redline | 7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06

Analysis

max time kernel
51s
max time network
300s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
28-10-2022 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Size

201KB
MD5

25c1edf6b6614bcd7b2bb069ce43da3c
SHA1

3c908bc6da3c488b4db676d7b142714355122dc4
SHA256

7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06
SHA512

fed4eabc05c462bb0b41f8e6748960de036a7664b5055574a0c942ffc54f19752e8de767454f0d127395574e4aa0d8bc2492cd77d23b40ee461937e60c8c8e9f
SSDEEP

6144:A3PNeTr97mhYdrkZ9NdlkPKUFfoYeErysLagemoP4V3L:EVlhZ9Vi5ewy8UQ

Score

10^/10

redline musor1 infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Musor1

79.137.197.136:23532

Attributes

auth_value
1a5194176f22f3833f172cb22889b471

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/228-277-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
4280	svcmgr.exe
4776	extra.exe
2128	jjmkw5gd.dx3.exe
4504	loader.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "C:\\Windows\\SvcManager\\svcnetwork.dll"	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe

Loads dropped DLL 1 IoCs

pid	Process
2128	jjmkw5gd.dx3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	svcmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	svcmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	svcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\WgaUtilAcc = "0"	svcmgr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3	svcmgr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8408FE5CA4467EE4DA84A76EF238FE3	svcmgr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 228	4776	extra.exe	85

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SvcManager\svcmgr.exe	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
File created	C:\Windows\SvcManager\svcnetwork.dll	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
File created	C:\Windows\SvcManager\svcnetwork.dat	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
File opened for modification	C:\Windows\SvcManager\temp	svcmgr.exe
File created	C:\Windows\SvcManager\temp\jjmkw5gd.dx3.exe	svcmgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
452	1460	WerFault.exe	66

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svcmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svcmgr.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	svcmgr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svcmgr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open\command	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open\command\ = "cmd.exe /C PowerShell -WindowStyle Hidden -Command \"& {Add-MpPreference -ExclusionPath C:\\Windows\\SvcManager\\}\""	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open\command	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell\open	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\ms-settings\shell	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c137e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5072	powershell.exe
5072	powershell.exe
5072	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe
4280	svcmgr.exe
4280	svcmgr.exe
2128	jjmkw5gd.dx3.exe
2128	jjmkw5gd.dx3.exe
2128	jjmkw5gd.dx3.exe
2128	jjmkw5gd.dx3.exe
2128	jjmkw5gd.dx3.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
4776	extra.exe
228	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5072	powershell.exe
Token: SeSecurityPrivilege	5072	powershell.exe
Token: SeTakeOwnershipPrivilege	5072	powershell.exe
Token: SeLoadDriverPrivilege	5072	powershell.exe
Token: SeSystemProfilePrivilege	5072	powershell.exe
Token: SeSystemtimePrivilege	5072	powershell.exe
Token: SeProfSingleProcessPrivilege	5072	powershell.exe
Token: SeIncBasePriorityPrivilege	5072	powershell.exe
Token: SeCreatePagefilePrivilege	5072	powershell.exe
Token: SeBackupPrivilege	5072	powershell.exe
Token: SeRestorePrivilege	5072	powershell.exe
Token: SeShutdownPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeSystemEnvironmentPrivilege	5072	powershell.exe
Token: SeRemoteShutdownPrivilege	5072	powershell.exe
Token: SeUndockPrivilege	5072	powershell.exe
Token: SeManageVolumePrivilege	5072	powershell.exe
Token: 33	5072	powershell.exe
Token: 34	5072	powershell.exe
Token: 35	5072	powershell.exe
Token: 36	5072	powershell.exe
Token: SeDebugPrivilege	4280	svcmgr.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeIncreaseQuotaPrivilege	724	powershell.exe
Token: SeSecurityPrivilege	724	powershell.exe
Token: SeTakeOwnershipPrivilege	724	powershell.exe
Token: SeLoadDriverPrivilege	724	powershell.exe
Token: SeSystemProfilePrivilege	724	powershell.exe
Token: SeSystemtimePrivilege	724	powershell.exe
Token: SeProfSingleProcessPrivilege	724	powershell.exe
Token: SeIncBasePriorityPrivilege	724	powershell.exe
Token: SeCreatePagefilePrivilege	724	powershell.exe
Token: SeBackupPrivilege	724	powershell.exe
Token: SeRestorePrivilege	724	powershell.exe
Token: SeShutdownPrivilege	724	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeSystemEnvironmentPrivilege	724	powershell.exe
Token: SeRemoteShutdownPrivilege	724	powershell.exe
Token: SeUndockPrivilege	724	powershell.exe
Token: SeManageVolumePrivilege	724	powershell.exe
Token: 33	724	powershell.exe
Token: 34	724	powershell.exe
Token: 35	724	powershell.exe
Token: 36	724	powershell.exe
Token: SeDebugPrivilege	4280	svcmgr.exe
Token: SeDebugPrivilege	2128	jjmkw5gd.dx3.exe
Token: SeDebugPrivilege	228	InstallUtil.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 4152	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	67
PID 1460 wrote to memory of 4152	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	67
PID 4152 wrote to memory of 5072	4152	cmd.exe	69
PID 4152 wrote to memory of 5072	4152	cmd.exe	69
PID 1460 wrote to memory of 4424	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	71
PID 1460 wrote to memory of 4424	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	71
PID 4424 wrote to memory of 4236	4424	cmd.exe	73
PID 4424 wrote to memory of 4236	4424	cmd.exe	73
PID 1460 wrote to memory of 1768	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	75
PID 1460 wrote to memory of 1768	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	75
PID 1768 wrote to memory of 724	1768	cmd.exe	77
PID 1768 wrote to memory of 724	1768	cmd.exe	77
PID 1460 wrote to memory of 4784	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	79
PID 1460 wrote to memory of 4784	1460	7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe	79
PID 4784 wrote to memory of 4776	4784	cmd.exe	81
PID 4784 wrote to memory of 4776	4784	cmd.exe	81
PID 4784 wrote to memory of 4776	4784	cmd.exe	81
PID 4280 wrote to memory of 2128	4280	svcmgr.exe	84
PID 4280 wrote to memory of 2128	4280	svcmgr.exe	84
PID 4776 wrote to memory of 228	4776	extra.exe	85
PID 4776 wrote to memory of 228	4776	extra.exe	85
PID 4776 wrote to memory of 228	4776	extra.exe	85
PID 4776 wrote to memory of 228	4776	extra.exe	85
PID 4776 wrote to memory of 228	4776	extra.exe	85
PID 228 wrote to memory of 4504	228	InstallUtil.exe	86
PID 228 wrote to memory of 4504	228	InstallUtil.exe	86

C:\Users\Admin\AppData\Local\Temp\7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe
"C:\Users\Admin\AppData\Local\Temp\7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c start computerdefaults.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\ComputerDefaults.exe
    computerdefaults.exe
    3⤵
    PID:4236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\\extra.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\extra.exe
    C:\Users\Admin\AppData\Local\Temp\\extra.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        5⤵
        Executes dropped EXE
        
        PID:4504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1460 -s 2240
  2⤵
  - Program crash
  PID:452

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\SvcManager\temp\jjmkw5gd.dx3.exe
  C:\Windows\SvcManager\temp\jjmkw5gd.dx3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9aefa22dfba5a7c309ebb8f763719210

SHA1
8ea34443089b782f672e34455a8f3efd0b5aaa43

SHA256
eac2b20c59d77b6d7efac0321198e6a62d6ecc61688540a2221a9c92586d7fc1

SHA512
289aada75790823470251bd1b8edfcf2d367147197db41d962fcdfc82002dfea6e7323816383cff28d6e44203e05a334fa1cd9ea2c5853446ba33d9357216c60

Download Submit
C:\Users\Admin\AppData\Local\Temp\extra.exe

Filesize
1.6MB

MD5
9b76d1b65cff171553608bf5bd25bbcc

SHA1
7c8e793a321b1cb987bab3821113a1a22b772e2a

SHA256
7038e912edcd2a564740ff77fefcacfc155a5ede690876dad14ea3d2fcec1828

SHA512
6c0094c30aa849a819679751129079bd9c3e92b2ac6253ba2a4dc37f9cbfeb956023b775b6650f2780ce5fc15b5824080eb2735c8cdc66971c8e5e779ce1290f

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
201KB

MD5
25c1edf6b6614bcd7b2bb069ce43da3c

SHA1
3c908bc6da3c488b4db676d7b142714355122dc4

SHA256
7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06

SHA512
fed4eabc05c462bb0b41f8e6748960de036a7664b5055574a0c942ffc54f19752e8de767454f0d127395574e4aa0d8bc2492cd77d23b40ee461937e60c8c8e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
201KB

MD5
25c1edf6b6614bcd7b2bb069ce43da3c

SHA1
3c908bc6da3c488b4db676d7b142714355122dc4

SHA256
7487dbc7ed6e93df4ec39b16c466c5c7e80f914a9b6fac9d1efad4002223cb06

SHA512
fed4eabc05c462bb0b41f8e6748960de036a7664b5055574a0c942ffc54f19752e8de767454f0d127395574e4aa0d8bc2492cd77d23b40ee461937e60c8c8e9f

Download Submit
C:\Windows\SvcManager\svcmgr.exe

Filesize
838KB

MD5
3c8f0f1f14d9688fe72f2f56a71b6e3e

SHA1
effe2f91636b91c1b66e0faa1cdfcbb481139d0d

SHA256
b7d1a21d5532377d4e4b1a69c7fa1c33c3ced4b6027a3f4b631a0efa87845594

SHA512
c4b399e29c81f93ab8d99838f03cb1e9255eae7e792f45fa3a629e0d5244663f114593b2240f6119f62eafada3edeae02b4376fa891f57abd5fbde32b28efb92

Download Submit
C:\Windows\SvcManager\svcmgr.exe

Filesize
838KB

MD5
3c8f0f1f14d9688fe72f2f56a71b6e3e

SHA1
effe2f91636b91c1b66e0faa1cdfcbb481139d0d

SHA256
b7d1a21d5532377d4e4b1a69c7fa1c33c3ced4b6027a3f4b631a0efa87845594

SHA512
c4b399e29c81f93ab8d99838f03cb1e9255eae7e792f45fa3a629e0d5244663f114593b2240f6119f62eafada3edeae02b4376fa891f57abd5fbde32b28efb92

Download Submit
C:\Windows\SvcManager\temp\jjmkw5gd.dx3.exe

Filesize
2.4MB

MD5
ab1460e448aa43b3b7e525e5bc762b3b

SHA1
b89b91a82189ca5244ae3de2237a674764201c79

SHA256
ecac99a7534cb8297afefb3fb4d584d90782793450de197cdaa1d21d70f1bf67

SHA512
62c38b457d4f09da73e639b6b3e007e17bf08f52d4cdca953a2c4c92e65745b538669901a9f3587051968aea5f2ed863ba180d455d7d00816874d6ec56162ed9

Download Submit
C:\Windows\SvcManager\temp\jjmkw5gd.dx3.exe

Filesize
2.4MB

MD5
ab1460e448aa43b3b7e525e5bc762b3b

SHA1
b89b91a82189ca5244ae3de2237a674764201c79

SHA256
ecac99a7534cb8297afefb3fb4d584d90782793450de197cdaa1d21d70f1bf67

SHA512
62c38b457d4f09da73e639b6b3e007e17bf08f52d4cdca953a2c4c92e65745b538669901a9f3587051968aea5f2ed863ba180d455d7d00816874d6ec56162ed9

Download Submit
\Users\Admin\AppData\Local\Temp\7d388e326c584c349f2441bf5ad8f145\SQLite.Interop.dll

Filesize
1.7MB

MD5
1288823e8e1fca09bb490ce46988188d

SHA1
b07fe4a5d032296e3a7d0727216af8c1d2166e91

SHA256
6514973856d1767ccb375dcb253400e710fb4f91feb758041d8defe92b1886c5

SHA512
88967f64116951092a54118055eab462082f16676ea7565f42515e88765813b53cdfbba5181318e73b668e04ddd030a0bfcf5cf47936772f68df85488b865acd

Download Submit
memory/228-280-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-329-0x00000000058E0000-0x0000000005EE6000-memory.dmp

Filesize
6.0MB

Download
memory/228-275-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/228-277-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/228-278-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-279-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-281-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-282-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-361-0x0000000006FE0000-0x0000000007030000-memory.dmp

Filesize
320KB

Download
memory/228-360-0x0000000007060000-0x00000000070D6000-memory.dmp

Filesize
472KB

Download
memory/228-283-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-356-0x0000000007EF0000-0x000000000841C000-memory.dmp

Filesize
5.2MB

Download
memory/228-355-0x00000000077F0000-0x00000000079B2000-memory.dmp

Filesize
1.8MB

Download
memory/228-344-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/228-341-0x00000000056F0000-0x0000000005782000-memory.dmp

Filesize
584KB

Download
memory/228-340-0x00000000063F0000-0x00000000068EE000-memory.dmp

Filesize
5.0MB

Download
memory/228-336-0x0000000005510000-0x000000000555B000-memory.dmp

Filesize
300KB

Download
memory/228-334-0x0000000005390000-0x00000000053CE000-memory.dmp

Filesize
248KB

Download
memory/228-284-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-332-0x0000000005330000-0x0000000005342000-memory.dmp

Filesize
72KB

Download
memory/228-330-0x0000000005400000-0x000000000550A000-memory.dmp

Filesize
1.0MB

Download
memory/228-285-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-287-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/228-286-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/1460-120-0x0000020E2C280000-0x0000020E2C2B8000-memory.dmp

Filesize
224KB

Download
memory/2128-246-0x00000225D5240000-0x00000225D52F0000-memory.dmp

Filesize
704KB

Download
memory/2128-248-0x00000225D53C0000-0x00000225D5410000-memory.dmp

Filesize
320KB

Download
memory/2128-243-0x00000225BAC30000-0x00000225BAE90000-memory.dmp

Filesize
2.4MB

Download
memory/2128-247-0x00000225D5300000-0x00000225D5364000-memory.dmp

Filesize
400KB

Download
memory/2128-251-0x00000225D5410000-0x00000225D5435000-memory.dmp

Filesize
148KB

Download
memory/2128-250-0x00000225D5450000-0x00000225D548A000-memory.dmp

Filesize
232KB

Download
memory/2128-249-0x00000225BCA20000-0x00000225BCA3E000-memory.dmp

Filesize
120KB

Download
memory/4280-163-0x00000161C6A40000-0x00000161C6A88000-memory.dmp

Filesize
288KB

Download
memory/4280-203-0x00000161C7440000-0x00000161C7966000-memory.dmp

Filesize
5.1MB

Download
memory/4280-202-0x00000161C6EC0000-0x00000161C6F0A000-memory.dmp

Filesize
296KB

Download
memory/4280-172-0x00000161C6B90000-0x00000161C6C40000-memory.dmp

Filesize
704KB

Download
memory/4280-162-0x00000161AD6B0000-0x00000161AD788000-memory.dmp

Filesize
864KB

Download
memory/4776-214-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-271-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-237-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-244-0x0000000002670000-0x0000000002F9D000-memory.dmp

Filesize
9.2MB

Download
memory/4776-236-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-235-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-233-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-234-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-232-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-231-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-230-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-253-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-254-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-256-0x0000000002670000-0x0000000002F9D000-memory.dmp

Filesize
9.2MB

Download
memory/4776-255-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-258-0x0000000002490000-0x000000000261B000-memory.dmp

Filesize
1.5MB

Download
memory/4776-257-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-259-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-260-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-261-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-262-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-263-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-264-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-265-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-266-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-267-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-268-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-269-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-270-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-238-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-272-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-273-0x000000000FBE0000-0x000000000FD75000-memory.dmp

Filesize
1.6MB

Download
memory/4776-274-0x000000000FBE0000-0x000000000FD75000-memory.dmp

Filesize
1.6MB

Download
memory/4776-229-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-228-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-227-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-226-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-225-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-224-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-223-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-222-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-221-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-220-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-219-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-218-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-217-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-216-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-215-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-213-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-212-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-211-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-210-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-209-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-208-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/4776-207-0x0000000077AA0000-0x0000000077C2E000-memory.dmp

Filesize
1.6MB

Download
memory/5072-130-0x000001436E4E0000-0x000001436E556000-memory.dmp

Filesize
472KB

Download
memory/5072-127-0x000001436E330000-0x000001436E352000-memory.dmp

Filesize
136KB

Download