djvu | 14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10-20220414-en
submitted
09-05-2022 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
Size

264KB
MD5

c4485dbfaf58d851abab30804f4261be
SHA1

24a567589697dd005668042296ba4440c894b8f1
SHA256

14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616
SHA512

9fb073ac44fbd8b27f0eb8640bec3ac4923276251a34f0b70d0a099752d20a9f9123df602e6bbeb36902d9db6db8731da5a5512d9efee6198f85685938a4ab39

Score

10^/10

djvu redline smokeloader vidar 1333 2 backdoor collection discovery evasion infostealer persistence ransomware spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://hanfinvest.at/upload/

http://phunilbeauty.com/upload/

http://spbdg.ru/upload/

http://tnt-az.com/upload/

http://casagenaro.com/upload/

http://girneotel.com/upload/

http://zennclinic.com/upload/

http://mordo.ru/forum/

http://piratia-life.ru/upload/

http://pkodev.net/upload/

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

rc4.i32

Extracted

Family

djvu

http://ugll.org/lancer/get.php

Attributes

extension
.egfg
offline_id
QcVY9rkapJoL3nQkZAsvfTFVYLmscrM1v1QxGWt1
payload_url
http://zerit.top/dl/build2.exe
http://ugll.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-6Ti2DxXR3I Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@time2mail.ch Reserve e-mail address to contact us: supportsys@airmail.cc Your personal ID: 0474JIjdm

rsa_pubkey.plain

Extracted

Family

vidar

Version

Botnet

1333

https://t.me/hollandracing

https://busshi.moe/@ronxik321

Attributes

profile_id
1333

Extracted

Family

redline

Botnet

91.241.19.193:11630

Attributes

auth_value
8f1381a27a56c64f6bc5ea1d4744ee1a

Signatures

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1844-163-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1844-171-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1844-175-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/516-168-0x00000000022A0000-0x00000000023BB000-memory.dmp	family_djvu
behavioral1/memory/1844-166-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1844-164-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2148-197-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2148-199-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2148-200-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2148-227-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1316-184-0x00000000022A0000-0x00000000022D6000-memory.dmp	family_redline
behavioral1/memory/1316-186-0x0000000004A40000-0x0000000004A74000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata: ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1452-176-0x0000000000400000-0x00000000004FB000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

C0EE.exeF260.exe9269.exe9912.exe9269.exe9EC0.exe9269.exe9269.exe

pid process

2252 C0EE.exe
2444 F260.exe
516 9269.exe
1452 9912.exe
1844 9269.exe
1316 9EC0.exe
2060 9269.exe
2148 9269.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Deletes itself 1 IoCs

Processes:

pid process

3168
Loads dropped DLL 2 IoCs

Processes:

9912.exe

pid process

1452 9912.exe
1452 9912.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

652 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2252	C0EE.exe
2444	F260.exe
516	9269.exe
1452	9912.exe
1844	9269.exe
1316	9EC0.exe
2060	9269.exe
2148	9269.exe

pid	process
3168

pid	process
1452	9912.exe
1452	9912.exe

pid	process
652	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9269.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\63123cec-9c15-4644-8071-430b997d2002\\9269.exe\" --AutoStart"	9269.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

100 api.2ip.ua
102 api.2ip.ua
115 api.2ip.ua
Suspicious use of SetThreadContext 2 IoCs

Processes:

9269.exe9269.exe

description pid process target process

PID 516 set thread context of 1844 516 9269.exe 9269.exe
PID 2060 set thread context of 2148 2060 9269.exe 9269.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
100	api.2ip.ua
102	api.2ip.ua
115	api.2ip.ua

description	pid	process	target process
PID 516 set thread context of 1844	516	9269.exe	9269.exe
PID 2060 set thread context of 2148	2060	9269.exe	9269.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exeC0EE.exeF260.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C0EE.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C0EE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F260.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F260.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C0EE.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4072 tasklist.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

760 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1056 systeminfo.exe

pid	process
4072	tasklist.exe

pid	process
760	ipconfig.exe

pid	process
1056	systeminfo.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

9269.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	9269.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	9269.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe

pid	process
4780	14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
4780	14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168
3168

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3168
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exeC0EE.exeF260.exe

pid process

4780 14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
2252 C0EE.exe
2444 F260.exe
3168
3168
3168
3168

pid	process
3168

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3460	WMIC.exe
Token: SeSecurityPrivilege	3460	WMIC.exe
Token: SeTakeOwnershipPrivilege	3460	WMIC.exe
Token: SeLoadDriverPrivilege	3460	WMIC.exe
Token: SeSystemProfilePrivilege	3460	WMIC.exe
Token: SeSystemtimePrivilege	3460	WMIC.exe
Token: SeProfSingleProcessPrivilege	3460	WMIC.exe
Token: SeIncBasePriorityPrivilege	3460	WMIC.exe
Token: SeCreatePagefilePrivilege	3460	WMIC.exe
Token: SeBackupPrivilege	3460	WMIC.exe
Token: SeRestorePrivilege	3460	WMIC.exe
Token: SeShutdownPrivilege	3460	WMIC.exe
Token: SeDebugPrivilege	3460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3460	WMIC.exe
Token: SeRemoteShutdownPrivilege	3460	WMIC.exe
Token: SeUndockPrivilege	3460	WMIC.exe
Token: SeManageVolumePrivilege	3460	WMIC.exe
Token: 33	3460	WMIC.exe
Token: 34	3460	WMIC.exe
Token: 35	3460	WMIC.exe
Token: 36	3460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3460	WMIC.exe
Token: SeSecurityPrivilege	3460	WMIC.exe
Token: SeTakeOwnershipPrivilege	3460	WMIC.exe
Token: SeLoadDriverPrivilege	3460	WMIC.exe
Token: SeSystemProfilePrivilege	3460	WMIC.exe
Token: SeSystemtimePrivilege	3460	WMIC.exe
Token: SeProfSingleProcessPrivilege	3460	WMIC.exe
Token: SeIncBasePriorityPrivilege	3460	WMIC.exe
Token: SeCreatePagefilePrivilege	3460	WMIC.exe
Token: SeBackupPrivilege	3460	WMIC.exe
Token: SeRestorePrivilege	3460	WMIC.exe
Token: SeShutdownPrivilege	3460	WMIC.exe
Token: SeDebugPrivilege	3460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3460	WMIC.exe
Token: SeRemoteShutdownPrivilege	3460	WMIC.exe
Token: SeUndockPrivilege	3460	WMIC.exe
Token: SeManageVolumePrivilege	3460	WMIC.exe
Token: 33	3460	WMIC.exe
Token: 34	3460	WMIC.exe
Token: 35	3460	WMIC.exe
Token: 36	3460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: 36	1464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe9269.exe

description	pid	process	target process
PID 3168 wrote to memory of 2252	3168		C0EE.exe
PID 3168 wrote to memory of 2252	3168		C0EE.exe
PID 3168 wrote to memory of 2252	3168		C0EE.exe
PID 3168 wrote to memory of 2444	3168		F260.exe
PID 3168 wrote to memory of 2444	3168		F260.exe
PID 3168 wrote to memory of 2444	3168		F260.exe
PID 3168 wrote to memory of 4160	3168		cmd.exe
PID 3168 wrote to memory of 4160	3168		cmd.exe
PID 4160 wrote to memory of 3460	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3460	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 1464	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 1464	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 1256	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 1256	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3028	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3028	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4252	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4252	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3644	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3644	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3328	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3328	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 5112	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 5112	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4652	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4652	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3212	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3212	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3204	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3204	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3248	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 3248	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4428	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4428	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4468	4160	cmd.exe	WMIC.exe
PID 4160 wrote to memory of 4468	4160	cmd.exe	WMIC.exe
PID 3168 wrote to memory of 516	3168		9269.exe
PID 3168 wrote to memory of 516	3168		9269.exe
PID 3168 wrote to memory of 516	3168		9269.exe
PID 4160 wrote to memory of 760	4160	cmd.exe	ipconfig.exe
PID 4160 wrote to memory of 760	4160	cmd.exe	ipconfig.exe
PID 4160 wrote to memory of 576	4160	cmd.exe	ROUTE.EXE
PID 4160 wrote to memory of 576	4160	cmd.exe	ROUTE.EXE
PID 4160 wrote to memory of 440	4160	cmd.exe	netsh.exe
PID 4160 wrote to memory of 440	4160	cmd.exe	netsh.exe
PID 3168 wrote to memory of 1452	3168		9912.exe
PID 3168 wrote to memory of 1452	3168		9912.exe
PID 3168 wrote to memory of 1452	3168		9912.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 516 wrote to memory of 1844	516	9269.exe	9269.exe
PID 3168 wrote to memory of 1316	3168		9EC0.exe
PID 3168 wrote to memory of 1316	3168		9EC0.exe
PID 3168 wrote to memory of 1316	3168		9EC0.exe
PID 4160 wrote to memory of 1056	4160	cmd.exe	systeminfo.exe
PID 4160 wrote to memory of 1056	4160	cmd.exe	systeminfo.exe
PID 3168 wrote to memory of 212	3168		explorer.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe
"C:\Users\Admin\AppData\Local\Temp\14d6e59172505169a844960eb1530b20018c3f16f7f9f336527762b69c652616.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4780

C:\Users\Admin\AppData\Local\Temp\C0EE.exe
C:\Users\Admin\AppData\Local\Temp\C0EE.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2252

C:\Users\Admin\AppData\Local\Temp\F260.exe
C:\Users\Admin\AppData\Local\Temp\F260.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2444

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
2⤵
PID:1256

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
2⤵
PID:3028

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
2⤵
PID:4252

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
2⤵
PID:3644

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
2⤵
PID:3328

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
2⤵
PID:5112

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
2⤵
PID:4652

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
2⤵
PID:3212

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
2⤵
PID:3204

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
2⤵
PID:3248

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
2⤵
PID:4428

C:\Windows\System32\Wbem\WMIC.exe
wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
2⤵
PID:4468

C:\Windows\system32\ipconfig.exe
ipconfig /displaydns
2⤵
- Gathers network information
PID:760

C:\Windows\system32\ROUTE.EXE
route print
2⤵
PID:576

C:\Windows\system32\netsh.exe
netsh firewall show state
2⤵
PID:440

C:\Windows\system32\systeminfo.exe
systeminfo
2⤵
- Gathers system information
PID:1056

C:\Windows\system32\tasklist.exe
tasklist /v
2⤵
- Enumerates processes with tasklist
PID:4072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4908

C:\Users\Admin\AppData\Local\Temp\9269.exe
C:\Users\Admin\AppData\Local\Temp\9269.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516

C:\Users\Admin\AppData\Local\Temp\9269.exe
C:\Users\Admin\AppData\Local\Temp\9269.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
PID:1844

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\63123cec-9c15-4644-8071-430b997d2002" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:652

C:\Users\Admin\AppData\Local\Temp\9269.exe
"C:\Users\Admin\AppData\Local\Temp\9269.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2060

C:\Users\Admin\AppData\Local\Temp\9269.exe
"C:\Users\Admin\AppData\Local\Temp\9269.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
PID:2148

C:\Users\Admin\AppData\Local\Temp\9912.exe
C:\Users\Admin\AppData\Local\Temp\9912.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452

C:\Users\Admin\AppData\Local\Temp\9EC0.exe
C:\Users\Admin\AppData\Local\Temp\9EC0.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:212

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
727B

MD5
e25910c9dde509fb4760477c89c6a4e7

SHA1
4b9d17d6b3629d88bc92663e2a706fa67b32490b

SHA256
05d4cc0a64e2fc232b3b4266c47d4925a30f8ba1d90f028646e3689a03a2f5ad

SHA512
a1ad80c2fe9798f3e90327f1775624d0ed3d07c10021ac627521d3eed9bb87b09797bf0fd7be4e302ec26efb7e5fc590c4a8c50cd9ed411796ee101fe156ce09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
471B

MD5
d5710c53f1f6105506249979b718c4a4

SHA1
c65a130aaec812b70a391ec99a749e4924977ff5

SHA256
2df6a7244a4daa65c6af33cb0eed7119dc6f6c3f7074ca39b6136da058e5645f

SHA512
c578d84534c0dfd73a844a9d88e0051f3c59bceda41b2806ce10d3cdda126e78cc26d4cb16de570294c17b187669cee9967916f17dd137ca40bc59bc36704603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
402B

MD5
6c319eb91c403a28e388165fae4716b6

SHA1
48524b9d45f667115eefda1bd64d9a68f7db38c4

SHA256
e5a3debec29663fe0ab59956161ff1daf5e01485d51fa827b77e8c254814f7ee

SHA512
ab0a88b24a3d025fc620700f0b89cea60c3f981126259f071ae2a5702bbcd286bd2b44edb946005f0a820e5206f72ee5f88e703f0847044731a2431fda4ecae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
396B

MD5
1ed01d7fd1603ed1d1441065aa7ecefa

SHA1
a040bc9fb9ac2bcbb5d33b19d810ef65e908386c

SHA256
ab1f2e82f625553b4458085ae05f6f2316811e0ba0b1d274c5b3459a7eadc30f

SHA512
ea67d95efceda037f361fffcd52b8d9b10a637f52bd00edc0528664720e7fcd8a802b0124b6e4fad935d54fb10bb5fc84f1d13f509886cefd0f9288afe818727

Download Submit
C:\Users\Admin\AppData\Local\63123cec-9c15-4644-8071-430b997d2002\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9269.exe
Filesize
793KB

MD5
63af65fe36babc095e343bf05cff70cc

SHA1
97c72008b97c8d043336b76c55dd62b5b16393a8

SHA256
a0cc5a24c9107b52177d612d342172612662287ad8ced1243966cf9ef5a687a3

SHA512
07f65fa77ca068d86435b039a29c3af8f3c61f83d89db1047bb80f4beb6c5755c666e8a1056b23de1cc3557bcc272cabd7e1fb7e6ded17b5dd584c94f51d5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9912.exe
Filesize
411KB

MD5
4d4aacaaac0146811970c85ce456cc2a

SHA1
bb25d5c6d7a9cc289c5195e13b2a0575289e6134

SHA256
771e19ccac62a39284a2e7e6929b5b3d770c151f0e1e79b54a987e41a02595e9

SHA512
4a0483cb4622240c6d9ad321e3e653f8bb0bc983feb20237473a63865eb5b284710081a06e563af5be69416b0e019c5da22a3bd6fd0dc91f6c009f01032ddef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\9912.exe
Filesize
411KB

MD5
4d4aacaaac0146811970c85ce456cc2a

SHA1
bb25d5c6d7a9cc289c5195e13b2a0575289e6134

SHA256
771e19ccac62a39284a2e7e6929b5b3d770c151f0e1e79b54a987e41a02595e9

SHA512
4a0483cb4622240c6d9ad321e3e653f8bb0bc983feb20237473a63865eb5b284710081a06e563af5be69416b0e019c5da22a3bd6fd0dc91f6c009f01032ddef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EC0.exe
Filesize
407KB

MD5
5ef73af10fb910fc299f3cf06afcb80f

SHA1
16023f3aeb0cb8ae109e4b7426d794a4e528ab53

SHA256
cd0b029bada1e06fb3853c385b45659a318147795643ac8f515735e8fe8993d5

SHA512
df00f89114a22da949f904d89b5037993697dae52d07f21de239f90e5ed34b20995206c0d349932148a8c9fed0d4f70f4629a35be5355a18cb8833efb4199a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EC0.exe
Filesize
407KB

MD5
5ef73af10fb910fc299f3cf06afcb80f

SHA1
16023f3aeb0cb8ae109e4b7426d794a4e528ab53

SHA256
cd0b029bada1e06fb3853c385b45659a318147795643ac8f515735e8fe8993d5

SHA512
df00f89114a22da949f904d89b5037993697dae52d07f21de239f90e5ed34b20995206c0d349932148a8c9fed0d4f70f4629a35be5355a18cb8833efb4199a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\C0EE.exe
Filesize
264KB

MD5
408bcad8555cd231402bd03f05335756

SHA1
1d55165b3fc1ce2f7170181c84ad11a0171b14e5

SHA256
24fd68b434954045202431d7fe8f629d16a9ab1d3a25b6f073e953da2d1a56ae

SHA512
c77ef7473f2d8ebbd3b2925fd45265cf5c12eb348a4a707e0a38496adfebad67bf5b542c72c31306be7dcc8dee619e9e0798818ac76549eed74838c8ab39986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C0EE.exe
Filesize
264KB

MD5
408bcad8555cd231402bd03f05335756

SHA1
1d55165b3fc1ce2f7170181c84ad11a0171b14e5

SHA256
24fd68b434954045202431d7fe8f629d16a9ab1d3a25b6f073e953da2d1a56ae

SHA512
c77ef7473f2d8ebbd3b2925fd45265cf5c12eb348a4a707e0a38496adfebad67bf5b542c72c31306be7dcc8dee619e9e0798818ac76549eed74838c8ab39986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F260.exe
Filesize
264KB

MD5
36ec7c61b27c373a0eab3e100e136711

SHA1
62e67a4a18d5ec406365ffb03cb0b9055e3b7d5b

SHA256
54a17f7dea0bb544a82f8a0efb75ef8e4f93a027f08cb9da4a2bd07dd0cb33ac

SHA512
f256fb70d77d05ae51b743ab432f7b65e11aa866b36d0ea33992863b6cbe119989792699a3b36720d319585ceec4abcf7fbd5c6de692df82b27cbcbfa434b277

Download Submit
C:\Users\Admin\AppData\Local\Temp\F260.exe
Filesize
264KB

MD5
36ec7c61b27c373a0eab3e100e136711

SHA1
62e67a4a18d5ec406365ffb03cb0b9055e3b7d5b

SHA256
54a17f7dea0bb544a82f8a0efb75ef8e4f93a027f08cb9da4a2bd07dd0cb33ac

SHA512
f256fb70d77d05ae51b743ab432f7b65e11aa866b36d0ea33992863b6cbe119989792699a3b36720d319585ceec4abcf7fbd5c6de692df82b27cbcbfa434b277

Download Submit
\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/212-177-0x0000000000000000-mapping.dmp

Download
memory/440-158-0x0000000000000000-mapping.dmp

Download
memory/516-153-0x0000000000000000-mapping.dmp

Download
memory/516-168-0x00000000022A0000-0x00000000023BB000-memory.dmp

Filesize
1.1MB

Download
memory/576-157-0x0000000000000000-mapping.dmp

Download
memory/652-179-0x0000000000000000-mapping.dmp

Download
memory/760-156-0x0000000000000000-mapping.dmp

Download
memory/1056-170-0x0000000000000000-mapping.dmp

Download
memory/1256-139-0x0000000000000000-mapping.dmp

Download
memory/1316-185-0x0000000004B50000-0x000000000504E000-memory.dmp

Filesize
5.0MB

Download
memory/1316-190-0x0000000005050000-0x0000000005656000-memory.dmp

Filesize
6.0MB

Download
memory/1316-184-0x00000000022A0000-0x00000000022D6000-memory.dmp

Filesize
216KB

Download
memory/1316-186-0x0000000004A40000-0x0000000004A74000-memory.dmp

Filesize
208KB

Download
memory/1316-187-0x00000000005D0000-0x000000000071A000-memory.dmp

Filesize
1.3MB

Download
memory/1316-188-0x00000000008C0000-0x00000000008FA000-memory.dmp

Filesize
232KB

Download
memory/1316-167-0x0000000000000000-mapping.dmp

Download
memory/1316-189-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1316-191-0x00000000056D0000-0x00000000056E2000-memory.dmp

Filesize
72KB

Download
memory/1316-192-0x0000000005700000-0x000000000580A000-memory.dmp

Filesize
1.0MB

Download
memory/1316-193-0x0000000005830000-0x000000000586E000-memory.dmp

Filesize
248KB

Download
memory/1316-194-0x0000000005890000-0x00000000058DB000-memory.dmp

Filesize
300KB

Download
memory/1452-174-0x0000000000620000-0x000000000076A000-memory.dmp

Filesize
1.3MB

Download
memory/1452-206-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/1452-159-0x0000000000000000-mapping.dmp

Download
memory/1452-169-0x0000000000809000-0x0000000000836000-memory.dmp

Filesize
180KB

Download
memory/1452-176-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1464-138-0x0000000000000000-mapping.dmp

Download
memory/1844-164-0x0000000000424141-mapping.dmp

Download
memory/1844-163-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1844-175-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1844-171-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1844-166-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2060-181-0x0000000000000000-mapping.dmp

Download
memory/2148-199-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2148-200-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2148-227-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2148-197-0x0000000000424141-mapping.dmp

Download
memory/2252-123-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/2252-119-0x0000000000000000-mapping.dmp

Download
memory/2252-122-0x0000000000623000-0x0000000000634000-memory.dmp

Filesize
68KB

Download
memory/2252-124-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2444-129-0x0000000000793000-0x00000000007A4000-memory.dmp

Filesize
68KB

Download
memory/2444-130-0x0000000000490000-0x00000000005DA000-memory.dmp

Filesize
1.3MB

Download
memory/2444-131-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2444-126-0x0000000000000000-mapping.dmp

Download
memory/3028-140-0x0000000000000000-mapping.dmp

Download
memory/3168-118-0x0000000001100000-0x0000000001116000-memory.dmp

Filesize
88KB

Download
memory/3168-132-0x0000000006620000-0x0000000006636000-memory.dmp

Filesize
88KB

Download
memory/3168-135-0x0000000006820000-0x000000000682F000-memory.dmp

Filesize
60KB

Download
memory/3168-125-0x0000000003180000-0x0000000003196000-memory.dmp

Filesize
88KB

Download
memory/3204-149-0x0000000000000000-mapping.dmp

Download
memory/3212-148-0x0000000000000000-mapping.dmp

Download
memory/3248-150-0x0000000000000000-mapping.dmp

Download
memory/3328-145-0x0000000000000000-mapping.dmp

Download
memory/3460-137-0x0000000000000000-mapping.dmp

Download
memory/3644-144-0x0000000000000000-mapping.dmp

Download
memory/4072-205-0x0000000000000000-mapping.dmp

Download
memory/4160-136-0x0000000000000000-mapping.dmp

Download
memory/4252-141-0x0000000000000000-mapping.dmp

Download
memory/4428-151-0x0000000000000000-mapping.dmp

Download
memory/4468-152-0x0000000000000000-mapping.dmp

Download
memory/4652-147-0x0000000000000000-mapping.dmp

Download
memory/4780-117-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4780-116-0x00000000004E0000-0x000000000058E000-memory.dmp

Filesize
696KB

Download
memory/4780-115-0x00000000004E0000-0x000000000062A000-memory.dmp

Filesize
1.3MB

Download
memory/4996-183-0x0000000000000000-mapping.dmp

Download
memory/5112-146-0x0000000000000000-mapping.dmp

Download