arkei | f8eee2152f76d73d0eaa7be03d1232fdf15cf798167f43f06f4a58751780cd8a

Analysis

max time kernel
152s
max time network
147s
platform
windows10_x64
resource
win10-en-20210920
submitted
25-09-2021 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68dbe18a88fc1375deb8100e367826f7.exe
Size

284KB
MD5

68dbe18a88fc1375deb8100e367826f7
SHA1

d24df032cbfc2a19fe03873609d47f92195811c1
SHA256

f8eee2152f76d73d0eaa7be03d1232fdf15cf798167f43f06f4a58751780cd8a
SHA512

3048e16080140f78711f49c144ee3ef77f09b7fa41b76e8d9cc6e679eb0225801deae756d3783c39e7bc749eda955c7e2f71b912b8241979a8aee90899be288c

Score

10^/10

arkei raccoon redline smokeloader tofsee 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 700$f6d7183c9e82d2a9b81e6c0608450aa66cefb51f qq backdoor discovery evasion infostealer persistence spyware stealer suricata themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

135.181.142.223:30397

Extracted

Family

redline

Botnet

700$

65.21.231.57:60751

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes

url4cnc
https://t.me/justoprostohello

rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4020-128-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/4020-129-0x000000000041C5CE-mapping.dmp	family_redline
behavioral2/memory/4020-139-0x00000000052E0000-0x00000000058E6000-memory.dmp	family_redline
behavioral2/memory/4436-218-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/4436-226-0x000000000041C5CA-mapping.dmp	family_redline
behavioral2/memory/1844-229-0x00000000021D0000-0x00000000021EF000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata

Arkei Stealer Payload 2 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\71D9.exe	family_arkei
C:\Users\Admin\AppData\Local\Temp\71D9.exe	family_arkei

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

3DB6.exe3DB6.exe96E3.exe41AB.exe47F5.exe5748.exe5D15.exe61E9.exe6CA8.exeoiekvfxd.exe71D9.exeYZ7qcVHMUz.exe

pid	process
4268	3DB6.exe
4020	3DB6.exe
4608	96E3.exe
864	41AB.exe
1096	47F5.exe
1844	5748.exe
2268	5D15.exe
2840	61E9.exe
1492	6CA8.exe
4444	oiekvfxd.exe
3280	71D9.exe
3256	YZ7qcVHMUz.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

47F5.exe96E3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	47F5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	47F5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	96E3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	96E3.exe

Deletes itself 1 IoCs

Processes:

pid process

3020
Loads dropped DLL 9 IoCs

Processes:

71D9.exe61E9.exe

pid process

3280 71D9.exe
3280 71D9.exe
3280 71D9.exe
2840 61E9.exe
2840 61E9.exe
2840 61E9.exe
2840 61E9.exe
2840 61E9.exe
2840 61E9.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3020

pid	process
3280	71D9.exe
3280	71D9.exe
3280	71D9.exe
2840	61E9.exe
2840	61E9.exe
2840	61E9.exe
2840	61E9.exe
2840	61E9.exe
2840	61E9.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\96E3.exe	themida
C:\Users\Admin\AppData\Local\Temp\96E3.exe	themida
behavioral2/memory/4608-151-0x0000000000B70000-0x0000000000B71000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\47F5.exe	themida
C:\Users\Admin\AppData\Local\Temp\47F5.exe	themida
behavioral2/memory/1096-176-0x0000000000B00000-0x0000000000B01000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

96E3.exe47F5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	96E3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	47F5.exe

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

96E3.exe47F5.exe

pid process

4608 96E3.exe
1096 47F5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

pid	process
4608	96E3.exe
1096	47F5.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

68dbe18a88fc1375deb8100e367826f7.exe3DB6.exe5D15.exeoiekvfxd.exe

description	pid	process	target process
PID 3708 set thread context of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 4268 set thread context of 4020	4268	3DB6.exe	3DB6.exe
PID 2268 set thread context of 4436	2268	5D15.exe	RegSvcs.exe
PID 4444 set thread context of 3968	4444	oiekvfxd.exe	svchost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4360 3280 WerFault.exe 71D9.exe

pid	pid_target	process	target process
4360	3280	WerFault.exe	71D9.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

68dbe18a88fc1375deb8100e367826f7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68dbe18a88fc1375deb8100e367826f7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68dbe18a88fc1375deb8100e367826f7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	68dbe18a88fc1375deb8100e367826f7.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4544 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3132 timeout.exe

pid	process
4544	schtasks.exe

pid	process
3132	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 4cedd73d60655c0424edb47d450dd49d084297dce82e72baa46d34fdc48d541dcc514e2487cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56814db874f7638e6a5644490bdb57423e89d5805cff7b454758df21d5904e0a56f14da834c773de5af64419bdce0286682cd0934cbc4e4241ddc9b440e34fbac6916edc70f3252a0f40948f48cb47b22e5925c05cdc4e13b7e85c12b496da0f15d15d8844b773fe6a8571ff459a42f14b90ca56dfdc48d541ce4ad744a6bbfff02579fc27d440dd49d642df44710c8ca98a46d34fdc741461ee4ad743c35f4a77311db9a4c703bfaac5c15f4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743de3cc945d	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

68dbe18a88fc1375deb8100e367826f7.exe

pid	process
3740	68dbe18a88fc1375deb8100e367826f7.exe
3740	68dbe18a88fc1375deb8100e367826f7.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3020
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

68dbe18a88fc1375deb8100e367826f7.exe

pid process

3740 68dbe18a88fc1375deb8100e367826f7.exe

pid	process
3020

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

3DB6.exe96E3.exe47F5.exe

description	pid	process
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	4020	3DB6.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	4608	96E3.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	1096	47F5.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

68dbe18a88fc1375deb8100e367826f7.exe3DB6.exe41AB.exe5D15.exe

description	pid	process	target process
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3708 wrote to memory of 3740	3708	68dbe18a88fc1375deb8100e367826f7.exe	68dbe18a88fc1375deb8100e367826f7.exe
PID 3020 wrote to memory of 4268	3020		3DB6.exe
PID 3020 wrote to memory of 4268	3020		3DB6.exe
PID 3020 wrote to memory of 4268	3020		3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 4268 wrote to memory of 4020	4268	3DB6.exe	3DB6.exe
PID 3020 wrote to memory of 4608	3020		96E3.exe
PID 3020 wrote to memory of 4608	3020		96E3.exe
PID 3020 wrote to memory of 4608	3020		96E3.exe
PID 3020 wrote to memory of 864	3020		41AB.exe
PID 3020 wrote to memory of 864	3020		41AB.exe
PID 3020 wrote to memory of 864	3020		41AB.exe
PID 3020 wrote to memory of 1096	3020		47F5.exe
PID 3020 wrote to memory of 1096	3020		47F5.exe
PID 3020 wrote to memory of 1096	3020		47F5.exe
PID 3020 wrote to memory of 1844	3020		5748.exe
PID 3020 wrote to memory of 1844	3020		5748.exe
PID 3020 wrote to memory of 1844	3020		5748.exe
PID 3020 wrote to memory of 2268	3020		5D15.exe
PID 3020 wrote to memory of 2268	3020		5D15.exe
PID 3020 wrote to memory of 2268	3020		5D15.exe
PID 864 wrote to memory of 2796	864	41AB.exe	cmd.exe
PID 864 wrote to memory of 2796	864	41AB.exe	cmd.exe
PID 864 wrote to memory of 2796	864	41AB.exe	cmd.exe
PID 3020 wrote to memory of 2840	3020		61E9.exe
PID 3020 wrote to memory of 2840	3020		61E9.exe
PID 3020 wrote to memory of 2840	3020		61E9.exe
PID 864 wrote to memory of 4184	864	41AB.exe	cmd.exe
PID 864 wrote to memory of 4184	864	41AB.exe	cmd.exe
PID 864 wrote to memory of 4184	864	41AB.exe	cmd.exe
PID 864 wrote to memory of 5012	864	41AB.exe	sc.exe
PID 864 wrote to memory of 5012	864	41AB.exe	sc.exe
PID 864 wrote to memory of 5012	864	41AB.exe	sc.exe
PID 864 wrote to memory of 1420	864	41AB.exe	sc.exe
PID 864 wrote to memory of 1420	864	41AB.exe	sc.exe
PID 864 wrote to memory of 1420	864	41AB.exe	sc.exe
PID 864 wrote to memory of 5040	864	41AB.exe	sc.exe
PID 864 wrote to memory of 5040	864	41AB.exe	sc.exe
PID 864 wrote to memory of 5040	864	41AB.exe	sc.exe
PID 3020 wrote to memory of 1492	3020		6CA8.exe
PID 3020 wrote to memory of 1492	3020		6CA8.exe
PID 3020 wrote to memory of 1492	3020		6CA8.exe
PID 864 wrote to memory of 2112	864	41AB.exe	netsh.exe
PID 864 wrote to memory of 2112	864	41AB.exe	netsh.exe
PID 864 wrote to memory of 2112	864	41AB.exe	netsh.exe
PID 2268 wrote to memory of 4436	2268	5D15.exe	RegSvcs.exe
PID 2268 wrote to memory of 4436	2268	5D15.exe	RegSvcs.exe
PID 2268 wrote to memory of 4436	2268	5D15.exe	RegSvcs.exe
PID 2268 wrote to memory of 4436	2268	5D15.exe	RegSvcs.exe
PID 3020 wrote to memory of 3280	3020		71D9.exe
PID 3020 wrote to memory of 3280	3020		71D9.exe
PID 3020 wrote to memory of 3280	3020		71D9.exe
PID 2268 wrote to memory of 4436	2268	5D15.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\68dbe18a88fc1375deb8100e367826f7.exe
"C:\Users\Admin\AppData\Local\Temp\68dbe18a88fc1375deb8100e367826f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3708

C:\Users\Admin\AppData\Local\Temp\68dbe18a88fc1375deb8100e367826f7.exe
"C:\Users\Admin\AppData\Local\Temp\68dbe18a88fc1375deb8100e367826f7.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3740

C:\Users\Admin\AppData\Local\Temp\3DB6.exe
C:\Users\Admin\AppData\Local\Temp\3DB6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4268

C:\Users\Admin\AppData\Local\Temp\3DB6.exe
C:\Users\Admin\AppData\Local\Temp\3DB6.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Users\Admin\AppData\Local\Temp\96E3.exe
C:\Users\Admin\AppData\Local\Temp\96E3.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Users\Admin\AppData\Local\Temp\41AB.exe
C:\Users\Admin\AppData\Local\Temp\41AB.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\neaxfbyb\
2⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oiekvfxd.exe" C:\Windows\SysWOW64\neaxfbyb\
2⤵
PID:4184

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create neaxfbyb binPath= "C:\Windows\SysWOW64\neaxfbyb\oiekvfxd.exe /d\"C:\Users\Admin\AppData\Local\Temp\41AB.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:5012

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description neaxfbyb "wifi internet conection"
2⤵
PID:1420

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start neaxfbyb
2⤵
PID:5040

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\47F5.exe
C:\Users\Admin\AppData\Local\Temp\47F5.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Users\Admin\AppData\Local\Temp\5748.exe
C:\Users\Admin\AppData\Local\Temp\5748.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Users\Admin\AppData\Local\Temp\5D15.exe
C:\Users\Admin\AppData\Local\Temp\5D15.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\61E9.exe
C:\Users\Admin\AppData\Local\Temp\61E9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840

C:\Users\Admin\AppData\Local\Temp\YZ7qcVHMUz.exe
"C:\Users\Admin\AppData\Local\Temp\YZ7qcVHMUz.exe"
2⤵
- Executes dropped EXE
PID:3256

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
3⤵
- Creates scheduled task(s)
PID:4544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\61E9.exe"
2⤵
PID:696

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3132

C:\Users\Admin\AppData\Local\Temp\6CA8.exe
C:\Users\Admin\AppData\Local\Temp\6CA8.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\SysWOW64\neaxfbyb\oiekvfxd.exe
C:\Windows\SysWOW64\neaxfbyb\oiekvfxd.exe /d"C:\Users\Admin\AppData\Local\Temp\41AB.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4444

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3968

C:\Users\Admin\AppData\Local\Temp\71D9.exe
C:\Users\Admin\AppData\Local\Temp\71D9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 1352
2⤵
- Program crash
PID:4360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3DB6.exe.log
MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DB6.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DB6.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DB6.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\41AB.exe
MD5
25d5d497838fd97828d3deccd8ab3dcf

SHA1
9a62b4fee040e18f55e9b05cba21fa4e8befb604

SHA256
81a5160e2ab8b3de21042416f371c9c95118c6d3f0d7f08bb1fd1158dfcba31c

SHA512
ba019bb8f104d260f67f6a897185457069b269c3796549becd8928e9e28d2654bfee42af9a6361bb77c6698df6519b37278a1368e50615618e9ff197f56e82c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\41AB.exe
MD5
25d5d497838fd97828d3deccd8ab3dcf

SHA1
9a62b4fee040e18f55e9b05cba21fa4e8befb604

SHA256
81a5160e2ab8b3de21042416f371c9c95118c6d3f0d7f08bb1fd1158dfcba31c

SHA512
ba019bb8f104d260f67f6a897185457069b269c3796549becd8928e9e28d2654bfee42af9a6361bb77c6698df6519b37278a1368e50615618e9ff197f56e82c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\47F5.exe
MD5
b034912423e70d6efb04aec0f04e6ffe

SHA1
0b8cbd448b1f86c587854366a6527c46bb5edc02

SHA256
00132fa8c558159ddc4ce3354c091e99b5eeed4d255e89a04561eece5ad8e43c

SHA512
89879dba82bed65dc4d7c6aff8771f6301f81e335ff38b3e006f92525625b186159c0349f4a0198fa2e154109af4dfa4ab959b6a53de113e2beb4787aff9754f

Download Submit
C:\Users\Admin\AppData\Local\Temp\47F5.exe
MD5
b034912423e70d6efb04aec0f04e6ffe

SHA1
0b8cbd448b1f86c587854366a6527c46bb5edc02

SHA256
00132fa8c558159ddc4ce3354c091e99b5eeed4d255e89a04561eece5ad8e43c

SHA512
89879dba82bed65dc4d7c6aff8771f6301f81e335ff38b3e006f92525625b186159c0349f4a0198fa2e154109af4dfa4ab959b6a53de113e2beb4787aff9754f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5748.exe
MD5
c7a74664f4ddb6997ae6ea6dac763b1d

SHA1
77eed13dfc9f45ed52343026b1705935912ebd32

SHA256
7f3a1c052e2eb53fac9791aa61c961f701e287598246a4231ac6dd670180a682

SHA512
0c2b2a701166b8b091b0d92c2aac053f73e4ff994b09712f66a8bfa754fb8d9ce55ebaa6d6e71db6de26047df56ff322808725c60b21ccbf303ae9b209409b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\5748.exe
MD5
c7a74664f4ddb6997ae6ea6dac763b1d

SHA1
77eed13dfc9f45ed52343026b1705935912ebd32

SHA256
7f3a1c052e2eb53fac9791aa61c961f701e287598246a4231ac6dd670180a682

SHA512
0c2b2a701166b8b091b0d92c2aac053f73e4ff994b09712f66a8bfa754fb8d9ce55ebaa6d6e71db6de26047df56ff322808725c60b21ccbf303ae9b209409b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D15.exe
MD5
66418c1bbdff03a57d27110d51372efc

SHA1
a60da2e4052136b89a2d1f8c8a80f5694700f9da

SHA256
f5b28d8533842deac03a82b2f72bcf1d4b72a4aad1445b53558a3b01f7ef4c90

SHA512
dcf1e46c62e4db49b069866fd0ce50cd612e13a979f4bfe5ac78ccf6ac6b91850f3fa79c644409248d08d98ff4536422d2842ce04f3061edd0c2effde8e61875

Download Submit
C:\Users\Admin\AppData\Local\Temp\5D15.exe
MD5
66418c1bbdff03a57d27110d51372efc

SHA1
a60da2e4052136b89a2d1f8c8a80f5694700f9da

SHA256
f5b28d8533842deac03a82b2f72bcf1d4b72a4aad1445b53558a3b01f7ef4c90

SHA512
dcf1e46c62e4db49b069866fd0ce50cd612e13a979f4bfe5ac78ccf6ac6b91850f3fa79c644409248d08d98ff4536422d2842ce04f3061edd0c2effde8e61875

Download Submit
C:\Users\Admin\AppData\Local\Temp\61E9.exe
MD5
353204b6070092d4ae78a0c9c809b5ee

SHA1
aa12b981dab99ae5891a5bd6f451a884e6def987

SHA256
6aceac14e068c53ebe3a0dd3f0e1a8bcc34b39ce31ef96f3dfcfcfc2308d23eb

SHA512
2b821c8bfa1338260d4fe03006aeb50254eb12c496d43484f9772a3d3b0834fe7fe3e95374d4d642cd2a5684dec5ed357d0062941f7063e46d4a16ca3c6ef87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\61E9.exe
MD5
353204b6070092d4ae78a0c9c809b5ee

SHA1
aa12b981dab99ae5891a5bd6f451a884e6def987

SHA256
6aceac14e068c53ebe3a0dd3f0e1a8bcc34b39ce31ef96f3dfcfcfc2308d23eb

SHA512
2b821c8bfa1338260d4fe03006aeb50254eb12c496d43484f9772a3d3b0834fe7fe3e95374d4d642cd2a5684dec5ed357d0062941f7063e46d4a16ca3c6ef87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6CA8.exe
MD5
c38dbc0116454547e36acc6c850150a8

SHA1
80d0f13e9bba9fb7365bc0858f27207ff5fca46e

SHA256
f35af24da4d47968bf775ca94a4dc8f173726473df4ca26d2183b4442889085f

SHA512
efcfc8db36a348431d44013522e579e8016e551e7bfbf7f3b595368e3b449c79b2895db0761fda96e3f09970e76b1deb574b3195b81239c353feb6da2fdc9da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\6CA8.exe
MD5
c38dbc0116454547e36acc6c850150a8

SHA1
80d0f13e9bba9fb7365bc0858f27207ff5fca46e

SHA256
f35af24da4d47968bf775ca94a4dc8f173726473df4ca26d2183b4442889085f

SHA512
efcfc8db36a348431d44013522e579e8016e551e7bfbf7f3b595368e3b449c79b2895db0761fda96e3f09970e76b1deb574b3195b81239c353feb6da2fdc9da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\71D9.exe
MD5
7fe4c282af08f210d4ba53018ebb1518

SHA1
a3e638758b95201e91facbbf8ef0016c1b4eaaf7

SHA256
09184983b338a537b6a3cef50b9d1e080d5c7013dad40966111a60e382d3724c

SHA512
72c76fa20f4470bf81ec98502b566acb9277f7560a1ec65aa67f98f1679c4312c1efbd0d5373c864a7ebf9e9f01b093b23924ae61c06fb3a93dff8bc999237f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\71D9.exe
MD5
7fe4c282af08f210d4ba53018ebb1518

SHA1
a3e638758b95201e91facbbf8ef0016c1b4eaaf7

SHA256
09184983b338a537b6a3cef50b9d1e080d5c7013dad40966111a60e382d3724c

SHA512
72c76fa20f4470bf81ec98502b566acb9277f7560a1ec65aa67f98f1679c4312c1efbd0d5373c864a7ebf9e9f01b093b23924ae61c06fb3a93dff8bc999237f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\96E3.exe
MD5
f853fe6b26dcf67545675aec618f3a99

SHA1
a70f5ffd6dac789909ccb19dfb31272a520c7bc0

SHA256
091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

SHA512
4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\96E3.exe
MD5
f853fe6b26dcf67545675aec618f3a99

SHA1
a70f5ffd6dac789909ccb19dfb31272a520c7bc0

SHA256
091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

SHA512
4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\YZ7qcVHMUz.exe
MD5
ae0cee82f6da1b1839eaba47c30de444

SHA1
42a4cf3377a7e35510122943a547787457a275ab

SHA256
aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

SHA512
8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

Download Submit
C:\Users\Admin\AppData\Local\Temp\YZ7qcVHMUz.exe
MD5
ae0cee82f6da1b1839eaba47c30de444

SHA1
42a4cf3377a7e35510122943a547787457a275ab

SHA256
aa8eec4de190b92115aa02baafdc3abc1be303c298995f5779c2452d4dc3e14b

SHA512
8355cabc1bf4885f96714201f22c4cdc83067b640784b10388970ced82c7ff6077d98ac7822e695833324afcbe24b4dc8161eafdd3692615d0dc277f6e3ad055

Download Submit
C:\Users\Admin\AppData\Local\Temp\oiekvfxd.exe
MD5
3af61ff9a64db33498b9049aeba0d5cf

SHA1
cb5068cda73fc5e272b89e02eae0b8486d9440b9

SHA256
1fd2cdf249259a6b07888e55486856544c4d88567001fd63d6d07f42c10ef741

SHA512
3a55a62cc1132dbdd30f31833044dbf7e7597b1bb450c31272adf068feb338bbbe1fc2277d1bc3b0f4a1f53d7e98cb69451c8415959d797385f73f10e1d80e11

Download Submit
C:\Windows\SysWOW64\neaxfbyb\oiekvfxd.exe
MD5
3af61ff9a64db33498b9049aeba0d5cf

SHA1
cb5068cda73fc5e272b89e02eae0b8486d9440b9

SHA256
1fd2cdf249259a6b07888e55486856544c4d88567001fd63d6d07f42c10ef741

SHA512
3a55a62cc1132dbdd30f31833044dbf7e7597b1bb450c31272adf068feb338bbbe1fc2277d1bc3b0f4a1f53d7e98cb69451c8415959d797385f73f10e1d80e11

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
memory/696-286-0x0000000000000000-mapping.dmp

Download
memory/864-193-0x00000000005B0000-0x00000000006FA000-memory.dmp

Filesize
1.3MB

Download
memory/864-168-0x0000000000000000-mapping.dmp

Download
memory/864-195-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1096-171-0x0000000000000000-mapping.dmp

Download
memory/1096-183-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/1096-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/1096-176-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1420-207-0x0000000000000000-mapping.dmp

Download
memory/1492-257-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1492-256-0x0000000002010000-0x00000000020A0000-memory.dmp

Filesize
576KB

Download
memory/1492-213-0x0000000000000000-mapping.dmp

Download
memory/1844-243-0x0000000004A42000-0x0000000004A43000-memory.dmp

Filesize
4KB

Download
memory/1844-241-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1844-184-0x0000000000000000-mapping.dmp

Download
memory/1844-247-0x0000000004A44000-0x0000000004A46000-memory.dmp

Filesize
8KB

Download
memory/1844-229-0x00000000021D0000-0x00000000021EF000-memory.dmp

Filesize
124KB

Download
memory/1844-235-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/1844-245-0x0000000004A43000-0x0000000004A44000-memory.dmp

Filesize
4KB

Download
memory/1844-238-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2112-217-0x0000000000000000-mapping.dmp

Download
memory/2268-190-0x0000000001360000-0x00000000013D4000-memory.dmp

Filesize
464KB

Download
memory/2268-196-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/2268-194-0x0000000000DC0000-0x0000000000E03000-memory.dmp

Filesize
268KB

Download
memory/2268-192-0x0000000074CF0000-0x0000000074EB2000-memory.dmp

Filesize
1.8MB

Download
memory/2268-191-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2268-187-0x0000000000000000-mapping.dmp

Download
memory/2796-197-0x0000000000000000-mapping.dmp

Download
memory/2840-251-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2840-250-0x0000000002170000-0x0000000002200000-memory.dmp

Filesize
576KB

Download
memory/2840-198-0x0000000000000000-mapping.dmp

Download
memory/3020-118-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/3132-289-0x0000000000000000-mapping.dmp

Download
memory/3256-292-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3256-285-0x0000000000000000-mapping.dmp

Download
memory/3256-291-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/3280-219-0x0000000000000000-mapping.dmp

Download
memory/3708-117-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3740-116-0x0000000000402FA5-mapping.dmp

Download
memory/3740-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3968-273-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/3968-263-0x0000000000619A6B-mapping.dmp

Download
memory/4020-140-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/4020-128-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4020-137-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/4020-129-0x000000000041C5CE-mapping.dmp

Download
memory/4020-134-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/4020-138-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/4020-139-0x00000000052E0000-0x00000000058E6000-memory.dmp

Filesize
6.0MB

Download
memory/4020-141-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/4020-136-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/4020-143-0x0000000007080000-0x0000000007081000-memory.dmp

Filesize
4KB

Download
memory/4020-146-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/4020-135-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/4184-201-0x0000000000000000-mapping.dmp

Download
memory/4268-127-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4268-126-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/4268-119-0x0000000000000000-mapping.dmp

Download
memory/4268-122-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/4268-124-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/4268-125-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/4436-218-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4436-237-0x00000000054C0000-0x0000000005AC6000-memory.dmp

Filesize
6.0MB

Download
memory/4436-226-0x000000000041C5CA-mapping.dmp

Download
memory/4436-227-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/4444-262-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4444-258-0x0000000000590000-0x00000000005A3000-memory.dmp

Filesize
76KB

Download
memory/4544-290-0x0000000000000000-mapping.dmp

Download
memory/4608-147-0x0000000000000000-mapping.dmp

Download
memory/4608-151-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4608-157-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/4608-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

Filesize
1.6MB

Download
memory/4608-159-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/4608-167-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

Filesize
4KB

Download
memory/5012-204-0x0000000000000000-mapping.dmp

Download
memory/5040-212-0x0000000000000000-mapping.dmp

Download