arkei | 188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866

Analysis

max time kernel
153s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
12-10-2021 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
Size

175KB
MD5

11ef2eed15aff42b4557fc76093268dc
SHA1

6e313dd7b69d4cb5f62b047534653e94d72a1757
SHA256

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866
SHA512

8b0cb88000391b9ad09e7103724ef013ec4cac8bc661e124c6d273b66f28e94794c9374bf5f790e87b4d8310f498ff0197fdc15ec582e8955a23bf1c30086656

Score

10^/10

arkei redline servhelper smokeloader xmrig megaproliv newpro w1 backdoor discovery infostealer miner persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://linavanandr11.club/

http://iselaharty12.club/

http://giovaninardo13.club/

http://zayneliann14.club/

http://zorinosali15.club/

rc4.i32

Extracted

Family

redline

Botnet

109.234.34.165:12323

Extracted

Family

redline

Botnet

MegaProliv

93.115.20.139:28978

Extracted

Family

redline

Botnet

Newpro

139.99.118.252:12517

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2732-122-0x0000000002460000-0x0000000002491000-memory.dmp	family_redline
behavioral1/memory/2732-127-0x0000000002630000-0x000000000264C000-memory.dmp	family_redline
behavioral1/memory/2100-170-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2224-169-0x000000000CB50000-0x000000000CB8D000-memory.dmp	family_redline
behavioral1/memory/2224-175-0x000000000F1E0000-0x000000000F21C000-memory.dmp	family_redline
behavioral1/memory/2100-172-0x000000000041B25E-mapping.dmp	family_redline
behavioral1/memory/2100-193-0x0000000004E40000-0x0000000005446000-memory.dmp	family_redline

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Arkei Stealer Payload 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2948-202-0x0000000000400000-0x0000000004C0B000-memory.dmp	family_arkei

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

DCB9.exeE4B9.exeE864.exeF0F0.exeF631.exeE864.exettedwuwttedwuw

pid process

2732 DCB9.exe
2340 E4B9.exe
1176 E864.exe
2224 F0F0.exe
2948 F631.exe
2100 E864.exe
4048 ttedwuw
352 ttedwuw
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Deletes itself 1 IoCs

Processes:

pid process

3060
Loads dropped DLL 3 IoCs

Processes:

F631.exe

pid process

2948 F631.exe
2948 F631.exe
2948 F631.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe

pid	process
2732	DCB9.exe
2340	E4B9.exe
1176	E864.exe
2224	F0F0.exe
2948	F631.exe
2100	E864.exe
4048	ttedwuw
352	ttedwuw

pid	process
3060

pid	process
2948	F631.exe
2948	F631.exe
2948	F631.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exeE864.exettedwuw

description	pid	process	target process
PID 656 set thread context of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 1176 set thread context of 2100	1176	E864.exe	E864.exe
PID 4048 set thread context of 352	4048	ttedwuw	ttedwuw

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1688 2948 WerFault.exe F631.exe

pid	pid_target	process	target process
1688	2948	WerFault.exe	F631.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exettedwuw

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ttedwuw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ttedwuw
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ttedwuw

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2232 reg.exe
Runs net.exe

pid	process
2232	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe

pid	process
2384	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
2384	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060
3060

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3060
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

624
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exettedwuw

pid process

2384 188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
352 ttedwuw

pid	process
3060

pid	process
624

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

DCB9.exepowershell.exeE864.exeF0F0.exeWerFault.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeDebugPrivilege	2732	DCB9.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	2100	E864.exe
Token: SeDebugPrivilege	2224	F0F0.exe
Token: SeRestorePrivilege	1688	WerFault.exe
Token: SeBackupPrivilege	1688	WerFault.exe
Token: SeDebugPrivilege	1688	WerFault.exe
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060
Token: SeShutdownPrivilege	3060
Token: SeCreatePagefilePrivilege	3060

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

3060
3060
3060
3060
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

3060
3060
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3060

pid	process
3060
3060
3060
3060

pid	process
3060
3060

pid	process
3060

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exeE864.exeE4B9.exepowershell.execsc.exettedwuw

description	pid	process	target process
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 656 wrote to memory of 2384	656	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe	188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
PID 3060 wrote to memory of 2732	3060		DCB9.exe
PID 3060 wrote to memory of 2732	3060		DCB9.exe
PID 3060 wrote to memory of 2732	3060		DCB9.exe
PID 3060 wrote to memory of 2340	3060		E4B9.exe
PID 3060 wrote to memory of 2340	3060		E4B9.exe
PID 3060 wrote to memory of 2340	3060		E4B9.exe
PID 3060 wrote to memory of 1176	3060		E864.exe
PID 3060 wrote to memory of 1176	3060		E864.exe
PID 3060 wrote to memory of 1176	3060		E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 3060 wrote to memory of 2224	3060		F0F0.exe
PID 3060 wrote to memory of 2224	3060		F0F0.exe
PID 3060 wrote to memory of 2224	3060		F0F0.exe
PID 3060 wrote to memory of 2948	3060		F631.exe
PID 3060 wrote to memory of 2948	3060		F631.exe
PID 3060 wrote to memory of 2948	3060		F631.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 1176 wrote to memory of 2100	1176	E864.exe	E864.exe
PID 2340 wrote to memory of 3868	2340	E4B9.exe	powershell.exe
PID 2340 wrote to memory of 3868	2340	E4B9.exe	powershell.exe
PID 2340 wrote to memory of 3868	2340	E4B9.exe	powershell.exe
PID 3868 wrote to memory of 3836	3868	powershell.exe	csc.exe
PID 3868 wrote to memory of 3836	3868	powershell.exe	csc.exe
PID 3868 wrote to memory of 3836	3868	powershell.exe	csc.exe
PID 3836 wrote to memory of 3516	3836	csc.exe	cvtres.exe
PID 3836 wrote to memory of 3516	3836	csc.exe	cvtres.exe
PID 3836 wrote to memory of 3516	3836	csc.exe	cvtres.exe
PID 3868 wrote to memory of 2524	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 2524	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 2524	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 3056	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 3056	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 3056	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 2300	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 2300	3868	powershell.exe	powershell.exe
PID 3868 wrote to memory of 2300	3868	powershell.exe	powershell.exe
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 4048 wrote to memory of 352	4048	ttedwuw	ttedwuw
PID 3868 wrote to memory of 1480	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 1480	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 1480	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2232	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2232	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2232	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2100	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2100	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 2100	3868	powershell.exe	reg.exe
PID 3868 wrote to memory of 1904	3868	powershell.exe	net.exe
PID 3868 wrote to memory of 1904	3868	powershell.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
"C:\Users\Admin\AppData\Local\Temp\188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe
  "C:\Users\Admin\AppData\Local\Temp\188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2384

C:\Users\Admin\AppData\Local\Temp\DCB9.exe
C:\Users\Admin\AppData\Local\Temp\DCB9.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Users\Admin\AppData\Local\Temp\E4B9.exe
C:\Users\Admin\AppData\Local\Temp\E4B9.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e1dbvxqd\e1dbvxqd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34EC.tmp" "c:\Users\Admin\AppData\Local\Temp\e1dbvxqd\CSCF60A7DCE46744318BB38C04A32A4D668.TMP"
      4⤵
      PID:3516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:2232
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:3888
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:3844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:640
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:1176
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:2148

C:\Users\Admin\AppData\Local\Temp\E864.exe
C:\Users\Admin\AppData\Local\Temp\E864.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\E864.exe
  C:\Users\Admin\AppData\Local\Temp\E864.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

C:\Users\Admin\AppData\Local\Temp\F0F0.exe
C:\Users\Admin\AppData\Local\Temp\F0F0.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Users\Admin\AppData\Local\Temp\F631.exe
C:\Users\Admin\AppData\Local\Temp\F631.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 1284
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1688

C:\Users\Admin\AppData\Roaming\ttedwuw
C:\Users\Admin\AppData\Roaming\ttedwuw
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Roaming\ttedwuw
  C:\Users\Admin\AppData\Roaming\ttedwuw
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E864.exe.log

MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
f3068198b62b4b70404ec46694d632be

SHA1
7b0b31ae227cf2a78cb751573a9d07f755104ea0

SHA256
bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

SHA512
ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCB9.exe

MD5
f5c4d463115dc020d5ec1756da0258a0

SHA1
b66eb6992d7c0191d1255ae0ada35b6403221425

SHA256
fa0bcd10cdc9df5fe9806e16a933d71d49c93fb6b21e75e2215bb728212b570e

SHA512
854bbe52abf339b75e68c20aef0b905fb29c4c2580a44b957b6d6b02889b78a44f6605a2e45f61f358b7b63d3530b61f6bad513f0672bcef06268d9ea1c55350

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCB9.exe

MD5
f5c4d463115dc020d5ec1756da0258a0

SHA1
b66eb6992d7c0191d1255ae0ada35b6403221425

SHA256
fa0bcd10cdc9df5fe9806e16a933d71d49c93fb6b21e75e2215bb728212b570e

SHA512
854bbe52abf339b75e68c20aef0b905fb29c4c2580a44b957b6d6b02889b78a44f6605a2e45f61f358b7b63d3530b61f6bad513f0672bcef06268d9ea1c55350

Download Submit
C:\Users\Admin\AppData\Local\Temp\E4B9.exe

MD5
2686d02fd6a82432c2bbfccdf7f334de

SHA1
75c80a6877c6e0724d19de0f5149bed186760e27

SHA256
35270b20b568beb5f844e1b8c9bfe53498cfbac02633a9cb3ca5927a2cba4e4d

SHA512
22333918e2fed9e39c967313f77844b6bc4f3a2dbfe97223c08def7b80057b7c89f5b75460575172e99c11ee2b824c66e4417588a12ae6a314968c2a34d01698

Download Submit
C:\Users\Admin\AppData\Local\Temp\E4B9.exe

MD5
2686d02fd6a82432c2bbfccdf7f334de

SHA1
75c80a6877c6e0724d19de0f5149bed186760e27

SHA256
35270b20b568beb5f844e1b8c9bfe53498cfbac02633a9cb3ca5927a2cba4e4d

SHA512
22333918e2fed9e39c967313f77844b6bc4f3a2dbfe97223c08def7b80057b7c89f5b75460575172e99c11ee2b824c66e4417588a12ae6a314968c2a34d01698

Download Submit
C:\Users\Admin\AppData\Local\Temp\E864.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\E864.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\E864.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0F0.exe

MD5
5a79659f43aeee5f46d0537054422948

SHA1
8bbd07f91bcbf9ac6bd940726215d0c6809ccb31

SHA256
b084e1e1eb26a99f9b9185fa7e288dc68967601a5c9703a5f16ef12ebc37e689

SHA512
632f12fa66437b6e05fe899442a76c9088f3d8ddc9e9517169a73e032be110531b9cb4a3086429c3ccfe9ca0615f813d2a5da616a6597db48426f3dc29bc7647

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0F0.exe

MD5
5a79659f43aeee5f46d0537054422948

SHA1
8bbd07f91bcbf9ac6bd940726215d0c6809ccb31

SHA256
b084e1e1eb26a99f9b9185fa7e288dc68967601a5c9703a5f16ef12ebc37e689

SHA512
632f12fa66437b6e05fe899442a76c9088f3d8ddc9e9517169a73e032be110531b9cb4a3086429c3ccfe9ca0615f813d2a5da616a6597db48426f3dc29bc7647

Download Submit
C:\Users\Admin\AppData\Local\Temp\F631.exe

MD5
0df60b46f5517609acc64b835315763e

SHA1
24081084e6bad9fd035a0b8f29ca44eba0250314

SHA256
4e8f2c354fbce1b66da6d1f8cf7d3593686ea8f3586a900d9dc9830db32301b5

SHA512
fa358d3d23169643467f2a1dc93930be576c1cc86281e2ba2a0e572b1bc4a7677b944a80c0cb89b6e96cd14d94829d5b6c3c312bf6e1a0847d5e2bd5ea93495c

Download Submit
C:\Users\Admin\AppData\Local\Temp\F631.exe

MD5
0df60b46f5517609acc64b835315763e

SHA1
24081084e6bad9fd035a0b8f29ca44eba0250314

SHA256
4e8f2c354fbce1b66da6d1f8cf7d3593686ea8f3586a900d9dc9830db32301b5

SHA512
fa358d3d23169643467f2a1dc93930be576c1cc86281e2ba2a0e572b1bc4a7677b944a80c0cb89b6e96cd14d94829d5b6c3c312bf6e1a0847d5e2bd5ea93495c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES34EC.tmp

MD5
60dee2940016e5924db161e8bd466e63

SHA1
4fc2ed105b43dcd72602e4501a1a702694feb33f

SHA256
04ebec64a72e134788990ab6871b8103fce2eacbe1d5dd90ace411387e7409ca

SHA512
6ade3134b7048888de818aa10dd11498353397435dd1a47c982f99254c52f2fd3de53da9e89e09d3b791867c747615b542ee9c39704349d2e03035b1f85d7b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\e1dbvxqd\e1dbvxqd.dll

MD5
bbdcd8677cb6ffc3353b60ac2c5b7888

SHA1
f74c6646f8ff571e5a6f93d4d8ae8f335528cda4

SHA256
9be298b8ca2f28301978cedd0b65d4b3c7bc1305a50f8ae09f70bfe73f9ff478

SHA512
6f4be3ec4acb9cfd6ed9cf1433ebe73e644163f857baa63618958b69d6c2ed6e1514af9cf50947c6c14a4267f6c779647a78842a1ef9f7a0023e84f0c5a50466

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
794bf0ae26a7efb0c516cf4a7692c501

SHA1
c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2

SHA256
97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825

SHA512
20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Roaming\ttedwuw

MD5
11ef2eed15aff42b4557fc76093268dc

SHA1
6e313dd7b69d4cb5f62b047534653e94d72a1757

SHA256
188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866

SHA512
8b0cb88000391b9ad09e7103724ef013ec4cac8bc661e124c6d273b66f28e94794c9374bf5f790e87b4d8310f498ff0197fdc15ec582e8955a23bf1c30086656

Download Submit
C:\Users\Admin\AppData\Roaming\ttedwuw

MD5
11ef2eed15aff42b4557fc76093268dc

SHA1
6e313dd7b69d4cb5f62b047534653e94d72a1757

SHA256
188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866

SHA512
8b0cb88000391b9ad09e7103724ef013ec4cac8bc661e124c6d273b66f28e94794c9374bf5f790e87b4d8310f498ff0197fdc15ec582e8955a23bf1c30086656

Download Submit
C:\Users\Admin\AppData\Roaming\ttedwuw

MD5
11ef2eed15aff42b4557fc76093268dc

SHA1
6e313dd7b69d4cb5f62b047534653e94d72a1757

SHA256
188013348e571899fb2afedeede0c92aa21ecc850b9564e26b268e65cb745866

SHA512
8b0cb88000391b9ad09e7103724ef013ec4cac8bc661e124c6d273b66f28e94794c9374bf5f790e87b4d8310f498ff0197fdc15ec582e8955a23bf1c30086656

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e1dbvxqd\CSCF60A7DCE46744318BB38C04A32A4D668.TMP

MD5
1308af0a0ac20e3699ce2726cda65a77

SHA1
8b033ab6e9ff6918637d6900437725b6fdad7f08

SHA256
ff29e71f54a8ef59e41c12438d7eff92beec5d4ee9b92f540df65641d7aed2e1

SHA512
5461db1913d9a0e940631e5f50c519f0604bd6026453c9c41ee51d6420d4d1c360495c1bdd2f644e2d87bf1c5de5d6090a1c063ef7c18776256ded6f46579567

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e1dbvxqd\e1dbvxqd.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e1dbvxqd\e1dbvxqd.cmdline

MD5
361be1155a0230dcdba9879fdbf66070

SHA1
8c383b2fa937b882c3a5468de87d941253b66381

SHA256
3fd84ecd31aacd03663a203bdb01c5014f867ebac8eab0a72d70f8eb704a7b06

SHA512
b7d0781d2e89f49a374eaed55d7e48a0bbca4d69fca9301f85c8b0826fa50ca2344726e349eb24edf1eceeb2b753d2fa9b21f6836ee18b0570e2e19eb0f1ad7c

Download Submit
\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
memory/352-893-0x0000000000402DF8-mapping.dmp

Download
memory/640-1113-0x0000000000000000-mapping.dmp

Download
memory/656-115-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1176-146-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/1176-150-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1176-149-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/1176-147-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/1176-139-0x0000000000000000-mapping.dmp

Download
memory/1176-144-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/1176-1114-0x0000000000000000-mapping.dmp

Download
memory/1380-1138-0x0000000000000000-mapping.dmp

Download
memory/1480-1065-0x0000000000000000-mapping.dmp

Download
memory/1868-1108-0x0000000000000000-mapping.dmp

Download
memory/1904-1104-0x0000000000000000-mapping.dmp

Download
memory/2100-193-0x0000000004E40000-0x0000000005446000-memory.dmp

Filesize
6.0MB

Download
memory/2100-1067-0x0000000000000000-mapping.dmp

Download
memory/2100-172-0x000000000041B25E-mapping.dmp

Download
memory/2100-170-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2148-1139-0x0000000000000000-mapping.dmp

Download
memory/2224-189-0x000000000F330000-0x000000000F331000-memory.dmp

Filesize
4KB

Download
memory/2224-191-0x000000000F333000-0x000000000F334000-memory.dmp

Filesize
4KB

Download
memory/2224-169-0x000000000CB50000-0x000000000CB8D000-memory.dmp

Filesize
244KB

Download
memory/2224-175-0x000000000F1E0000-0x000000000F21C000-memory.dmp

Filesize
240KB

Download
memory/2224-151-0x0000000000000000-mapping.dmp

Download
memory/2224-161-0x0000000007630000-0x000000000C946000-memory.dmp

Filesize
83.1MB

Download
memory/2224-188-0x0000000000400000-0x00000000057CE000-memory.dmp

Filesize
83.8MB

Download
memory/2224-190-0x000000000F332000-0x000000000F333000-memory.dmp

Filesize
4KB

Download
memory/2224-192-0x000000000F334000-0x000000000F336000-memory.dmp

Filesize
8KB

Download
memory/2232-1066-0x0000000000000000-mapping.dmp

Download
memory/2300-793-0x0000000006D20000-0x0000000006D21000-memory.dmp

Filesize
4KB

Download
memory/2300-782-0x0000000000000000-mapping.dmp

Download
memory/2300-795-0x0000000006D22000-0x0000000006D23000-memory.dmp

Filesize
4KB

Download
memory/2300-824-0x000000007F2E0000-0x000000007F2E1000-memory.dmp

Filesize
4KB

Download
memory/2340-154-0x00000000058C0000-0x0000000005CBF000-memory.dmp

Filesize
4.0MB

Download
memory/2340-167-0x0000000006480000-0x0000000006481000-memory.dmp

Filesize
4KB

Download
memory/2340-166-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/2340-158-0x00000000015E2000-0x00000000015E3000-memory.dmp

Filesize
4KB

Download
memory/2340-157-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2340-165-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/2340-155-0x00000000010C0000-0x00000000014C2000-memory.dmp

Filesize
4.0MB

Download
memory/2340-162-0x00000000015E3000-0x00000000015E4000-memory.dmp

Filesize
4KB

Download
memory/2340-168-0x00000000015E4000-0x00000000015E5000-memory.dmp

Filesize
4KB

Download
memory/2340-137-0x0000000000CB7000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/2340-133-0x0000000000000000-mapping.dmp

Download
memory/2340-173-0x0000000008230000-0x0000000008231000-memory.dmp

Filesize
4KB

Download
memory/2384-117-0x0000000000402DF8-mapping.dmp

Download
memory/2384-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2524-302-0x000000007F4C0000-0x000000007F4C1000-memory.dmp

Filesize
4KB

Download
memory/2524-271-0x0000000004FD2000-0x0000000004FD3000-memory.dmp

Filesize
4KB

Download
memory/2524-270-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/2524-265-0x0000000000000000-mapping.dmp

Download
memory/2728-1109-0x0000000000000000-mapping.dmp

Download
memory/2732-199-0x0000000006960000-0x0000000006961000-memory.dmp

Filesize
4KB

Download
memory/2732-122-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/2732-130-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/2732-131-0x0000000005542000-0x0000000005543000-memory.dmp

Filesize
4KB

Download
memory/2732-148-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2732-201-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/2732-142-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/2732-132-0x0000000005543000-0x0000000005544000-memory.dmp

Filesize
4KB

Download
memory/2732-127-0x0000000002630000-0x000000000264C000-memory.dmp

Filesize
112KB

Download
memory/2732-129-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/2732-119-0x0000000000000000-mapping.dmp

Download
memory/2732-136-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/2732-138-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/2732-141-0x0000000005544000-0x0000000005545000-memory.dmp

Filesize
4KB

Download
memory/2948-194-0x0000000006A40000-0x000000000B1EB000-memory.dmp

Filesize
71.7MB

Download
memory/2948-202-0x0000000000400000-0x0000000004C0B000-memory.dmp

Filesize
72.0MB

Download
memory/2948-160-0x0000000000000000-mapping.dmp

Download
memory/3056-559-0x000000007E1C0000-0x000000007E1C1000-memory.dmp

Filesize
4KB

Download
memory/3056-521-0x0000000000000000-mapping.dmp

Download
memory/3056-533-0x0000000004CB2000-0x0000000004CB3000-memory.dmp

Filesize
4KB

Download
memory/3056-532-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3060-118-0x00000000013F0000-0x0000000001406000-memory.dmp

Filesize
88KB

Download
memory/3060-1054-0x0000000002E10000-0x0000000002E26000-memory.dmp

Filesize
88KB

Download
memory/3200-1105-0x0000000000000000-mapping.dmp

Download
memory/3516-236-0x0000000000000000-mapping.dmp

Download
memory/3836-233-0x0000000000000000-mapping.dmp

Download
memory/3844-1112-0x0000000000000000-mapping.dmp

Download
memory/3868-203-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/3868-196-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3868-198-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/3868-215-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/3868-197-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3868-204-0x0000000007492000-0x0000000007493000-memory.dmp

Filesize
4KB

Download
memory/3868-207-0x0000000007970000-0x0000000007971000-memory.dmp

Filesize
4KB

Download
memory/3868-1239-0x000000007F100000-0x000000007F101000-memory.dmp

Filesize
4KB

Download
memory/3868-195-0x0000000000000000-mapping.dmp

Download
memory/3868-200-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/3868-242-0x0000000007493000-0x0000000007494000-memory.dmp

Filesize
4KB

Download
memory/3868-208-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/3868-212-0x00000000083A0000-0x00000000083A1000-memory.dmp

Filesize
4KB

Download
memory/3888-1110-0x0000000000000000-mapping.dmp

Download
memory/3920-1111-0x0000000000000000-mapping.dmp

Download
memory/4088-1115-0x0000000000000000-mapping.dmp

Download