exe
Token: SeRemoteShutdownPrivilege	1948	Thu203b503b429e68.exe
Token: SeUndockPrivilege	1948	Thu203b503b429e68.exe
Token: SeSyncAgentPrivilege	1948	Thu203b503b429e68.exe
Token: SeEnableDelegationPrivilege	1948	Thu203b503b429e68.exe
Token: SeManageVolumePrivilege	1948	Thu203b503b429e68.exe
Token: SeImpersonatePrivilege	1948	Thu203b503b429e68.exe
Token: SeCreateGlobalPrivilege	1948	Thu203b503b429e68.exe
Token: 31	1948	Thu203b503b429e68.exe
Token: 32	1948	Thu203b503b429e68.exe
Token: 33	1948	Thu203b503b429e68.exe
Token: 34	1948	Thu203b503b429e68.exe
Token: 35	1948	Thu203b503b429e68.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1960	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	1644	2.exe
Token: SeDebugPrivilege	2240	1697881.scr
Token: SeDebugPrivilege	2284	BearVpn 3.exe
Token: SeShutdownPrivilege	1352	Process not Found
Token: SeShutdownPrivilege	1352	Process not Found
Token: SeShutdownPrivilege	1352	Process not Found
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	2692	2663541.exe
Token: SeShutdownPrivilege	1352	Process not Found
Token: SeShutdownPrivilege	1352	Process not Found
Token: SeShutdownPrivilege	1352	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1088 wrote to memory of 1616	1088	setup_x86_x64_install.exe	25
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1616 wrote to memory of 1452	1616	setup_installer.exe	26
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 1952	1452	setup_install.exe	28
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 684	1452	setup_install.exe	29
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 580	1452	setup_install.exe	30
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1716	1452	setup_install.exe	31
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1784	1452	setup_install.exe	32
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1688	1452	setup_install.exe	37
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1140	1452	setup_install.exe	33
PID 1452 wrote to memory of 1444	1452	setup_install.exe	34

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1952
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20c467678e2c.exe
      4⤵
      Loads dropped DLL
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20c467678e2c.exe
        
        Thu20c467678e2c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        6⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:620
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
        
        C:\ProgramData\2663541.exe
        
        "C:\ProgramData\2663541.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\ProgramData\6527531.exe
        
        "C:\ProgramData\6527531.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        7⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20f2cf5e0c.exe
      4⤵
      Loads dropped DLL
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20f2cf5e0c.exe
        
        Thu20f2cf5e0c.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
      - C:\Users\Admin\AppData\Roaming\1697881.scr
        
        "C:\Users\Admin\AppData\Roaming\1697881.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
      - C:\Users\Admin\AppData\Roaming\4472494.scr
        
        "C:\Users\Admin\AppData\Roaming\4472494.scr" /S
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Roaming\1129332.scr
        
        "C:\Users\Admin\AppData\Roaming\1129332.scr" /S
        6⤵
        
        PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20dae7c52bc0856.exe
      4⤵
      Loads dropped DLL
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20dae7c52bc0856.exe
        
        Thu20dae7c52bc0856.exe
        5⤵
        Executes dropped EXE
        
        PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20a5f7ccaa78.exe
      4⤵
      Loads dropped DLL
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20a5f7ccaa78.exe
        
        Thu20a5f7ccaa78.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20a5f7ccaa78.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20a5f7ccaa78.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu203b503b429e68.exe
      4⤵
      Loads dropped DLL
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu203b503b429e68.exe
        
        Thu203b503b429e68.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 1484
        6⤵
        Program crash
        
        PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2094524d5e5b.exe
      4⤵
      Loads dropped DLL
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu2094524d5e5b.exe
        
        Thu2094524d5e5b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1696
      - C:\Users\Admin\Documents\TOIGjU3RmztHCYVjUwbLm25X.exe
        
        "C:\Users\Admin\Documents\TOIGjU3RmztHCYVjUwbLm25X.exe"
        6⤵
        
        PID:2268
      - C:\Users\Admin\Documents\WncZqbWgmBFcM1xxkBDm2dmk.exe
        
        "C:\Users\Admin\Documents\WncZqbWgmBFcM1xxkBDm2dmk.exe"
        6⤵
        
        PID:2552
      - C:\Users\Admin\Documents\mAnDRgKzt7dWfVXDT6rCZ4Cs.exe
        
        "C:\Users\Admin\Documents\mAnDRgKzt7dWfVXDT6rCZ4Cs.exe"
        6⤵
        
        PID:1756
      - C:\Users\Admin\Documents\5lGan68fHrhZW2vyrM01NyxZ.exe
        
        "C:\Users\Admin\Documents\5lGan68fHrhZW2vyrM01NyxZ.exe"
        6⤵
        
        PID:2892
      - C:\Users\Admin\Documents\dfpfhEzSQNQ2V7n4sKjNW1j5.exe
        
        "C:\Users\Admin\Documents\dfpfhEzSQNQ2V7n4sKjNW1j5.exe"
        6⤵
        
        PID:2836
      - C:\Users\Admin\Documents\yAMy4JyHsTyVV96y7mcvMbHS.exe
        
        "C:\Users\Admin\Documents\yAMy4JyHsTyVV96y7mcvMbHS.exe"
        6⤵
        
        PID:2908
      - C:\Users\Admin\Documents\MN_hgsK7GnRpGFhPyw1uW2MU.exe
        
        "C:\Users\Admin\Documents\MN_hgsK7GnRpGFhPyw1uW2MU.exe"
        6⤵
        
        PID:1240
      - C:\Users\Admin\Documents\HDWK_tNUsCEqq5A8ejI46x8f.exe
        
        "C:\Users\Admin\Documents\HDWK_tNUsCEqq5A8ejI46x8f.exe"
        6⤵
        
        PID:2660
      - C:\Users\Admin\Documents\Kc_OTx_p6BPGWxo_xswojYkg.exe
        
        "C:\Users\Admin\Documents\Kc_OTx_p6BPGWxo_xswojYkg.exe"
        6⤵
        
        PID:2704
      - C:\Users\Admin\Documents\fbKpZgrEZ4ZI_6nvrNTzOi3Y.exe
        
        "C:\Users\Admin\Documents\fbKpZgrEZ4ZI_6nvrNTzOi3Y.exe"
        6⤵
        
        PID:2352
      - C:\Users\Admin\Documents\nRwz_dEKXsA9Fd38YRRixdST.exe
        
        "C:\Users\Admin\Documents\nRwz_dEKXsA9Fd38YRRixdST.exe"
        6⤵
        
        PID:684
      - C:\Users\Admin\Documents\qs3Fl3IRFumSRlMyrIrBk5p3.exe
        
        "C:\Users\Admin\Documents\qs3Fl3IRFumSRlMyrIrBk5p3.exe"
        6⤵
        
        PID:1628
      - C:\Users\Admin\Documents\84hy2slg_o6W4a_ksmQAybDh.exe
        
        "C:\Users\Admin\Documents\84hy2slg_o6W4a_ksmQAybDh.exe"
        6⤵
        
        PID:2248
      - C:\Users\Admin\Documents\KYPrtNs1YferDG_einRvYn7c.exe
        
        "C:\Users\Admin\Documents\KYPrtNs1YferDG_einRvYn7c.exe"
        6⤵
        
        PID:2052
      - C:\Users\Admin\Documents\jKXQJXKLe68D4l2GRWlp9miv.exe
        
        "C:\Users\Admin\Documents\jKXQJXKLe68D4l2GRWlp9miv.exe"
        6⤵
        
        PID:800
      - C:\Users\Admin\Documents\rGB0AKP_Svfa5lathVkXNf_Q.exe
        
        "C:\Users\Admin\Documents\rGB0AKP_Svfa5lathVkXNf_Q.exe"
        6⤵
        
        PID:1608
      - C:\Users\Admin\Documents\kC5sEkc1XKKhmh_eFJtE23tm.exe
        
        "C:\Users\Admin\Documents\kC5sEkc1XKKhmh_eFJtE23tm.exe"
        6⤵
        
        PID:1672
      - C:\Users\Admin\Documents\HPQxruU1YgiV8K48fOPcEYKs.exe
        
        "C:\Users\Admin\Documents\HPQxruU1YgiV8K48fOPcEYKs.exe"
        6⤵
        
        PID:1984
      - C:\Users\Admin\Documents\jN7bpgpqJjeE1V4PLkBxSocW.exe
        
        "C:\Users\Admin\Documents\jN7bpgpqJjeE1V4PLkBxSocW.exe"
        6⤵
        
        PID:2092
      - C:\Users\Admin\Documents\JmuOIFkilZIV2fRQrB0S_TPu.exe
        
        "C:\Users\Admin\Documents\JmuOIFkilZIV2fRQrB0S_TPu.exe"
        6⤵
        
        PID:816
      - C:\Users\Admin\Documents\qzQwFHCfB6InpNseB4OLSyCN.exe
        
        "C:\Users\Admin\Documents\qzQwFHCfB6InpNseB4OLSyCN.exe"
        6⤵
        
        PID:600
      - C:\Users\Admin\Documents\HDC65QaBcrdarU2WHYT4ru8y.exe
        
        "C:\Users\Admin\Documents\HDC65QaBcrdarU2WHYT4ru8y.exe"
        6⤵
        
        PID:1652
      - C:\Users\Admin\Documents\QJVFC0W8zOVQ7t76AVw5oJx3.exe
        
        "C:\Users\Admin\Documents\QJVFC0W8zOVQ7t76AVw5oJx3.exe"
        6⤵
        
        PID:836
      - C:\Users\Admin\Documents\3q2CJ4b8zY5N0VU1iZKuX7ZT.exe
        
        "C:\Users\Admin\Documents\3q2CJ4b8zY5N0VU1iZKuX7ZT.exe"
        6⤵
        
        PID:1232
      - C:\Users\Admin\Documents\JDjVLLGPp6uOI1XChKicNRHQ.exe
        
        "C:\Users\Admin\Documents\JDjVLLGPp6uOI1XChKicNRHQ.exe"
        6⤵
        
        PID:2104
      - C:\Users\Admin\Documents\nwnhWA8PEnaUL9PzOdRfikS9.exe
        
        "C:\Users\Admin\Documents\nwnhWA8PEnaUL9PzOdRfikS9.exe"
        6⤵
        
        PID:1004
      - C:\Users\Admin\Documents\8BwGU0QNPI4qKJP4rWInmC2U.exe
        
        "C:\Users\Admin\Documents\8BwGU0QNPI4qKJP4rWInmC2U.exe"
        6⤵
        
        PID:1800
      - C:\Users\Admin\Documents\PPUZNtT_QTKbHC3PRJAXNcKf.exe
        
        "C:\Users\Admin\Documents\PPUZNtT_QTKbHC3PRJAXNcKf.exe"
        6⤵
        
        PID:3000
      - C:\Users\Admin\Documents\ZLqT3aG4b865PXze1jz4OPvy.exe
        
        "C:\Users\Admin\Documents\ZLqT3aG4b865PXze1jz4OPvy.exe"
        6⤵
        
        PID:2804
      - C:\Users\Admin\Documents\VKzF5I7GpLk2Rt_bONK6IMrT.exe
        
        "C:\Users\Admin\Documents\VKzF5I7GpLk2Rt_bONK6IMrT.exe"
        6⤵
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2090b5515d63b2.exe
      4⤵
      Loads dropped DLL
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu2090b5515d63b2.exe
        
        Thu2090b5515d63b2.exe
        5⤵
        Executes dropped EXE
        
        PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2026c04e7218e1.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20bc9ea26f.exe
      4⤵
      Loads dropped DLL
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20bc9ea26f.exe
        
        Thu20bc9ea26f.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2025d6674aed72ba.exe /mixone
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu20fdd9ac35a68.exe
      4⤵
      Loads dropped DLL
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu20fdd9ac35a68.exe
        
        Thu20fdd9ac35a68.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu203cdb52ef3c6580d.exe
      4⤵
      Loads dropped DLL
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\7zS0569BE91\Thu203cdb52ef3c6580d.exe
        
        Thu203cdb52ef3c6580d.exe
        5⤵
        Executes dropped EXE
        
        PID:1072

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:2656

C:\Users\Admin\AppData\Local\Temp\709D.exe
C:\Users\Admin\AppData\Local\Temp\709D.exe
1⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\261.exe
C:\Users\Admin\AppData\Local\Temp\261.exe
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\3AC0.exe
C:\Users\Admin\AppData\Local\Temp\3AC0.exe
1⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\81DE.exe
C:\Users\Admin\AppData\Local\Temp\81DE.exe
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-191-0x0000000140000000-0x0000000140650000-memory.dmp

Filesize
6.3MB

Download
memory/976-187-0x000000001AD70000-0x000000001AD72000-memory.dmp

Filesize
8KB

Download
memory/976-161-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1088-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1132-270-0x00000000024F0000-0x00000000024F2000-memory.dmp

Filesize
8KB

Download
memory/1132-203-0x000000013F4E0000-0x000000013F4E1000-memory.dmp

Filesize
4KB

Download
memory/1160-192-0x00000000013E0000-0x00000000013E1000-memory.dmp

Filesize
4KB

Download
memory/1160-214-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1280-330-0x000000001BA10000-0x000000001BA12000-memory.dmp

Filesize
8KB

Download
memory/1352-213-0x00000000021E0000-0x00000000021F5000-memory.dmp

Filesize
84KB

Download
memory/1420-227-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/1420-243-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/1420-260-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1420-200-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/1420-198-0x0000000000502000-0x0000000000503000-memory.dmp

Filesize
4KB

Download
memory/1420-193-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/1420-195-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1452-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1452-104-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1452-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1452-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1452-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1452-92-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1452-96-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1452-93-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1452-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1452-108-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1588-199-0x0000000000230000-0x000000000027E000-memory.dmp

Filesize
312KB

Download
memory/1588-201-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1628-194-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/1644-209-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1644-212-0x000000001B140000-0x000000001B142000-memory.dmp

Filesize
8KB

Download
memory/1696-239-0x0000000003D20000-0x0000000003E60000-memory.dmp

Filesize
1.2MB

Download
memory/1940-189-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

Filesize
8KB

Download
memory/1940-190-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/1940-185-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1960-206-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1960-211-0x000000001ABE0000-0x000000001ABE2000-memory.dmp

Filesize
8KB

Download
memory/2084-229-0x0000000000400000-0x0000000002B5D000-memory.dmp

Filesize
39.4MB

Download
memory/2084-226-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/2240-217-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/2240-225-0x000000001ADA0000-0x000000001ADA2000-memory.dmp

Filesize
8KB

Download
memory/2240-221-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2284-228-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2284-223-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2480-234-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2480-250-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/2480-237-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2692-247-0x000000001AE00000-0x000000001AE02000-memory.dmp

Filesize
8KB

Download
memory/2692-244-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2692-246-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2812-269-0x0000000000400000-0x0000000000D39000-memory.dmp

Filesize
9.2MB

Download
memory/2812-268-0x0000000002B90000-0x00000000034AE000-memory.dmp

Filesize
9.1MB

Download
memory/2864-256-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download