globeimposter | 7fa0fc4b901ff3bb9002f33b4a7f0a01aef10f36c8304d26cdbf0934a9fd816f

Analysis

max time kernel
105s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2022 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
Size

30KB
MD5

0d7eb2137c2d696071df27cc6a601a5a
SHA1

f3e487886630e0729fb4b4967cd11c2ee0daa989
SHA256

7fa0fc4b901ff3bb9002f33b4a7f0a01aef10f36c8304d26cdbf0934a9fd816f
SHA512

1b6f45cd581d3cd8292d8b97b840473eddb5239ce07037a8d34cf1530dc6c35613591e1d06f56453b50060d0df8d6066cc675a8cde3018220547597515e8f662
SSDEEP

768:8t6+ztmVfbHmHS8/ckpKd75wiqjUKPO6AAb3vM8pYwA:2ztmJbHmHT/zKdVwigUAAK3qw

Score

10^/10

globeimposter redline smokeloader 0025 backdoor infostealer persistence ransomware trojan

Malware Config

Extracted

Path

\??\M:\readme.txt

Family

globeimposter

Ransom Note

All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ Your ID ��7A A4 40 05 90 8B AD CC BD 8C 07 0A 7D 8B C0 3D 22 77 10 93 F1 5A 97 7B DB 23 33 F5 A0 81 BE FD 13 6E F4 88 E4 70 F7 55 ED 85 A5 8E 32 21 1B 99 B1 51 EF C5 F4 EE 10 35 3C DA B2 7A AE 7E 26 95 CC D2 95 07 93 FD 5F C1 DB C2 2C 9D B7 DE 24 46 FA 61 76 CB EB AB 47 5F C3 9A 18 50 8C E9 94 EB 7A D9 47 B4 64 B7 98 C1 FE 7A 35 3B 27 FA 11 4E 8E 0C 45 3D A9 F5 A5 51 ED A2 88 24 DD BE 80 59 08 B0 99 93 BF 34 50 FE 60 7C 6D 13 AF F1 6F 46 E5 82 5A 01 01 CB 01 5D 28 65 22 A2 12 64 44 09 2E 8C E4 3F 69 03 CE A7 4C E9 03 7C 30 06 C4 B3 B9 6D 24 2E 0E 53 80 1C 70 E3 95 B9 A9 9E 16 A8 11 53 79 CE FC 5E 84 A8 D7 91 0A F1 B6 9A A6 AD CA 33 30 BA A0 A8 84 72 92 44 AA 35 18 2D 4A 76 60 54 ED 68 3E 64 7A 7B 1C 12 ED 3D 19 D9 76 D0 B7 41 03 AB 31 9C 77 CC 76 46 3C 52 C0 6B DD 5C

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV

Extracted

Path

\??\M:\Boot\bg-BG\ReadMe.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?403FWYPRSKL 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?403FWYPRSKL

https://yip.su/2QstD5

Extracted

Family

redline

Botnet

0025

216.52.57.15:38185

Attributes

auth_value
e3493445b68f497cdc542eee79f1a761

Signatures

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1128-132-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral2/memory/1128-133-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0005000000022dc1-183.dat	family_redline
behavioral2/files/0x0005000000022dc1-184.dat	family_redline
behavioral2/memory/2204-185-0x0000000000E20000-0x0000000000E40000-memory.dmp	family_redline
behavioral2/memory/216-190-0x0000000000EB0000-0x0000000000F24000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

Processes:

EB2B.exeF0D9.exeF510.exe

pid	Process
392	EB2B.exe
2264	F0D9.exe
2204	F510.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

F0D9.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	F0D9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\F0D9.exe"	F0D9.exe

Drops desktop.ini file(s) 18 IoCs

Processes:

F0D9.exeEB2B.exe

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	F0D9.exe
File opened for modification	C:\Program Files\desktop.ini	EB2B.exe
File opened for modification	C:\Users\Public\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	F0D9.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	F0D9.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

EB2B.exe

description	ioc	Process
File opened (read-only)	\??\S:	EB2B.exe
File opened (read-only)	\??\H:	EB2B.exe
File opened (read-only)	\??\Q:	EB2B.exe
File opened (read-only)	\??\T:	EB2B.exe
File opened (read-only)	\??\Y:	EB2B.exe
File opened (read-only)	\??\U:	EB2B.exe
File opened (read-only)	\??\O:	EB2B.exe
File opened (read-only)	\??\A:	EB2B.exe
File opened (read-only)	\??\X:	EB2B.exe
File opened (read-only)	\??\R:	EB2B.exe
File opened (read-only)	\??\G:	EB2B.exe
File opened (read-only)	\??\K:	EB2B.exe
File opened (read-only)	\??\Z:	EB2B.exe
File opened (read-only)	\??\B:	EB2B.exe
File opened (read-only)	\??\M:
File opened (read-only)	\??\W:	EB2B.exe
File opened (read-only)	\??\E:	EB2B.exe
File opened (read-only)	\??\I:	EB2B.exe
File opened (read-only)	\??\P:	EB2B.exe
File opened (read-only)	\??\F:	EB2B.exe
File opened (read-only)	\??\N:	EB2B.exe
File opened (read-only)	\??\J:	EB2B.exe
File opened (read-only)	\??\L:	EB2B.exe
File opened (read-only)	\??\V:	EB2B.exe
File opened (read-only)	\??\M:	EB2B.exe

Drops file in Program Files directory 64 IoCs

Processes:

EB2B.exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\jawt.h	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui	EB2B.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\CloseMerge.wps	EB2B.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\ReadMe.txt	EB2B.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	EB2B.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bn.pak	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	EB2B.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll	EB2B.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\ReadMe.txt	EB2B.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\images\ReadMe.txt	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jfxmedia.dll	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock	EB2B.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\ReadMe.txt	EB2B.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\ReadMe.txt	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\concrt140.dll	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\attach.dll	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_es.properties	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms	EB2B.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\ReadMe.txt	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms	EB2B.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ReadMe.txt	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf	EB2B.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\management\management.properties	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms	EB2B.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui	EB2B.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar	EB2B.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\net.properties	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml	EB2B.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms	EB2B.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2812	216	WerFault.exe	83

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe

pid	Process
1128	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
1128	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056
2056

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
2056

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe

pid	Process
1128	7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
2056
2056
2056
2056

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

description	pid	Process
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056
Token: SeShutdownPrivilege	2056
Token: SeCreatePagefilePrivilege	2056

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid	Process
2056
2056

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pid	Process
2056

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

description	pid	procid_target
PID 2056 wrote to memory of 392	2056	78
PID 2056 wrote to memory of 392	2056	78
PID 2056 wrote to memory of 392	2056	78
PID 2056 wrote to memory of 2264	2056	81
PID 2056 wrote to memory of 2264	2056	81
PID 2056 wrote to memory of 2264	2056	81
PID 2056 wrote to memory of 2204	2056	82
PID 2056 wrote to memory of 2204	2056	82
PID 2056 wrote to memory of 2204	2056	82
PID 2056 wrote to memory of 216	2056	83
PID 2056 wrote to memory of 216	2056	83
PID 2056 wrote to memory of 216	2056	83
PID 2056 wrote to memory of 216	2056	83
PID 2056 wrote to memory of 3848	2056	84
PID 2056 wrote to memory of 3848	2056	84
PID 2056 wrote to memory of 3848	2056	84

C:\Users\Admin\AppData\Local\Temp\7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe
"C:\Users\Admin\AppData\Local\Temp\7FA0FC4B901FF3BB9002F33B4A7F0A01AEF10F36C8304.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1128

C:\Users\Admin\AppData\Local\Temp\EB2B.exe
C:\Users\Admin\AppData\Local\Temp\EB2B.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:392

C:\Users\Admin\AppData\Local\Temp\F0D9.exe
C:\Users\Admin\AppData\Local\Temp\F0D9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:2264

C:\Users\Admin\AppData\Local\Temp\F510.exe
C:\Users\Admin\AppData\Local\Temp\F510.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 752
  2⤵
  - Program crash
  PID:2812

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 216 -ip 216
1⤵
PID:1788

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2676

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\F0D9.exe
  "C:\Users\Admin\AppData\Local\F0D9.exe"
  2⤵
  PID:4564

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:776

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

Filesize
203KB

MD5
4e2b3d8982bca7f4c1ee7b15c934822c

SHA1
2cc3ac6452d7c79a627b7c79f7881ff2dc91495a

SHA256
a9cf4fa125ef691f32b965285ec8a2c11a9d8ae88aa6ec36070a6c1662f4ee34

SHA512
7061c86ec293d536bed0d22ace27e74d4eb36c9809adae8d690abe718a3c639192dcdebad56ac66e45a43d3fa3924c0b89930169b3b30cbf7cb29c5dfdb70be0

Download Submit
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

Filesize
203KB

MD5
4e6fe95373ebe3a507781900cb80c9ff

SHA1
9ffe8c6d0b0d0a34e4078214a769f44dfeea6681

SHA256
af84d112efa7200010497581f9bea4be3f6f3f6215e353fa137125cfc95e2a94

SHA512
beb92fa19552dbd1cc5d4757d8e2ae02727d0bb9038b0cb19940694e8e7db2d9e21de85dd633435f45a340f4c334392d4614ad8b6f31bc5b55513d0324b70433

Download Submit
C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe

Filesize
320KB

MD5
93889bd85b0c0b6d8380094e9ce6459e

SHA1
5aaae0b23eaf18e390baf0e1914df702b734c12a

SHA256
7581f01f756caeaff10ad4e44c81d3530ea5e25cb6ff0fe269123d769fc92714

SHA512
04bc9acf26140409b16b88ef485f2d2a17a224532cb5d5299418318d5a3cca6d3ded52f4111d2384c9c62a9c6016a52fca10fbe89a8574319d0e5e04b29e46cf

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\USERS\PUBLIC\DESKTOP\ACROBAT READER DC.LNK.R2U

Filesize
3KB

MD5
afaca81a393da18518fea16d8df7f373

SHA1
f1134e0c573f005c15751d957cdf9fef3bc8a698

SHA256
c676631d03a5294653d6316aff912e901ceae4385aac8ee41a97836e8486dece

SHA512
87d82e68a6ea4b7f894a1dbfc7d9ff78a8466521ea320f2ec971459233dfdd3f8fc74e263113bf69b3f11b5ef709eb96933effb05bc836458440acf6a2cfc453

Download Submit
C:\USERS\PUBLIC\DESKTOP\FIREFOX.LNK.R2U

Filesize
1KB

MD5
bfcb0f993cf3b6af80a442ae7ae841ea

SHA1
5f522b1cd35e98d36fd2acb28bc75b7e0c004058

SHA256
0b48edac7675218a5f00a6f901092f6df7e112f5eb346531fa8497852cb4fbb7

SHA512
da0d119247079cdc5e7fdbcdf5504a069cbfd81b9488fb3705bc6490257c347ed0558566f0147615d86fe2989ae323712ea35d2923483baaf9527d60b1818429

Download Submit
C:\USERS\PUBLIC\DESKTOP\GOOGLE CHROME.LNK.R2U

Filesize
3KB

MD5
6a60f0d65ab0e5a6a2787bd6afe48bab

SHA1
90c8a98f74a01d03912e5dc432a67391e494966b

SHA256
2e2ec160a211011a3dfd006bc67f29ab18cda70622c12daf4776300ef2c3b532

SHA512
dbda307d33cf8208525783dfbdbb68132d82d7179bebb3a3a4bb371b6c3c1f4be63e837245a6f2440fea39ff65a0674f84ead56be8f77d4af4c26e8524a0382b

Download Submit
C:\USERS\PUBLIC\DESKTOP\README.TXT

Filesize
1KB

MD5
c03dedf785e4b3f769411780136adb84

SHA1
1abad02dabb297ccb2d6768df0b283c3f44361b6

SHA256
187e8e2198fd67f730ce69f858697e0c88358178e0b32846bff49a4440702e3c

SHA512
8f1d181f45b7f90d3a97e41dbf0e8385a55a6584a817b39f4cd3ab5d59a11d1fa8cd426a3633b5893eb8e1a903371aded55de1956a60e3bd28541c1440ba160e

Download Submit
C:\USERS\PUBLIC\DESKTOP\VLC MEDIA PLAYER.LNK.R2U

Filesize
1KB

MD5
e41ad393aa8694632b26e80a0e03edf2

SHA1
36036ade08d882b314687af5aa77421f6b3893d3

SHA256
f7c1559617cb906cbde4499f23ae076dc3a922f2475d7a6386e0078a9a77a8db

SHA512
0013ace4e0e9e6b55be1865cddb40bd5cb9291bdf2849debd73740fb8f7223746562090738df0172eb23d57abaadc17e6d7bcd71f2cd4594149bc816d0b532dc

Download Submit
C:\Users\Admin\AppData\Local\F0D9.exe

Filesize
50KB

MD5
4c4a63e3906a19edb4e7f97419fa3033

SHA1
afc257d249bd12e4a13a2c4fc7e1df44301228d3

SHA256
16bb1dd92c0dcc2cc0a3057b15f2e50214cb79c225ab136a91f7918787678882

SHA512
c18e3f8010f02b829c39e2488bca4cc5f9e9fc0c7055d4049490f79820793389fe6b55d37a6e4f24b57bb629aa9b0721323f409f5d84e3603d5eb742c70a5e50

Download Submit
C:\Users\Admin\AppData\Local\F0D9.exe

Filesize
50KB

MD5
4c4a63e3906a19edb4e7f97419fa3033

SHA1
afc257d249bd12e4a13a2c4fc7e1df44301228d3

SHA256
16bb1dd92c0dcc2cc0a3057b15f2e50214cb79c225ab136a91f7918787678882

SHA512
c18e3f8010f02b829c39e2488bca4cc5f9e9fc0c7055d4049490f79820793389fe6b55d37a6e4f24b57bb629aa9b0721323f409f5d84e3603d5eb742c70a5e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB2B.exe

Filesize
106KB

MD5
957f3db87f8c9a1540269e6aa08c14b2

SHA1
14be1c43fbfb325858cda78a126528f82cf77ad2

SHA256
2cb58713d1eff5ac37e8db040d25537c0e7bb6737c905a577fb257e4e4360f83

SHA512
cd7089eb072c3eaccc474a1e8f4b60a3bcaa4fc60c2761f649ac91edbfe7b7389db60d8156fe1eadb8b78628c48bca115fabdb00d115451a85433272d875d463

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB2B.exe

Filesize
106KB

MD5
957f3db87f8c9a1540269e6aa08c14b2

SHA1
14be1c43fbfb325858cda78a126528f82cf77ad2

SHA256
2cb58713d1eff5ac37e8db040d25537c0e7bb6737c905a577fb257e4e4360f83

SHA512
cd7089eb072c3eaccc474a1e8f4b60a3bcaa4fc60c2761f649ac91edbfe7b7389db60d8156fe1eadb8b78628c48bca115fabdb00d115451a85433272d875d463

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0D9.exe

Filesize
50KB

MD5
4c4a63e3906a19edb4e7f97419fa3033

SHA1
afc257d249bd12e4a13a2c4fc7e1df44301228d3

SHA256
16bb1dd92c0dcc2cc0a3057b15f2e50214cb79c225ab136a91f7918787678882

SHA512
c18e3f8010f02b829c39e2488bca4cc5f9e9fc0c7055d4049490f79820793389fe6b55d37a6e4f24b57bb629aa9b0721323f409f5d84e3603d5eb742c70a5e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0D9.exe

Filesize
50KB

MD5
4c4a63e3906a19edb4e7f97419fa3033

SHA1
afc257d249bd12e4a13a2c4fc7e1df44301228d3

SHA256
16bb1dd92c0dcc2cc0a3057b15f2e50214cb79c225ab136a91f7918787678882

SHA512
c18e3f8010f02b829c39e2488bca4cc5f9e9fc0c7055d4049490f79820793389fe6b55d37a6e4f24b57bb629aa9b0721323f409f5d84e3603d5eb742c70a5e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\F510.exe

Filesize
107KB

MD5
29c35719b1ad2a2106cfa7072877e86c

SHA1
393a2b9a4bf4bc4711e51f3f62f21bc6fa93f9a5

SHA256
16c1c4b955d4c9acfbba91c6267ed68a0e9826aab0eaa0f7e05a7cfbbde1ffe1

SHA512
f740f53837ce94ea0dcdfa9ab3151e661624a15ab0b5e91ff970037333921907316bc51d61c2fefaf949e9f2a7c0de75e8ce20df1cb3f297d0d6039c982206ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\F510.exe

Filesize
107KB

MD5
29c35719b1ad2a2106cfa7072877e86c

SHA1
393a2b9a4bf4bc4711e51f3f62f21bc6fa93f9a5

SHA256
16c1c4b955d4c9acfbba91c6267ed68a0e9826aab0eaa0f7e05a7cfbbde1ffe1

SHA512
f740f53837ce94ea0dcdfa9ab3151e661624a15ab0b5e91ff970037333921907316bc51d61c2fefaf949e9f2a7c0de75e8ce20df1cb3f297d0d6039c982206ee

Download Submit
C:\Users\Admin\AppData\Roaming\aitfhfa

Filesize
31KB

MD5
ccfe6fcb0b2237e87f56f5232bd642a9

SHA1
10b5b9db76c994b91e3e15b98ca48da47e990768

SHA256
512073deee834a9d4a8200336fab223b9b98edf1dc817920a850e3a2656fbc03

SHA512
c3049c1dbaa860124c70975fdae08a18fc471c756f4e1c74a5d0448b1ca42bfab1df9df98599c0b5959038d41d6bcb5b418cab720c9b58cff37f24b6a0d3c945

Download Submit
C:\Users\Admin\AppData\Roaming\fuweggh

Filesize
243KB

MD5
9ed8119386531d22524f74c418364c3b

SHA1
5c250b39371f07438994e2a5c8ff7848ddc9454e

SHA256
6b560dddbe1be909de2e7780e3f57a04c9df76ffb1c891cd48c616486b428086

SHA512
7ae7cb40f914ab93ed84040940b1eb414aa24057155729125774c4b3dad3c205e6fd4e172a6dd37c0a41850caf8f6ff769b8740204533b3af5259745a157f5c2

Download Submit
C:\Users\Public\8D9E927358F0E450365F21C7CBB7996EDFF5C6F92A853E877E85154F384B2AD7

Filesize
1KB

MD5
be303bd5de25641e3ca9b42d5f60b3f1

SHA1
7b532410d2e840ac5cd2b337cebb9cc89359c77a

SHA256
ae2916e7ebaeae3639d87724649853e7a66532d4d1561c0636370dc7c7dabd18

SHA512
f22177eddeab7883640e0c96d143d5c4fd03b5a8d7b2b502dbd6d2a213c08d53627758a7573ca377263e537a7e41d4005af5a4c587fe9fac7c2668851ace8d33

Download Submit
\??\M:\Boot\readme.txt

Filesize
1KB

MD5
b3dfb1e0a1caa9098ec26008ff4bca9e

SHA1
79f01cf532f2b23339368da36ac06439e0b3cc5b

SHA256
f66cc8da077c846628ccaec36bd09dba9228c2b3681e4adb3f4a0ce99d3fbb47

SHA512
e49848e5aa995510e8dfed9a941d67e54be87eb8459ee080235f1b47d4c9012a03599c35b48b35d4964c4f15423c33df25dc6e3352d56162c576fe4f940097a0

Download Submit
\??\M:\readme.txt

Filesize
1KB

MD5
437e75f08a1f36bdc8760b14ec4c296c

SHA1
2b0d61af400f8a9c2a4fb210ddcce4d4a4b1f5ba

SHA256
d1cd27a101212fa35ec7a850a9cfcf793795c6876fa32c723a239b3c2be48b95

SHA512
5ac94a0ac174eafc0428ce5360f0068bfcb981998ec1f20d3c54652a9ddf364c7766d2b33ebf1f7869296eb7c399dc3dc6680b91279f4d81c20586618540a0f3

Download Submit
memory/216-192-0x0000000000E40000-0x0000000000EAB000-memory.dmp

Filesize
428KB

Download
memory/216-190-0x0000000000EB0000-0x0000000000F24000-memory.dmp

Filesize
464KB

Download
memory/216-186-0x0000000000000000-mapping.dmp

Download
memory/392-175-0x0000000000000000-mapping.dmp

Download
memory/1128-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1128-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2056-154-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-151-0x00000000074C0000-0x00000000074D0000-memory.dmp

Filesize
64KB

Download
memory/2056-161-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-164-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-165-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-166-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-167-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-168-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-169-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-170-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-171-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2056-172-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-173-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-174-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-162-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-160-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-159-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-134-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-158-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-157-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-135-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-136-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-156-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-155-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-137-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-153-0x0000000007F20000-0x0000000007F30000-memory.dmp

Filesize
64KB

Download
memory/2056-138-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-139-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-140-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-141-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-152-0x0000000007F20000-0x0000000007F30000-memory.dmp

Filesize
64KB

Download
memory/2056-163-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-143-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-142-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-150-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-198-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-149-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-199-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-195-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2056-200-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2056-148-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-147-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-146-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-144-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2056-145-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2204-188-0x00000000057B0000-0x00000000057C2000-memory.dmp

Filesize
72KB

Download
memory/2204-182-0x0000000000000000-mapping.dmp

Download
memory/2204-206-0x0000000005C80000-0x0000000005CF6000-memory.dmp

Filesize
472KB

Download
memory/2204-204-0x00000000068E0000-0x0000000006E84000-memory.dmp

Filesize
5.6MB

Download
memory/2204-215-0x0000000007000000-0x0000000007066000-memory.dmp

Filesize
408KB

Download
memory/2204-207-0x0000000006450000-0x000000000646E000-memory.dmp

Filesize
120KB

Download
memory/2204-189-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/2204-187-0x0000000005D10000-0x0000000006328000-memory.dmp

Filesize
6.1MB

Download
memory/2204-205-0x0000000006330000-0x00000000063C2000-memory.dmp

Filesize
584KB

Download
memory/2204-194-0x0000000005850000-0x000000000588C000-memory.dmp

Filesize
240KB

Download
memory/2204-185-0x0000000000E20000-0x0000000000E40000-memory.dmp

Filesize
128KB

Download
memory/2264-181-0x0000000000400000-0x000000000040D400-memory.dmp

Filesize
53KB

Download
memory/2264-178-0x0000000000000000-mapping.dmp

Download
memory/3848-191-0x0000000000000000-mapping.dmp

Download
memory/3848-193-0x0000000000D50000-0x0000000000D5C000-memory.dmp

Filesize
48KB

Download
memory/4564-217-0x0000000000000000-mapping.dmp

Download
memory/4564-220-0x0000000000400000-0x000000000040D400-memory.dmp

Filesize
53KB

Download