djvu | 31991c4e5167dd4f5a7a3a71fe0b09cc8cad51bb610057c18f1d58383c47f79a

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 211KB
Sample221011-els9radfb8
SHA256 31991c4e5167dd4f5a7a3a71fe0b09cc8cad51bb610057c18f1d58383c47f79a
MD5 e5030e9f23f13afb77009eaf92e5b1af
SHA1 95b48e12a3f70a3c91225a7f3a8433479f5ec7c6
SHA512 3494f35a18b5f5a6021798dff18715b0bef93d00d76dc5526286e3782b2ae5203077a69829c9a155a4bd03df71203b82d2f68e9835acb0e5da806490e6dcf21c
SSDEEP 3072:fr1o/X/DAeaheDLg+XmARG2L747d5dR8xiqscwesRXQdO:fB2NagLg+XmEEfqsOH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu smokeloader backdoor collection discovery persistence ransomware trojan

Malware Config

Extracted

Family

djvu

http://winnlinne.com/lancer/get.php

Attributes

extension
.towz
offline_id
SSHsHMHGmSIhrz50VnIxLJJX15osxEQY6iXedXt1
payload_url
http://rgyui.top/dl/build2.exe

http://winnlinne.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Kbx8mJatqN Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0577Jhyjd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/3388-160-0x0000000002200000-0x000000000231B000-memory.dmp	family_djvu
behavioral2/memory/5064-163-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5064-168-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5064-165-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5064-169-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4580-170-0x0000000001200000-0x0000000001275000-memory.dmp	family_djvu
behavioral2/memory/5064-205-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4312-211-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4312-212-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4312-220-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 3 IoCs

resource	yara_rule
behavioral2/memory/736-133-0x0000000000720000-0x0000000000729000-memory.dmp	family_smokeloader
behavioral2/memory/736-136-0x0000000000720000-0x0000000000729000-memory.dmp	family_smokeloader
behavioral2/memory/2416-173-0x0000000000610000-0x0000000000619000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
4152	B6BD.exe
3388	D8CD.exe
772	DCC6.exe
2416	E071.exe
4376	E4F6.exe
5064	D8CD.exe
4484	Bags.exe.pif
3596	D8CD.exe
4312	D8CD.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	D8CD.exe

Loads dropped DLL 2 IoCs

pid	Process
2832	regsvr32.exe
2832	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
404	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	E4F6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	E4F6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d2b0a8e2-3b88-497d-9c57-f0b93c8e2cd9\\D8CD.exe\" --AutoStart"	D8CD.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	api.2ip.ua
46	api.2ip.ua
51	api.2ip.ua
71	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 5064	3388	D8CD.exe	97
PID 3596 set thread context of 4312	3596	D8CD.exe	123

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1552	772	WerFault.exe	92
2544	4152	WerFault.exe	89
3024	4152	WerFault.exe	89
2644	4152	WerFault.exe	89
996	4152	WerFault.exe	89

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E071.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E071.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4116	tasklist.exe
3372	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3900	PING.EXE
4860	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
736	file.exe
736	file.exe
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
736	file.exe
3092	Process not Found
3092	Process not Found
3092	Process not Found
3092	Process not Found
2416	E071.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeDebugPrivilege	4116	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found
Token: SeShutdownPrivilege	3092	Process not Found
Token: SeCreatePagefilePrivilege	3092	Process not Found

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4484	Bags.exe.pif
3092	Process not Found
3092	Process not Found
4484	Bags.exe.pif
4484	Bags.exe.pif
3092	Process not Found
3092	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4484	Bags.exe.pif
4484	Bags.exe.pif
4484	Bags.exe.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4152	3092	Process not Found	89
PID 3092 wrote to memory of 4152	3092	Process not Found	89
PID 3092 wrote to memory of 4152	3092	Process not Found	89
PID 3092 wrote to memory of 3388	3092	Process not Found	90
PID 3092 wrote to memory of 3388	3092	Process not Found	90
PID 3092 wrote to memory of 3388	3092	Process not Found	90
PID 3092 wrote to memory of 1528	3092	Process not Found	91
PID 3092 wrote to memory of 1528	3092	Process not Found	91
PID 3092 wrote to memory of 772	3092	Process not Found	92
PID 3092 wrote to memory of 772	3092	Process not Found	92
PID 3092 wrote to memory of 772	3092	Process not Found	92
PID 1528 wrote to memory of 2832	1528	regsvr32.exe	93
PID 1528 wrote to memory of 2832	1528	regsvr32.exe	93
PID 1528 wrote to memory of 2832	1528	regsvr32.exe	93
PID 3092 wrote to memory of 2416	3092	Process not Found	94
PID 3092 wrote to memory of 2416	3092	Process not Found	94
PID 3092 wrote to memory of 2416	3092	Process not Found	94
PID 3092 wrote to memory of 4376	3092	Process not Found	95
PID 3092 wrote to memory of 4376	3092	Process not Found	95
PID 3092 wrote to memory of 4376	3092	Process not Found	95
PID 3092 wrote to memory of 4580	3092	Process not Found	96
PID 3092 wrote to memory of 4580	3092	Process not Found	96
PID 3092 wrote to memory of 4580	3092	Process not Found	96
PID 3092 wrote to memory of 4580	3092	Process not Found	96
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3092 wrote to memory of 2680	3092	Process not Found	100
PID 3092 wrote to memory of 2680	3092	Process not Found	100
PID 3092 wrote to memory of 2680	3092	Process not Found	100
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 3388 wrote to memory of 5064	3388	D8CD.exe	97
PID 4376 wrote to memory of 1152	4376	E4F6.exe	98
PID 4376 wrote to memory of 1152	4376	E4F6.exe	98
PID 4376 wrote to memory of 1152	4376	E4F6.exe	98
PID 4376 wrote to memory of 1276	4376	E4F6.exe	104
PID 4376 wrote to memory of 1276	4376	E4F6.exe	104
PID 4376 wrote to memory of 1276	4376	E4F6.exe	104
PID 1276 wrote to memory of 1704	1276	cmd.exe	106
PID 1276 wrote to memory of 1704	1276	cmd.exe	106
PID 1276 wrote to memory of 1704	1276	cmd.exe	106
PID 5064 wrote to memory of 404	5064	D8CD.exe	113
PID 5064 wrote to memory of 404	5064	D8CD.exe	113
PID 5064 wrote to memory of 404	5064	D8CD.exe	113
PID 1704 wrote to memory of 4116	1704	cmd.exe	114
PID 1704 wrote to memory of 4116	1704	cmd.exe	114
PID 1704 wrote to memory of 4116	1704	cmd.exe	114
PID 1704 wrote to memory of 2228	1704	cmd.exe	115
PID 1704 wrote to memory of 2228	1704	cmd.exe	115
PID 1704 wrote to memory of 2228	1704	cmd.exe	115
PID 1704 wrote to memory of 3372	1704	cmd.exe	116
PID 1704 wrote to memory of 3372	1704	cmd.exe	116
PID 1704 wrote to memory of 3372	1704	cmd.exe	116
PID 1704 wrote to memory of 3308	1704	cmd.exe	117
PID 1704 wrote to memory of 3308	1704	cmd.exe	117
PID 1704 wrote to memory of 3308	1704	cmd.exe	117
PID 1704 wrote to memory of 2480	1704	cmd.exe	119
PID 1704 wrote to memory of 2480	1704	cmd.exe	119
PID 1704 wrote to memory of 2480	1704	cmd.exe	119

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:736

C:\Users\Admin\AppData\Local\Temp\B6BD.exe
C:\Users\Admin\AppData\Local\Temp\B6BD.exe
1⤵
- Executes dropped EXE
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 536
  2⤵
  - Program crash
  PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 560
  2⤵
  - Program crash
  PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 560
  2⤵
  - Program crash
  PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 608
  2⤵
  - Program crash
  PID:996

C:\Users\Admin\AppData\Local\Temp\D8CD.exe
C:\Users\Admin\AppData\Local\Temp\D8CD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\D8CD.exe
  C:\Users\Admin\AppData\Local\Temp\D8CD.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\d2b0a8e2-3b88-497d-9c57-f0b93c8e2cd9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\D8CD.exe
    "C:\Users\Admin\AppData\Local\Temp\D8CD.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\D8CD.exe
      "C:\Users\Admin\AppData\Local\Temp\D8CD.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4312

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DA83.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DA83.dll
  2⤵
  - Loads dropped DLL
  PID:2832

C:\Users\Admin\AppData\Local\Temp\DCC6.exe
C:\Users\Admin\AppData\Local\Temp\DCC6.exe
1⤵
- Executes dropped EXE
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 340
  2⤵
  - Program crash
  PID:1552

C:\Users\Admin\AppData\Local\Temp\E071.exe
C:\Users\Admin\AppData\Local\Temp\E071.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2416

C:\Users\Admin\AppData\Local\Temp\E4F6.exe
C:\Users\Admin\AppData\Local\Temp\E4F6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\ftp.exe
  ftp /?
  2⤵
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Preferences.vsd & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4116
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3372
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:3308
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^zsXAL$" Simulation.vsd
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bags.exe.pif
      Bags.exe.pif f
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4484
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:4860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4580

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 772 -ip 772
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4152 -ip 4152
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4152 -ip 4152
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4152 -ip 4152
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4152 -ip 4152
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 2KB
SHA256 2d82e2629fa2e08f28b43b15da43dff56c7f4b23b39d66109c7c61998e35b4d5
MD5 6f59ed058aa06aaf5ec6213b955aabd4
SHA1 baf7b828a563b8fb6111e4ce35e0055575ad80b4
SHA512 6b0f041dafb98b9eaf70ac0d20a98c56e1c42231c4a4ae6e11582b20d20bf8f96dfd7747739a10d77368994441adb0e181b356f8569697b1f22ab4fe931170ce
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 1KB
SHA256 263292040d77903899257c1d21201dc64d6f8d6b5a1d945cd5b28d0124d7906c
MD5 0698dbc93ba7b6bef73ba316695f8317
SHA1 a444078ff1eb7c88f52cb4e324365926b491ed47
SHA512 ebacaa7009aebb88199cd70fd0bb3afe69ed300318cb633edd1c0404e42aef829617f589bcbad6cb7ab4bd0a8ae87f7df1435c786184ecc5de61c8fc6950a900
MD5 SHA1 SHA512

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 488B
SHA256 a7b9008dee608120bfa084582b27095638ab0edadf3061b0e990908ada8741f2
MD5 fa105ea6d2548eef04d16449bb92e5e1
SHA1 b77c27c3316707f2b51dea4cf4d09990c68f0fd2
SHA512 7e2df110402e686f60eb1b35d9b26f257528aba6bf02b9661060f154db173f9219f6447732e20ae9a25a55e11275052f2b08fb68d8043fb6562509bade059ecf
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 482B
SHA256 ca41fa37a2cf86be44e9a6293a408664c542ffb9e392223566a2da398dc1aba4
MD5 112c99d9bebbb3a8addbac41c250fa4f
SHA1 2652d409413a673aaa9e6eabce47145187c2296d
SHA512 32f16167987fbbf0f455081d26c5f920290ea8800361fbcc2af8e179ee1c981d4e8335bee24ba649defb03d7ca0b039d73120cfbfe9675ba1aed1774808b0a73
MD5 SHA1 SHA512

Submit Download

B6BD.exe

Path C:\Users\Admin\AppData\Local\Temp\B6BD.exe
Size 5.6MB
SHA256 47dff2cd65d884f11c012b5e682e2492cf50d81d74a90b23737bc5a697226b3f
MD5 9bbfdade0753215cdc3a39201ec0bd0e
SHA1 2b5bea6c5571c4c007a8686240e9d2e6032b1773
SHA512 411e9106a1f1201a814486d4e207aee010755626ba6f03000ddc1072220aa1a44b9e9b338bc54780f2f5ee9ae95c18dd81e4a322871444f46425ea6772790bee
SSDEEP 49152:9Hq0TgFFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:9HqmJSjL+EnHOMz5ysZA5+bf6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

B6BD.exe

Path C:\Users\Admin\AppData\Local\Temp\B6BD.exe
Size 5.6MB
SHA256 47dff2cd65d884f11c012b5e682e2492cf50d81d74a90b23737bc5a697226b3f
MD5 9bbfdade0753215cdc3a39201ec0bd0e
SHA1 2b5bea6c5571c4c007a8686240e9d2e6032b1773
SHA512 411e9106a1f1201a814486d4e207aee010755626ba6f03000ddc1072220aa1a44b9e9b338bc54780f2f5ee9ae95c18dd81e4a322871444f46425ea6772790bee
SSDEEP 49152:9Hq0TgFFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:9HqmJSjL+EnHOMz5ysZA5+bf6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\Temp\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\Temp\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\Temp\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\Temp\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\Temp\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DA83.dll

Path C:\Users\Admin\AppData\Local\Temp\DA83.dll
Size 1.4MB
SHA256 58ee95995100dee5d1511f860081b27ac8bdca627e43ed0c783f14351a1eb70d
MD5 ee4e00c732ed0e71a3e15eb848f99f84
SHA1 53bf346138bfa70ed91756c0a1835dc2d68813bf
SHA512 0c1c33be5b9da02c3a6c7a6b1f25b9a8898717853ba1b31835514b593364da4edfbc2224c86820551be124c9c7b2e22c15f0e2effd8c5c2c68f74c8d8d316b62
SSDEEP 24576:/shYxuKGJBAXWY4zfvC43a/LgjcQ0r2LEz7Zl+0bKchYLTA+Jxyu:/lraPYUpqjgj/0CLu80PKrxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DA83.dll

Path C:\Users\Admin\AppData\Local\Temp\DA83.dll
Size 1.4MB
SHA256 58ee95995100dee5d1511f860081b27ac8bdca627e43ed0c783f14351a1eb70d
MD5 ee4e00c732ed0e71a3e15eb848f99f84
SHA1 53bf346138bfa70ed91756c0a1835dc2d68813bf
SHA512 0c1c33be5b9da02c3a6c7a6b1f25b9a8898717853ba1b31835514b593364da4edfbc2224c86820551be124c9c7b2e22c15f0e2effd8c5c2c68f74c8d8d316b62
SSDEEP 24576:/shYxuKGJBAXWY4zfvC43a/LgjcQ0r2LEz7Zl+0bKchYLTA+Jxyu:/lraPYUpqjgj/0CLu80PKrxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DA83.dll

Path C:\Users\Admin\AppData\Local\Temp\DA83.dll
Size 1.4MB
SHA256 58ee95995100dee5d1511f860081b27ac8bdca627e43ed0c783f14351a1eb70d
MD5 ee4e00c732ed0e71a3e15eb848f99f84
SHA1 53bf346138bfa70ed91756c0a1835dc2d68813bf
SHA512 0c1c33be5b9da02c3a6c7a6b1f25b9a8898717853ba1b31835514b593364da4edfbc2224c86820551be124c9c7b2e22c15f0e2effd8c5c2c68f74c8d8d316b62
SSDEEP 24576:/shYxuKGJBAXWY4zfvC43a/LgjcQ0r2LEz7Zl+0bKchYLTA+Jxyu:/lraPYUpqjgj/0CLu80PKrxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCC6.exe

Path C:\Users\Admin\AppData\Local\Temp\DCC6.exe
Size 274KB
SHA256 30502d73924e948dadf7c1162bb2ad385fe2bc04872eb37bcdb002c9351095bf
MD5 1ffcf9fb93401efc7dcf8824c76b2256
SHA1 811a2b23568b091da9ca1d74707a17afbf0aa308
SHA512 34c4992ad352ac06a10cc1b8a7825e5547136de316d3ec901b37cb4aa46ba4efc44ca0d247c10449fba2b27ad1fa1ce11122dc42176a0e7017115f4127701725
SSDEEP 3072:cXrlYCA0QolTJQo60o5/5ogSdL7JCMW4LrCzFM/h3qpZa9uD6VdyhkhUuS:YpYCAzoP7q51SlcMWRrwVfquS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCC6.exe

Path C:\Users\Admin\AppData\Local\Temp\DCC6.exe
Size 274KB
SHA256 30502d73924e948dadf7c1162bb2ad385fe2bc04872eb37bcdb002c9351095bf
MD5 1ffcf9fb93401efc7dcf8824c76b2256
SHA1 811a2b23568b091da9ca1d74707a17afbf0aa308
SHA512 34c4992ad352ac06a10cc1b8a7825e5547136de316d3ec901b37cb4aa46ba4efc44ca0d247c10449fba2b27ad1fa1ce11122dc42176a0e7017115f4127701725
SSDEEP 3072:cXrlYCA0QolTJQo60o5/5ogSdL7JCMW4LrCzFM/h3qpZa9uD6VdyhkhUuS:YpYCAzoP7q51SlcMWRrwVfquS
MD5 SHA1 SHA512 SSDEEP

Submit Download

E071.exe

Path C:\Users\Admin\AppData\Local\Temp\E071.exe
Size 210KB
SHA256 f876e3f788538f0e83a3081ee1291e6fe6bdf4eec0193aaa274a786be476bbc4
MD5 014789aa038e30c273fffbcab8648de6
SHA1 b4053bc3ece6ed77b87cf24c8a50e7b0c12f3883
SHA512 471368f383964299f541c31a8d083698d1aeff6caf7a2d1ea51c54c604e11bafcca11a5f22ba1217425b6df9010b348d2d211d517daa1a3735a8406ddcf755a2
SSDEEP 3072:3oOo/XeLAfGNCL+KgFiwRGomD9LjeVqsKp63arhBJcI05B1Ep1O:3pP4fL+9Fi8mD9PeVC4arnJcIu27
MD5 SHA1 SHA512 SSDEEP

Submit Download

E071.exe

Path C:\Users\Admin\AppData\Local\Temp\E071.exe
Size 210KB
SHA256 f876e3f788538f0e83a3081ee1291e6fe6bdf4eec0193aaa274a786be476bbc4
MD5 014789aa038e30c273fffbcab8648de6
SHA1 b4053bc3ece6ed77b87cf24c8a50e7b0c12f3883
SHA512 471368f383964299f541c31a8d083698d1aeff6caf7a2d1ea51c54c604e11bafcca11a5f22ba1217425b6df9010b348d2d211d517daa1a3735a8406ddcf755a2
SSDEEP 3072:3oOo/XeLAfGNCL+KgFiwRGomD9LjeVqsKp63arhBJcI05B1Ep1O:3pP4fL+9Fi8mD9PeVC4arnJcIu27
MD5 SHA1 SHA512 SSDEEP

Submit Download

E4F6.exe

Path C:\Users\Admin\AppData\Local\Temp\E4F6.exe
Size 692KB
SHA256 b7d5fb28fcb3168a491be679b71c79ad28e4dde619361671095c81c2b6c97970
MD5 52d4af6eab9e603ed974524ea0a7103c
SHA1 0bd5d7b73a649c17c40685fab934aeb13d734c82
SHA512 f9211e95ea9aec395e32165c82f2663924a2097e454cd7c8e3e8bc394073ec963be4ec7a5b6193368f403e502efa475b0a218565b8860d18d57f792290421e25
SSDEEP 12288:8S7yhBX+pxkKjVpN+y5bFOxI0cHsfvdXzwI52KtMqi1q4TQBhmz+9RGQlknr:4hoDpjVpN1b8xGHWv1cyI1qkshLRGeGr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bags.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bags.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bags.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bags.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Euros.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Euros.vsd
Size 725KB
SHA256 97208cb34d8b0af9e7bf3b8400ddd249337a58c4be8a38f39e3874900a73d455
MD5 e0352752dddef97bad04fa25c81fe867
SHA1 1c040b67598bbccdd510a49f842668935365fd71
SHA512 331ac25e2122779710fd0c4b3818df6ab3c1ea7df2d406953cfe39734dac32283f849a37766c0070fcd2dba82502c22b2e28867dcf64a9931cc5d8c14e4a1240
SSDEEP 6144:bPQ9I7fH7tfSfrfFUZwtGplmkzErMdaxf8cLD3Y/pIufjGy5OieS13m9yFdG1s+E:OITjZpmY4Ea8C85fjGK34vISF43
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Preferences.vsd
Size 10KB
SHA256 7f50c3b8b4e5f2117c562a78e2a08c65a25c019e3341c649b2a44b7873ae190d
MD5 23df91b58a61d477860ae3d23b098968
SHA1 b474e7cd93994fbbe780842e3cbebcd833981a34
SHA512 ea05e91b616ec2861ae2586fbd17120fd00e3b059c3200a7676a57146344bc54ff418902912ac2a184eb7e0ab1926b9a56774a10ba68166c030319a6974f4331
SSDEEP 192:k6eWTzeRl+nR8ae582KePqtWvqAHv8pO4yOvTqHFz7pC4yOvTqHFT+neEvvWJj:k6eWTMl+Te5+VkqkUpO2TSFfpC2TSF6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Simulation.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Simulation.vsd
Size 924KB
SHA256 b6031d6424a4221830e29153fc7125dbd251b454539de76fee852a6875840431
MD5 75d2326d2d1bb6de24f3dda341482c13
SHA1 38c9138a24824073eef171cf365ebb01a2c4937f
SHA512 b3521bdc95c871ffb8f5866f2f9699ed8343715437e40f9da42a4740e1b279ddb6d4aa85229485baf8331bba5868c4299860031888c322e96b29ce6aa3761dc3
SSDEEP 24576:dErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:d86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

D8CD.exe

Path C:\Users\Admin\AppData\Local\d2b0a8e2-3b88-497d-9c57-f0b93c8e2cd9\D8CD.exe
Size 794KB
SHA256 dabde7613fffa25ef0f3d562f1918f81afd615dc74186e7dc2c004fbb12a7210
MD5 7b64f806fa586af2a86c5f23e0c663e3
SHA1 d90156925d2b201d33c3ee7adc5da673af9df4c6
SHA512 7a93714867880d4abf5ec687a2e79014e4617161e7f989d6de44581086a599cece9d6c524bee7981858cca826de8852c8a1c5e20f735537349770526efd05035
SSDEEP 24576:kBNPJhPNNP+LLAv4ggLNT93AwuQrzYRbSn:kBN/NNP+LLAkNT9mgCbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/736-134-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/736-132-0x000000000083D000-0x000000000084E000-memory.dmp

Download

memory/736-136-0x0000000000720000-0x0000000000729000-memory.dmp

Download

memory/736-137-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/736-135-0x000000000083D000-0x000000000084E000-memory.dmp

Download

memory/736-133-0x0000000000720000-0x0000000000729000-memory.dmp

Download

memory/772-178-0x0000000000637000-0x0000000000647000-memory.dmp

Download

memory/772-175-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2416-173-0x0000000000610000-0x0000000000619000-memory.dmp

Download

memory/2416-172-0x000000000080D000-0x000000000081D000-memory.dmp

Download

memory/2416-174-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2416-179-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2680-167-0x00000000005E0000-0x00000000005EC000-memory.dmp

Download

memory/2832-181-0x0000000002C40000-0x0000000002CF5000-memory.dmp

Download

memory/2832-158-0x0000000002390000-0x00000000024FB000-memory.dmp

Download

memory/2832-182-0x0000000002C40000-0x0000000002CF5000-memory.dmp

Download

memory/2832-176-0x0000000002870000-0x0000000002967000-memory.dmp

Download

memory/2832-180-0x0000000002B70000-0x0000000002C39000-memory.dmp

Download

memory/2832-186-0x0000000002A70000-0x0000000002B65000-memory.dmp

Download

memory/2832-177-0x0000000002A70000-0x0000000002B65000-memory.dmp

Download

memory/3388-159-0x0000000000544000-0x00000000005D5000-memory.dmp

Download

memory/3388-160-0x0000000002200000-0x000000000231B000-memory.dmp

Download

memory/3596-213-0x0000000000989000-0x0000000000A1A000-memory.dmp

Download

memory/4152-191-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/4152-190-0x0000000003260000-0x000000000377F000-memory.dmp

Download

memory/4152-219-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/4312-220-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4312-212-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4312-211-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4580-185-0x0000000001200000-0x0000000001275000-memory.dmp

Download

memory/4580-184-0x0000000000AC0000-0x0000000000B2B000-memory.dmp

Download

memory/4580-171-0x0000000000AC0000-0x0000000000B2B000-memory.dmp

Download

memory/4580-170-0x0000000001200000-0x0000000001275000-memory.dmp

Download

memory/5064-205-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5064-163-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5064-168-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5064-165-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5064-169-0x0000000000400000-0x0000000000537000-memory.dmp

Download