privateloader | 5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37

Analysis

max time kernel
24s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-09-2022 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Size

2.5MB
MD5

61a8ec81c089852fdcb14baaeb75bc63
SHA1

3a022b517a8e8030e0e2679abcb9655eb268a2f0
SHA256

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37
SHA512

7ac5abc614dd5c292d4a2285612bc1047ebc4a9d93fcfdce8d524b8eb654566000f9f9f48e19a3d07a5046544b3b498f0a6309dd4f58260f57c050bd5dbe98c7
SSDEEP

49152:eAzniM/t7sj31n7HEkJbjloay0/UXQE/7LgmlT+IjwAMcf6V9TQtWmezNj3:RziM/BsjFnbEqhMXQqRXdf0iUB7

Score

10^/10

privateloader raccoon redline ad82482251879b6e89002f532531462a evasion infostealer loader spyware stealer themida trojan vmprotect

Malware Config

Extracted

Family

privateloader

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Family

raccoon

Botnet

ad82482251879b6e89002f532531462a

http://89.185.85.53/

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-118-0x0000000002570000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/1664-120-0x0000000002630000-0x000000000265C000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

Y_8gtHBYvxNPzEt1HAkhhhuq.exeZwVDvL74agE7XPSmw0u2Oorh.exejm5fMo7k63Gn843yWnxvpkmq.exe

pid process

1848 Y_8gtHBYvxNPzEt1HAkhhhuq.exe
1672 ZwVDvL74agE7XPSmw0u2Oorh.exe
1708 jm5fMo7k63Gn843yWnxvpkmq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

pid	process
1848	Y_8gtHBYvxNPzEt1HAkhhhuq.exe
1672	ZwVDvL74agE7XPSmw0u2Oorh.exe
1708	jm5fMo7k63Gn843yWnxvpkmq.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe	vmprotect
C:\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe	vmprotect
behavioral1/memory/1672-98-0x0000000140000000-0x00000001406A2000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Loads dropped DLL 3 IoCs

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

pid	process
1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1324-55-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-56-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-57-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-58-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-59-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-60-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-62-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-63-0x0000000001160000-0x000000000197A000-memory.dmp	themida
behavioral1/memory/1324-64-0x0000000001160000-0x000000000197A000-memory.dmp	themida
\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe	themida
C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe	themida
C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe	themida
behavioral1/memory/1324-113-0x0000000001160000-0x000000000197A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ipinfo.io
2 ipinfo.io
100 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

pid process

1324 5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
1	ipinfo.io
2	ipinfo.io
100	ip-api.com

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

pid	process
1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe

description	pid	process	target process
PID 1324 wrote to memory of 1672	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	ZwVDvL74agE7XPSmw0u2Oorh.exe
PID 1324 wrote to memory of 1672	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	ZwVDvL74agE7XPSmw0u2Oorh.exe
PID 1324 wrote to memory of 1672	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	ZwVDvL74agE7XPSmw0u2Oorh.exe
PID 1324 wrote to memory of 1672	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	ZwVDvL74agE7XPSmw0u2Oorh.exe
PID 1324 wrote to memory of 1848	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	Y_8gtHBYvxNPzEt1HAkhhhuq.exe
PID 1324 wrote to memory of 1848	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	Y_8gtHBYvxNPzEt1HAkhhhuq.exe
PID 1324 wrote to memory of 1848	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	Y_8gtHBYvxNPzEt1HAkhhhuq.exe
PID 1324 wrote to memory of 1848	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	Y_8gtHBYvxNPzEt1HAkhhhuq.exe
PID 1324 wrote to memory of 1708	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	jm5fMo7k63Gn843yWnxvpkmq.exe
PID 1324 wrote to memory of 1708	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	jm5fMo7k63Gn843yWnxvpkmq.exe
PID 1324 wrote to memory of 1708	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	jm5fMo7k63Gn843yWnxvpkmq.exe
PID 1324 wrote to memory of 1708	1324	5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe	jm5fMo7k63Gn843yWnxvpkmq.exe

C:\Users\Admin\AppData\Local\Temp\5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe
"C:\Users\Admin\AppData\Local\Temp\5a3076aabd6921cb9c0b0fd24e1ef23e90abc1736ccb4d3abecd1af2aafd8e37.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\Pictures\Minor Policy\Y_8gtHBYvxNPzEt1HAkhhhuq.exe
"C:\Users\Admin\Pictures\Minor Policy\Y_8gtHBYvxNPzEt1HAkhhhuq.exe"
2⤵
- Executes dropped EXE
PID:1848

C:\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe
"C:\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe"
2⤵
- Executes dropped EXE
PID:1672

C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe
"C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe"
2⤵
- Executes dropped EXE
PID:1708

C:\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe
"C:\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe"
2⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\is-IHP3A.tmp\is-OMLB6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IHP3A.tmp\is-OMLB6.tmp" /SL4 $A011C "C:\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe" 2324125 52736
3⤵
PID:1668

C:\Users\Admin\Pictures\Minor Policy\Cag4bQvw9JGkDZ41pvxHPM25.exe
"C:\Users\Admin\Pictures\Minor Policy\Cag4bQvw9JGkDZ41pvxHPM25.exe"
2⤵
PID:1664

C:\Users\Admin\Pictures\Minor Policy\E0u96kWN8jSfkv_yAU_ZD8cs.exe
"C:\Users\Admin\Pictures\Minor Policy\E0u96kWN8jSfkv_yAU_ZD8cs.exe"
2⤵
PID:1836

C:\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe
"C:\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe"
2⤵
PID:1900

C:\Users\Admin\Pictures\Minor Policy\ApJu7KhgFtzzQv54ovdBJDaS.exe
"C:\Users\Admin\Pictures\Minor Policy\ApJu7KhgFtzzQv54ovdBJDaS.exe"
2⤵
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe
Filesize
6.6MB

MD5
83fd77104c17653424a3d3894dbe8793

SHA1
fbd8618f1d840c2506b33e85df7be7abf6753c19

SHA256
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172

SHA512
18c577e3fa7b48cd7a2954fa9c132a023d8c64809aa1887969ecb35cbb188efc87a0013d9b41a83d4bc701ffb496e6914331e48f84de39382848213f559566a9

Download Submit
C:\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe
Filesize
6.6MB

MD5
83fd77104c17653424a3d3894dbe8793

SHA1
fbd8618f1d840c2506b33e85df7be7abf6753c19

SHA256
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172

SHA512
18c577e3fa7b48cd7a2954fa9c132a023d8c64809aa1887969ecb35cbb188efc87a0013d9b41a83d4bc701ffb496e6914331e48f84de39382848213f559566a9

Download Submit
C:\Users\Admin\Pictures\Minor Policy\ApJu7KhgFtzzQv54ovdBJDaS.exe
Filesize
84KB

MD5
2ef8da551cf5ab2ab6e3514321791eab

SHA1
d618d2d2b8f272f75f1e89cb2023ea6a694b7773

SHA256
50691a77e2b8153d8061bd35d9280c0e69175196cdcf876203ccecf8bcfd7c19

SHA512
3073ed8a572a955ba120e2845819afe9e13d226879db7a0cd98752fd3e336a57baf17a97a38f94412eeb500fd0a0c8bac55fdbdfef2c7cbf970a7091cdfc0e00

Download Submit
C:\Users\Admin\Pictures\Minor Policy\Cag4bQvw9JGkDZ41pvxHPM25.exe
Filesize
5.0MB

MD5
469b0c97d2aa9a03581536d485bc8864

SHA1
b56dcae7a00ac7333c728bd00197da2e07ddfe36

SHA256
51a2d9691b6a426415cbd2a21e445a6e29204680a5ab63d8e51058bfa542e67c

SHA512
d0942bf318e025805e6bfbb513cffef2b62cb645d41e92aedb215b276d9857cb64cb2e430927e5063a8e0431115167d34d561315ecddfbcb514a007db5d98df2

Download Submit
C:\Users\Admin\Pictures\Minor Policy\Y_8gtHBYvxNPzEt1HAkhhhuq.exe
Filesize
400KB

MD5
9519c85c644869f182927d93e8e25a33

SHA1
eadc9026e041f7013056f80e068ecf95940ea060

SHA256
f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

SHA512
dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Download Submit
C:\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe
Filesize
3.8MB

MD5
77d8df4427c8b1a28c8d2591a9c92a70

SHA1
9a0e1ca712f93f4ab30b162f5c9b04d9c825f1f9

SHA256
00cbd7c3427b9d2e960bd1d3fb04d3897a7c53486b52e5c42f0c2c6678a63762

SHA512
8204c35c4b4aa6a15c4d32d8600d0792e21296af633fc0ab45141abdfd7bcf0fb9b96a972f7734e01ca0ee9002d0e730f6380c5593ed0ca5e534c7c48ed83b98

Download Submit
C:\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe
Filesize
2.5MB

MD5
d33f5c381c8a2dc544c313355ba4eb64

SHA1
a342afff06633cacdb904c28ec7b78a8bfd559fd

SHA256
e40f0c222b4e696c27be11d5250c3763f04e5c4e7f1525becd1ec11b333b4c5d

SHA512
77bd9d3a35129c392db6976279c32216e35e174a658fa03660b6a874391e3d048f640546eef2094fe5498d495726359581ba2c2a81775f66a23eeec397157417

Download Submit
C:\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe
Filesize
2.5MB

MD5
d33f5c381c8a2dc544c313355ba4eb64

SHA1
a342afff06633cacdb904c28ec7b78a8bfd559fd

SHA256
e40f0c222b4e696c27be11d5250c3763f04e5c4e7f1525becd1ec11b333b4c5d

SHA512
77bd9d3a35129c392db6976279c32216e35e174a658fa03660b6a874391e3d048f640546eef2094fe5498d495726359581ba2c2a81775f66a23eeec397157417

Download Submit
C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe
Filesize
3.1MB

MD5
106078bb0964b75800da2013419239d9

SHA1
44f3c39446cebb7349697703cc88bd0c014b6c7e

SHA256
7e0bd7043b674f37a6c086fcd8aa5ddb0ec4ba675e4860e30f88abe3cfe4b879

SHA512
e9172ecbddc2d11291d6da05a65d967984c72317d525451ad13dbd6931b5b1bf580237926a4f6cd40d265f5b559efaa961352e348ce22827b3e52552ca618b7e

Download Submit
C:\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe
Filesize
3.1MB

MD5
106078bb0964b75800da2013419239d9

SHA1
44f3c39446cebb7349697703cc88bd0c014b6c7e

SHA256
7e0bd7043b674f37a6c086fcd8aa5ddb0ec4ba675e4860e30f88abe3cfe4b879

SHA512
e9172ecbddc2d11291d6da05a65d967984c72317d525451ad13dbd6931b5b1bf580237926a4f6cd40d265f5b559efaa961352e348ce22827b3e52552ca618b7e

Download Submit
\Users\Admin\AppData\Local\Temp\is-IHP3A.tmp\is-OMLB6.tmp
Filesize
658KB

MD5
fec7bff4c36a4303ade51e3ed704e708

SHA1
487c0f4af67e56a661b9f1d99515ff080db968c3

SHA256
0414eeff52f63cb32e508fe22c54aedb399e7a6baaab94a81081073dbe78c75f

SHA512
1267a0b954f3315b067883ff6ae8d599166ccfe35f1c7770e29f5f66a13650d4e1ae7f04c0b48e3da0875fb6c7127892f4a6ecd6214f43f6beb5013f55fe94d0

Download Submit
\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe
Filesize
6.6MB

MD5
83fd77104c17653424a3d3894dbe8793

SHA1
fbd8618f1d840c2506b33e85df7be7abf6753c19

SHA256
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172

SHA512
18c577e3fa7b48cd7a2954fa9c132a023d8c64809aa1887969ecb35cbb188efc87a0013d9b41a83d4bc701ffb496e6914331e48f84de39382848213f559566a9

Download Submit
\Users\Admin\Pictures\Minor Policy\4crp00AkJKSsEBmJmuJ2pezJ.exe
Filesize
6.6MB

MD5
83fd77104c17653424a3d3894dbe8793

SHA1
fbd8618f1d840c2506b33e85df7be7abf6753c19

SHA256
4d70a2e9f63fea018db99bef6cecbf094255c52f6e2bd9d1d7458e637efb9172

SHA512
18c577e3fa7b48cd7a2954fa9c132a023d8c64809aa1887969ecb35cbb188efc87a0013d9b41a83d4bc701ffb496e6914331e48f84de39382848213f559566a9

Download Submit
\Users\Admin\Pictures\Minor Policy\ApJu7KhgFtzzQv54ovdBJDaS.exe
Filesize
84KB

MD5
2ef8da551cf5ab2ab6e3514321791eab

SHA1
d618d2d2b8f272f75f1e89cb2023ea6a694b7773

SHA256
50691a77e2b8153d8061bd35d9280c0e69175196cdcf876203ccecf8bcfd7c19

SHA512
3073ed8a572a955ba120e2845819afe9e13d226879db7a0cd98752fd3e336a57baf17a97a38f94412eeb500fd0a0c8bac55fdbdfef2c7cbf970a7091cdfc0e00

Download Submit
\Users\Admin\Pictures\Minor Policy\ApJu7KhgFtzzQv54ovdBJDaS.exe
Filesize
84KB

MD5
2ef8da551cf5ab2ab6e3514321791eab

SHA1
d618d2d2b8f272f75f1e89cb2023ea6a694b7773

SHA256
50691a77e2b8153d8061bd35d9280c0e69175196cdcf876203ccecf8bcfd7c19

SHA512
3073ed8a572a955ba120e2845819afe9e13d226879db7a0cd98752fd3e336a57baf17a97a38f94412eeb500fd0a0c8bac55fdbdfef2c7cbf970a7091cdfc0e00

Download Submit
\Users\Admin\Pictures\Minor Policy\Cag4bQvw9JGkDZ41pvxHPM25.exe
Filesize
5.0MB

MD5
469b0c97d2aa9a03581536d485bc8864

SHA1
b56dcae7a00ac7333c728bd00197da2e07ddfe36

SHA256
51a2d9691b6a426415cbd2a21e445a6e29204680a5ab63d8e51058bfa542e67c

SHA512
d0942bf318e025805e6bfbb513cffef2b62cb645d41e92aedb215b276d9857cb64cb2e430927e5063a8e0431115167d34d561315ecddfbcb514a007db5d98df2

Download Submit
\Users\Admin\Pictures\Minor Policy\E0u96kWN8jSfkv_yAU_ZD8cs.exe
Filesize
1.2MB

MD5
76000a1a15850fcaa06877e21f7eb348

SHA1
755f0dbecf5ef2868270d34ced20213a4d5137c4

SHA256
52558d772708fed5fea4982d2f5ed377d47d1e4f9bc6d04a10a75817887fdf01

SHA512
573742a804ad957d2a11cd15e3d9f908fa0278067bd983b84fd39ca6c2d43dc91ca4e1870b86fe0ab1eba0f7317b87855cf22e66462c73abf0e569e4b018a9cb

Download Submit
\Users\Admin\Pictures\Minor Policy\E0u96kWN8jSfkv_yAU_ZD8cs.exe
Filesize
1.2MB

MD5
76000a1a15850fcaa06877e21f7eb348

SHA1
755f0dbecf5ef2868270d34ced20213a4d5137c4

SHA256
52558d772708fed5fea4982d2f5ed377d47d1e4f9bc6d04a10a75817887fdf01

SHA512
573742a804ad957d2a11cd15e3d9f908fa0278067bd983b84fd39ca6c2d43dc91ca4e1870b86fe0ab1eba0f7317b87855cf22e66462c73abf0e569e4b018a9cb

Download Submit
\Users\Admin\Pictures\Minor Policy\Y_8gtHBYvxNPzEt1HAkhhhuq.exe
Filesize
400KB

MD5
9519c85c644869f182927d93e8e25a33

SHA1
eadc9026e041f7013056f80e068ecf95940ea060

SHA256
f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

SHA512
dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Download Submit
\Users\Admin\Pictures\Minor Policy\ZwVDvL74agE7XPSmw0u2Oorh.exe
Filesize
3.8MB

MD5
77d8df4427c8b1a28c8d2591a9c92a70

SHA1
9a0e1ca712f93f4ab30b162f5c9b04d9c825f1f9

SHA256
00cbd7c3427b9d2e960bd1d3fb04d3897a7c53486b52e5c42f0c2c6678a63762

SHA512
8204c35c4b4aa6a15c4d32d8600d0792e21296af633fc0ab45141abdfd7bcf0fb9b96a972f7734e01ca0ee9002d0e730f6380c5593ed0ca5e534c7c48ed83b98

Download Submit
\Users\Admin\Pictures\Minor Policy\bXE_RbX_WTkthqiDB7BWCqHA.exe
Filesize
2.5MB

MD5
d33f5c381c8a2dc544c313355ba4eb64

SHA1
a342afff06633cacdb904c28ec7b78a8bfd559fd

SHA256
e40f0c222b4e696c27be11d5250c3763f04e5c4e7f1525becd1ec11b333b4c5d

SHA512
77bd9d3a35129c392db6976279c32216e35e174a658fa03660b6a874391e3d048f640546eef2094fe5498d495726359581ba2c2a81775f66a23eeec397157417

Download Submit
\Users\Admin\Pictures\Minor Policy\jm5fMo7k63Gn843yWnxvpkmq.exe
Filesize
3.1MB

MD5
106078bb0964b75800da2013419239d9

SHA1
44f3c39446cebb7349697703cc88bd0c014b6c7e

SHA256
7e0bd7043b674f37a6c086fcd8aa5ddb0ec4ba675e4860e30f88abe3cfe4b879

SHA512
e9172ecbddc2d11291d6da05a65d967984c72317d525451ad13dbd6931b5b1bf580237926a4f6cd40d265f5b559efaa961352e348ce22827b3e52552ca618b7e

Download Submit
memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1324-58-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-113-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-66-0x0000000006F70000-0x0000000007A2A000-memory.dmp

Filesize
10.7MB

Download
memory/1324-76-0x0000000005FB0000-0x000000000673E000-memory.dmp

Filesize
7.6MB

Download
memory/1324-60-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-62-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-65-0x0000000002E80000-0x0000000002EAE000-memory.dmp

Filesize
184KB

Download
memory/1324-59-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-61-0x0000000077960000-0x0000000077AE0000-memory.dmp

Filesize
1.5MB

Download
memory/1324-77-0x0000000003C20000-0x0000000003C49000-memory.dmp

Filesize
164KB

Download
memory/1324-63-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-57-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-56-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-55-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-64-0x0000000001160000-0x000000000197A000-memory.dmp

Filesize
8.1MB

Download
memory/1324-121-0x0000000005FB0000-0x000000000673E000-memory.dmp

Filesize
7.6MB

Download
memory/1488-83-0x0000000000000000-mapping.dmp

Download
memory/1664-102-0x0000000000400000-0x0000000000902000-memory.dmp

Filesize
5.0MB

Download
memory/1664-90-0x0000000000000000-mapping.dmp

Download
memory/1664-120-0x0000000002630000-0x000000000265C000-memory.dmp

Filesize
176KB

Download
memory/1664-127-0x0000000000400000-0x0000000000902000-memory.dmp

Filesize
5.0MB

Download
memory/1664-118-0x0000000002570000-0x000000000259E000-memory.dmp

Filesize
184KB

Download
memory/1668-124-0x0000000000000000-mapping.dmp

Download
memory/1672-98-0x0000000140000000-0x00000001406A2000-memory.dmp

Filesize
6.6MB

Download
memory/1672-69-0x0000000000000000-mapping.dmp

Download
memory/1708-74-0x0000000000000000-mapping.dmp

Download
memory/1708-100-0x00000000011F0000-0x000000000197E000-memory.dmp

Filesize
7.6MB

Download
memory/1708-122-0x00000000011F0000-0x000000000197E000-memory.dmp

Filesize
7.6MB

Download
memory/1728-128-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1728-89-0x0000000000000000-mapping.dmp

Download
memory/1728-109-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1836-93-0x0000000000000000-mapping.dmp

Download
memory/1848-70-0x0000000000000000-mapping.dmp

Download
memory/1900-85-0x0000000000000000-mapping.dmp

Download
memory/1900-126-0x0000000000400000-0x0000000000E21000-memory.dmp

Filesize
10.1MB

Download
memory/1900-116-0x0000000000400000-0x0000000000E21000-memory.dmp

Filesize
10.1MB

Download
memory/1900-103-0x0000000000400000-0x0000000000E21000-memory.dmp

Filesize
10.1MB

Download