redline | 2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c

Analysis

max time kernel
152s
max time network
154s
platform
windows10_x64
resource
win10-en-20211104
submitted
02-12-2021 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
Size

232KB
MD5

7a64cc4cfb6cfed7fccd3853a5789b9c
SHA1

31168fc6a02f1e6f6b24c526666915353f6e0f88
SHA256

2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c
SHA512

2d0da69415f989c35b784222b00aba469a4d400ec3e32143c4cdfc9cecb2d96ce7544a299802c1ba12b79c8527b841ff1ae35f99228d95832c4293461aa49e9e

Score

10^/10

redline smokeloader 1 backdoor collection discovery evasion infostealer spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

https://cinems.club/search.php

https://clothes.surf/search.php

rc4.i32

Extracted

Family

redline

Botnet

45.9.20.59:46287

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2752-135-0x00000000049D0000-0x00000000049FE000-memory.dmp	family_redline
behavioral1/memory/2752-141-0x0000000004DC0000-0x0000000004DEC000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

A9B9.exeEA0F.exeF76E.exe

pid process

3752 A9B9.exe
3640 EA0F.exe
2752 F76E.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Deletes itself 1 IoCs

Processes:

pid process

3040
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3752	A9B9.exe
3640	EA0F.exe
2752	F76E.exe

pid	process
3040

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1104 3640 WerFault.exe EA0F.exe
2104 3692 WerFault.exe DllHost.exe

pid	pid_target	process	target process
1104	3640	WerFault.exe	EA0F.exe
2104	3692	WerFault.exe	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

A9B9.exe2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A9B9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A9B9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A9B9.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2160 tasklist.exe
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exe

pid process

2108 ipconfig.exe
3548 NETSTAT.EXE
3792 NETSTAT.EXE
4088 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

3588 systeminfo.exe

pid	process
2160	tasklist.exe

pid	process
2108	ipconfig.exe
3548	NETSTAT.EXE
3792	NETSTAT.EXE
4088	ipconfig.exe

pid	process
3588	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8281C3E-5358-11EC-B34F-56E05CEBA64F} = "0"	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe

pid	process
2632	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
2632	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3040

pid	process
3040

Suspicious behavior: MapViewOfSection 54 IoCs

Processes:

2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exeA9B9.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
2632	2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
3752	A9B9.exe
3040
3040
3040
3040
3040
3040
656	explorer.exe
656	explorer.exe
3040
3040
2180	explorer.exe
2180	explorer.exe
3040
3040
648	explorer.exe
648	explorer.exe
3040
3040
1196	explorer.exe
1196	explorer.exe
3040
3040
1504	explorer.exe
1504	explorer.exe
3040
3040
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe
1712	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exeF76E.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1104	WerFault.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	2752	F76E.exe
Token: SeIncreaseQuotaPrivilege	1816	WMIC.exe
Token: SeSecurityPrivilege	1816	WMIC.exe
Token: SeTakeOwnershipPrivilege	1816	WMIC.exe
Token: SeLoadDriverPrivilege	1816	WMIC.exe
Token: SeSystemProfilePrivilege	1816	WMIC.exe
Token: SeSystemtimePrivilege	1816	WMIC.exe
Token: SeProfSingleProcessPrivilege	1816	WMIC.exe
Token: SeIncBasePriorityPrivilege	1816	WMIC.exe
Token: SeCreatePagefilePrivilege	1816	WMIC.exe
Token: SeBackupPrivilege	1816	WMIC.exe
Token: SeRestorePrivilege	1816	WMIC.exe
Token: SeShutdownPrivilege	1816	WMIC.exe
Token: SeDebugPrivilege	1816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1816	WMIC.exe
Token: SeRemoteShutdownPrivilege	1816	WMIC.exe
Token: SeUndockPrivilege	1816	WMIC.exe
Token: SeManageVolumePrivilege	1816	WMIC.exe
Token: 33	1816	WMIC.exe
Token: 34	1816	WMIC.exe
Token: 35	1816	WMIC.exe
Token: 36	1816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1816	WMIC.exe
Token: SeSecurityPrivilege	1816	WMIC.exe
Token: SeTakeOwnershipPrivilege	1816	WMIC.exe
Token: SeLoadDriverPrivilege	1816	WMIC.exe
Token: SeSystemProfilePrivilege	1816	WMIC.exe
Token: SeSystemtimePrivilege	1816	WMIC.exe
Token: SeProfSingleProcessPrivilege	1816	WMIC.exe
Token: SeIncBasePriorityPrivilege	1816	WMIC.exe
Token: SeCreatePagefilePrivilege	1816	WMIC.exe
Token: SeBackupPrivilege	1816	WMIC.exe
Token: SeRestorePrivilege	1816	WMIC.exe
Token: SeShutdownPrivilege	1816	WMIC.exe
Token: SeDebugPrivilege	1816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1816	WMIC.exe
Token: SeRemoteShutdownPrivilege	1816	WMIC.exe
Token: SeUndockPrivilege	1816	WMIC.exe
Token: SeManageVolumePrivilege	1816	WMIC.exe
Token: 33	1816	WMIC.exe
Token: 34	1816	WMIC.exe
Token: 35	1816	WMIC.exe
Token: 36	1816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe
Token: SeShutdownPrivilege	1632	WMIC.exe
Token: SeDebugPrivilege	1632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1632	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1784 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1784 iexplore.exe
1784 iexplore.exe
1168 IEXPLORE.EXE
1168 IEXPLORE.EXE

pid	process
1784	iexplore.exe

pid	process
1784	iexplore.exe
1784	iexplore.exe
1168	IEXPLORE.EXE
1168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3040 wrote to memory of 3752	3040		A9B9.exe
PID 3040 wrote to memory of 3752	3040		A9B9.exe
PID 3040 wrote to memory of 3752	3040		A9B9.exe
PID 3040 wrote to memory of 3640	3040		EA0F.exe
PID 3040 wrote to memory of 3640	3040		EA0F.exe
PID 3040 wrote to memory of 2752	3040		F76E.exe
PID 3040 wrote to memory of 2752	3040		F76E.exe
PID 3040 wrote to memory of 2752	3040		F76E.exe
PID 3040 wrote to memory of 1408	3040		cmd.exe
PID 3040 wrote to memory of 1408	3040		cmd.exe
PID 1408 wrote to memory of 1816	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1816	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1632	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1632	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 4028	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 4028	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2288	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2288	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1236	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1236	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2880	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2880	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 900	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 900	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2736	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2736	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 588	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 588	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1336	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1336	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 680	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 680	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2320	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2320	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1848	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 1848	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2116	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2116	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 2108	1408	cmd.exe	ipconfig.exe
PID 1408 wrote to memory of 2108	1408	cmd.exe	ipconfig.exe
PID 1408 wrote to memory of 3012	1408	cmd.exe	ROUTE.EXE
PID 1408 wrote to memory of 3012	1408	cmd.exe	ROUTE.EXE
PID 1408 wrote to memory of 2288	1408	cmd.exe	netsh.exe
PID 1408 wrote to memory of 2288	1408	cmd.exe	netsh.exe
PID 1408 wrote to memory of 3588	1408	cmd.exe	systeminfo.exe
PID 1408 wrote to memory of 3588	1408	cmd.exe	systeminfo.exe
PID 1408 wrote to memory of 2160	1408	cmd.exe	tasklist.exe
PID 1408 wrote to memory of 2160	1408	cmd.exe	tasklist.exe
PID 1408 wrote to memory of 2684	1408	cmd.exe	net.exe
PID 1408 wrote to memory of 2684	1408	cmd.exe	net.exe
PID 2684 wrote to memory of 2680	2684	net.exe	net1.exe
PID 2684 wrote to memory of 2680	2684	net.exe	net1.exe
PID 1408 wrote to memory of 3972	1408	cmd.exe	net.exe
PID 1408 wrote to memory of 3972	1408	cmd.exe	net.exe
PID 3972 wrote to memory of 3120	3972	net.exe	net1.exe
PID 3972 wrote to memory of 3120	3972	net.exe	net1.exe
PID 1408 wrote to memory of 2932	1408	cmd.exe	net.exe
PID 1408 wrote to memory of 2932	1408	cmd.exe	net.exe
PID 2932 wrote to memory of 1868	2932	net.exe	net1.exe
PID 2932 wrote to memory of 1868	2932	net.exe	net1.exe
PID 1408 wrote to memory of 2880	1408	cmd.exe	net.exe
PID 1408 wrote to memory of 2880	1408	cmd.exe	net.exe
PID 2880 wrote to memory of 2344	2880	net.exe	net1.exe
PID 2880 wrote to memory of 2344	2880	net.exe	net1.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3252

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3692 -s 908
2⤵
- Program crash
PID:2104

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3468

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3264

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2692

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2368

C:\Users\Admin\AppData\Local\Temp\2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe
"C:\Users\Admin\AppData\Local\Temp\2363e6dbda5bec8cc5967ff6bad455978aa374c48eb94755344270a5ce387b2c.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2632

C:\Users\Admin\AppData\Local\Temp\A9B9.exe
C:\Users\Admin\AppData\Local\Temp\A9B9.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3752

C:\Users\Admin\AppData\Local\Temp\EA0F.exe
C:\Users\Admin\AppData\Local\Temp\EA0F.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3640 -s 424
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Users\Admin\AppData\Local\Temp\F76E.exe
C:\Users\Admin\AppData\Local\Temp\F76E.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
2⤵
PID:4028

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
2⤵
PID:2288

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
2⤵
PID:1236

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
2⤵
PID:2880

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
2⤵
PID:900

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
2⤵
PID:2736

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
2⤵
PID:588

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
2⤵
PID:1336

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
2⤵
PID:680

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
2⤵
PID:2320

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
2⤵
PID:1848

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
2⤵
PID:2116

C:\Windows\system32\ipconfig.exe
ipconfig /displaydns
2⤵
- Gathers network information
PID:2108

C:\Windows\system32\ROUTE.EXE
route print
2⤵
PID:3012

C:\Windows\system32\netsh.exe
netsh firewall show state
2⤵
PID:2288

C:\Windows\system32\systeminfo.exe
systeminfo
2⤵
- Gathers system information
PID:3588

C:\Windows\system32\tasklist.exe
tasklist /v
2⤵
- Enumerates processes with tasklist
PID:2160

C:\Windows\system32\net.exe
net accounts /domain
2⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 accounts /domain
3⤵
PID:2680

C:\Windows\system32\net.exe
net share
2⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 share
3⤵
PID:3120

C:\Windows\system32\net.exe
net user
2⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
3⤵
PID:1868

C:\Windows\system32\net.exe
net user /domain
2⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user /domain
3⤵
PID:2344

C:\Windows\system32\net.exe
net use
2⤵
PID:2224

C:\Windows\system32\net.exe
net group
2⤵
PID:2180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 group
3⤵
PID:644

C:\Windows\system32\net.exe
net localgroup
2⤵
PID:648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
3⤵
PID:2600

C:\Windows\system32\NETSTAT.EXE
netstat -r
2⤵
- Gathers network information
PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
3⤵
PID:940

C:\Windows\system32\ROUTE.EXE
C:\Windows\system32\route.exe print
4⤵
PID:1216

C:\Windows\system32\NETSTAT.EXE
netstat -nao
2⤵
- Gathers network information
PID:3792

C:\Windows\system32\schtasks.exe
schtasks /query
2⤵
PID:1016

C:\Windows\system32\ipconfig.exe
ipconfig /all
2⤵
- Gathers network information
PID:4088

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1784 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3120

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2608

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:656

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2180

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:648

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1196

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1504

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A9B9.exe
MD5
bc200d1d9549c0d552a3176a6b8306e5

SHA1
bcd2b7586194fa423f937dc067da7e574ec865c4

SHA256
a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b

SHA512
bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\A9B9.exe
MD5
bc200d1d9549c0d552a3176a6b8306e5

SHA1
bcd2b7586194fa423f937dc067da7e574ec865c4

SHA256
a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b

SHA512
bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\EA0F.exe
MD5
797969fff63bc27ff47c02212685e027

SHA1
8dbb347120bdfffbb4eec3929d323cc6ed42698d

SHA256
df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4

SHA512
de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297

Download Submit
C:\Users\Admin\AppData\Local\Temp\EA0F.exe
MD5
797969fff63bc27ff47c02212685e027

SHA1
8dbb347120bdfffbb4eec3929d323cc6ed42698d

SHA256
df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4

SHA512
de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297

Download Submit
C:\Users\Admin\AppData\Local\Temp\F76E.exe
MD5
f6994fd134037e0409d9070fe6f64dd5

SHA1
76caa1d0f0aa879dfdac2d8f90cc9456a354c173

SHA256
d91e510fa9a49aa3256d21e2e4053136178d297262e8a6767a237474f92ee404

SHA512
68413f31a8e888e9639177d1d8f6f8c42d6dff8bd21e746d56e692de6012fafab21608d65e3ad20cc617335bd3139aad11aac5ed9ed99cd3ef2d545128088ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\F76E.exe
MD5
f6994fd134037e0409d9070fe6f64dd5

SHA1
76caa1d0f0aa879dfdac2d8f90cc9456a354c173

SHA256
d91e510fa9a49aa3256d21e2e4053136178d297262e8a6767a237474f92ee404

SHA512
68413f31a8e888e9639177d1d8f6f8c42d6dff8bd21e746d56e692de6012fafab21608d65e3ad20cc617335bd3139aad11aac5ed9ed99cd3ef2d545128088ed6

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/588-168-0x0000000000000000-mapping.dmp

Download
memory/644-191-0x0000000000000000-mapping.dmp

Download
memory/648-271-0x0000000000000000-mapping.dmp

Download
memory/648-272-0x0000000002780000-0x0000000002785000-memory.dmp

Filesize
20KB

Download
memory/648-273-0x0000000002770000-0x0000000002779000-memory.dmp

Filesize
36KB

Download
memory/648-192-0x0000000000000000-mapping.dmp

Download
memory/656-264-0x0000000000000000-mapping.dmp

Download
memory/656-266-0x00000000027A0000-0x00000000027AB000-memory.dmp

Filesize
44KB

Download
memory/656-265-0x00000000027B0000-0x00000000027B7000-memory.dmp

Filesize
28KB

Download
memory/680-170-0x0000000000000000-mapping.dmp

Download
memory/900-166-0x0000000000000000-mapping.dmp

Download
memory/940-196-0x0000000000000000-mapping.dmp

Download
memory/1016-199-0x0000000000000000-mapping.dmp

Download
memory/1104-291-0x000002039A880000-0x000002039A881000-memory.dmp

Filesize
4KB

Download
memory/1104-289-0x000002039A880000-0x000002039A881000-memory.dmp

Filesize
4KB

Download
memory/1168-230-0x0000000000000000-mapping.dmp

Download
memory/1196-276-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/1196-274-0x0000000000000000-mapping.dmp

Download
memory/1196-275-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1216-197-0x0000000000000000-mapping.dmp

Download
memory/1236-158-0x0000000000000000-mapping.dmp

Download
memory/1336-169-0x0000000000000000-mapping.dmp

Download
memory/1408-152-0x0000000000000000-mapping.dmp

Download
memory/1504-280-0x0000000002790000-0x000000000279B000-memory.dmp

Filesize
44KB

Download
memory/1504-279-0x00000000027A0000-0x00000000027A6000-memory.dmp

Filesize
24KB

Download
memory/1504-278-0x0000000000000000-mapping.dmp

Download
memory/1632-155-0x0000000000000000-mapping.dmp

Download
memory/1712-281-0x0000000000000000-mapping.dmp

Download
memory/1712-283-0x00000000005D0000-0x00000000005DD000-memory.dmp

Filesize
52KB

Download
memory/1712-282-0x00000000005E0000-0x00000000005E7000-memory.dmp

Filesize
28KB

Download
memory/1784-218-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-222-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-237-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-206-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-207-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-290-0x00000154C6530000-0x00000154C6531000-memory.dmp

Filesize
4KB

Download
memory/1784-235-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-234-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-232-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-231-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-240-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-241-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-228-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-245-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-246-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-247-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-227-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-226-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-225-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-210-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-277-0x00000154C6500000-0x00000154C6501000-memory.dmp

Filesize
4KB

Download
memory/1784-270-0x00000154C44B0000-0x00000154C44B1000-memory.dmp

Filesize
4KB

Download
memory/1784-223-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-239-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-221-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-209-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-219-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-205-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-217-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-215-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-214-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-211-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-213-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1784-212-0x00007FFEF8F00000-0x00007FFEF8F6B000-memory.dmp

Filesize
428KB

Download
memory/1816-154-0x0000000000000000-mapping.dmp

Download
memory/1848-174-0x0000000000000000-mapping.dmp

Download
memory/1868-186-0x0000000000000000-mapping.dmp

Download
memory/1900-160-0x0000018EACA70000-0x0000018EACA72000-memory.dmp

Filesize
8KB

Download
memory/1900-159-0x0000018EACA70000-0x0000018EACA72000-memory.dmp

Filesize
8KB

Download
memory/2108-176-0x0000000000000000-mapping.dmp

Download
memory/2116-175-0x0000000000000000-mapping.dmp

Download
memory/2160-180-0x0000000000000000-mapping.dmp

Download
memory/2180-269-0x0000000000800000-0x000000000080E000-memory.dmp

Filesize
56KB

Download
memory/2180-268-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download
memory/2180-267-0x0000000000000000-mapping.dmp

Download
memory/2180-190-0x0000000000000000-mapping.dmp

Download
memory/2224-189-0x0000000000000000-mapping.dmp

Download
memory/2288-157-0x0000000000000000-mapping.dmp

Download
memory/2288-178-0x0000000000000000-mapping.dmp

Download
memory/2320-173-0x0000000000000000-mapping.dmp

Download
memory/2344-188-0x0000000000000000-mapping.dmp

Download
memory/2368-284-0x000001DE89EA0000-0x000001DE89EA1000-memory.dmp

Filesize
4KB

Download
memory/2424-285-0x000001802DF40000-0x000001802DF41000-memory.dmp

Filesize
4KB

Download
memory/2600-193-0x0000000000000000-mapping.dmp

Download
memory/2608-262-0x0000000000B30000-0x0000000000B37000-memory.dmp

Filesize
28KB

Download
memory/2608-263-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2608-261-0x0000000000000000-mapping.dmp

Download
memory/2632-118-0x0000000002C10000-0x0000000002C18000-memory.dmp

Filesize
32KB

Download
memory/2632-120-0x0000000000400000-0x0000000002B72000-memory.dmp

Filesize
39.4MB

Download
memory/2632-119-0x0000000002C30000-0x0000000002D7A000-memory.dmp

Filesize
1.3MB

Download
memory/2680-182-0x0000000000000000-mapping.dmp

Download
memory/2684-181-0x0000000000000000-mapping.dmp

Download
memory/2692-286-0x0000026B0F110000-0x0000026B0F111000-memory.dmp

Filesize
4KB

Download
memory/2736-167-0x0000000000000000-mapping.dmp

Download
memory/2752-148-0x0000000007304000-0x0000000007306000-memory.dmp

Filesize
8KB

Download
memory/2752-143-0x0000000007303000-0x0000000007304000-memory.dmp

Filesize
4KB

Download
memory/2752-172-0x0000000008DE0000-0x0000000008DE1000-memory.dmp

Filesize
4KB

Download
memory/2752-171-0x0000000008C10000-0x0000000008C11000-memory.dmp

Filesize
4KB

Download
memory/2752-132-0x0000000000000000-mapping.dmp

Download
memory/2752-145-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/2752-164-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/2752-163-0x00000000088E0000-0x00000000088E1000-memory.dmp

Filesize
4KB

Download
memory/2752-162-0x0000000008830000-0x0000000008831000-memory.dmp

Filesize
4KB

Download
memory/2752-161-0x0000000008190000-0x0000000008191000-memory.dmp

Filesize
4KB

Download
memory/2752-135-0x00000000049D0000-0x00000000049FE000-memory.dmp

Filesize
184KB

Download
memory/2752-136-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/2752-138-0x0000000002D20000-0x0000000002D59000-memory.dmp

Filesize
228KB

Download
memory/2752-146-0x0000000007E20000-0x0000000007E21000-memory.dmp

Filesize
4KB

Download
memory/2752-139-0x0000000000400000-0x0000000002B95000-memory.dmp

Filesize
39.6MB

Download
memory/2752-149-0x0000000007F30000-0x0000000007F31000-memory.dmp

Filesize
4KB

Download
memory/2752-137-0x0000000002CF0000-0x0000000002D1B000-memory.dmp

Filesize
172KB

Download
memory/2752-141-0x0000000004DC0000-0x0000000004DEC000-memory.dmp

Filesize
176KB

Download
memory/2752-142-0x0000000007302000-0x0000000007303000-memory.dmp

Filesize
4KB

Download
memory/2752-144-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/2752-140-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/2752-147-0x0000000007270000-0x0000000007271000-memory.dmp

Filesize
4KB

Download
memory/2880-187-0x0000000000000000-mapping.dmp

Download
memory/2880-165-0x0000000000000000-mapping.dmp

Download
memory/2932-185-0x0000000000000000-mapping.dmp

Download
memory/3012-177-0x0000000000000000-mapping.dmp

Download
memory/3040-151-0x0000000004810000-0x0000000004812000-memory.dmp

Filesize
8KB

Download
memory/3040-201-0x0000000004810000-0x0000000004812000-memory.dmp

Filesize
8KB

Download
memory/3040-121-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

Filesize
88KB

Download
memory/3040-128-0x0000000000EC0000-0x0000000000ED6000-memory.dmp

Filesize
88KB

Download
memory/3040-204-0x0000000004810000-0x0000000004812000-memory.dmp

Filesize
8KB

Download
memory/3040-203-0x0000000004810000-0x0000000004812000-memory.dmp

Filesize
8KB

Download
memory/3040-150-0x0000000004810000-0x0000000004812000-memory.dmp

Filesize
8KB

Download
memory/3040-153-0x0000000004720000-0x000000000472F000-memory.dmp

Filesize
60KB

Download
memory/3120-258-0x0000000000000000-mapping.dmp

Download
memory/3120-260-0x0000000002B10000-0x0000000002B7B000-memory.dmp

Filesize
428KB

Download
memory/3120-184-0x0000000000000000-mapping.dmp

Download
memory/3120-259-0x0000000002B80000-0x0000000002BF5000-memory.dmp

Filesize
468KB

Download
memory/3468-287-0x0000019EA67F0000-0x0000019EA67F1000-memory.dmp

Filesize
4KB

Download
memory/3548-195-0x0000000000000000-mapping.dmp

Download
memory/3588-179-0x0000000000000000-mapping.dmp

Download
memory/3640-129-0x0000000000000000-mapping.dmp

Download
memory/3640-288-0x000001AC54B60000-0x000001AC54B61000-memory.dmp

Filesize
4KB

Download
memory/3752-127-0x0000000000400000-0x0000000002B72000-memory.dmp

Filesize
39.4MB

Download
memory/3752-122-0x0000000000000000-mapping.dmp

Download
memory/3752-126-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/3752-125-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/3792-198-0x0000000000000000-mapping.dmp

Download
memory/3972-183-0x0000000000000000-mapping.dmp

Download
memory/4028-156-0x0000000000000000-mapping.dmp

Download
memory/4088-200-0x0000000000000000-mapping.dmp

Download