djvu | 70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870

Analysis

max time kernel
73s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
Size

334KB
MD5

1fbdb1063b832e6529118d4ab7e66971
SHA1

71939c038fb724e76418b63780cda1d5736d6133
SHA256

70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870
SHA512

cc40ef6f27fd8a7305380a38bbed3810e2309cd751d94e565841311e7947b2a20a21aac94ac0ae244e2a13437a08f2c839b2034aea449043f81f14079e6d4d3d
SSDEEP

6144:KvYRQ7LkpgYXd3mWZc1GH55OV0iPvzpQ6ijLxQFiaI:47cgM4GcA55QxnzpQ6ijqF

Score

10^/10

djvu raccoon redline smokeloader ec7a54fb6492ff3a52d09504b8ecf082 mario23_10 backdoor bootkit collection discovery infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

mario23_10

167.235.252.160:10642

Attributes

auth_value
eca57cfb5172f71dc45986763bb98942

Extracted

Family

djvu

http://abibiall.com/lancer/get.php

Attributes

extension
.bttu
offline_id
8p2Go5ZmkbFk0DF2oJ6E8vGEogpBqqaGCWjto1t1
payload_url
http://uaery.top/dl/build2.exe
http://abibiall.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0619JOsie

rsa_pubkey.plain

Extracted

Family

raccoon

Botnet

ec7a54fb6492ff3a52d09504b8ecf082

http://88.119.161.188

http://88.119.161.19

rc4.plain

Signatures

Detected Djvu ransomware 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2380-185-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2380-188-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2380-190-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3148-191-0x0000000002250000-0x000000000236B000-memory.dmp	family_djvu
behavioral1/memory/2380-200-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2380-231-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4260-241-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4260-243-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4260-248-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2340-133-0x00000000006B0000-0x00000000006B9000-memory.dmp	family_smokeloader
behavioral1/memory/2096-178-0x00000000005A0000-0x00000000005A9000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3708-145-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/2272-154-0x0000000000D00000-0x0000000000D69000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 10 IoCs

Processes:

B115.exeB21F.exeB368.exeB696.exeB8BA.exeBBD8.exeC36A.exeBBD8.exeBBD8.exeBBD8.exe

pid process

220 B115.exe
2272 B21F.exe
2632 B368.exe
2096 B696.exe
2636 B8BA.exe
3148 BBD8.exe
2264 C36A.exe
2380 BBD8.exe
3824 BBD8.exe
4260 BBD8.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

BBD8.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation BBD8.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

4292 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
220	B115.exe
2272	B21F.exe
2632	B368.exe
2096	B696.exe
2636	B8BA.exe
3148	BBD8.exe
2264	C36A.exe
2380	BBD8.exe
3824	BBD8.exe
4260	BBD8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	BBD8.exe

pid	process
4292	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BBD8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ebdecb6b-f5b6-4fd0-ac27-cca04c6f2d16\\BBD8.exe\" --AutoStart"	BBD8.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.2ip.ua
29 api.2ip.ua
43 api.2ip.ua
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

B368.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 B368.exe

flow	ioc
28	api.2ip.ua
29	api.2ip.ua
43	api.2ip.ua

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	B368.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

B21F.exeBBD8.exeB115.exeBBD8.exe

description	pid	process	target process
PID 2272 set thread context of 3708	2272	B21F.exe	AppLaunch.exe
PID 3148 set thread context of 2380	3148	BBD8.exe	BBD8.exe
PID 220 set thread context of 4572	220	B115.exe	InstallUtil.exe
PID 3824 set thread context of 4260	3824	BBD8.exe	BBD8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4000 2272 WerFault.exe B21F.exe
4844 2636 WerFault.exe B8BA.exe

pid	pid_target	process	target process
4000	2272	WerFault.exe	B21F.exe
4844	2636	WerFault.exe	B8BA.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

B696.exe70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B696.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B696.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe

pid	process
2340	70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
2340	70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572
2572

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exeB696.exe

pid process

2340 70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
2572
2572
2572
2572
2096 B696.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

B115.exewmic.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeDebugPrivilege	220	B115.exe
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeIncreaseQuotaPrivilege	4056	wmic.exe
Token: SeSecurityPrivilege	4056	wmic.exe
Token: SeTakeOwnershipPrivilege	4056	wmic.exe
Token: SeLoadDriverPrivilege	4056	wmic.exe
Token: SeSystemProfilePrivilege	4056	wmic.exe
Token: SeSystemtimePrivilege	4056	wmic.exe
Token: SeProfSingleProcessPrivilege	4056	wmic.exe
Token: SeIncBasePriorityPrivilege	4056	wmic.exe
Token: SeCreatePagefilePrivilege	4056	wmic.exe
Token: SeBackupPrivilege	4056	wmic.exe
Token: SeRestorePrivilege	4056	wmic.exe
Token: SeShutdownPrivilege	4056	wmic.exe
Token: SeDebugPrivilege	4056	wmic.exe
Token: SeSystemEnvironmentPrivilege	4056	wmic.exe
Token: SeRemoteShutdownPrivilege	4056	wmic.exe
Token: SeUndockPrivilege	4056	wmic.exe
Token: SeManageVolumePrivilege	4056	wmic.exe
Token: 33	4056	wmic.exe
Token: 34	4056	wmic.exe
Token: 35	4056	wmic.exe
Token: 36	4056	wmic.exe
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeIncreaseQuotaPrivilege	4056	wmic.exe
Token: SeSecurityPrivilege	4056	wmic.exe
Token: SeTakeOwnershipPrivilege	4056	wmic.exe
Token: SeLoadDriverPrivilege	4056	wmic.exe
Token: SeSystemProfilePrivilege	4056	wmic.exe
Token: SeSystemtimePrivilege	4056	wmic.exe
Token: SeProfSingleProcessPrivilege	4056	wmic.exe
Token: SeIncBasePriorityPrivilege	4056	wmic.exe
Token: SeCreatePagefilePrivilege	4056	wmic.exe
Token: SeBackupPrivilege	4056	wmic.exe
Token: SeRestorePrivilege	4056	wmic.exe
Token: SeShutdownPrivilege	4056	wmic.exe
Token: SeDebugPrivilege	4056	wmic.exe
Token: SeSystemEnvironmentPrivilege	4056	wmic.exe
Token: SeRemoteShutdownPrivilege	4056	wmic.exe
Token: SeUndockPrivilege	4056	wmic.exe
Token: SeManageVolumePrivilege	4056	wmic.exe
Token: 33	4056	wmic.exe
Token: 34	4056	wmic.exe
Token: 35	4056	wmic.exe
Token: 36	4056	wmic.exe
Token: SeShutdownPrivilege	2572
Token: SeCreatePagefilePrivilege	2572
Token: SeIncreaseQuotaPrivilege	4820	WMIC.exe
Token: SeSecurityPrivilege	4820	WMIC.exe
Token: SeTakeOwnershipPrivilege	4820	WMIC.exe
Token: SeLoadDriverPrivilege	4820	WMIC.exe
Token: SeSystemProfilePrivilege	4820	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

B21F.exeC36A.exeBBD8.exeB115.execmd.exeBBD8.execmd.exe

description	pid	process	target process
PID 2572 wrote to memory of 220	2572		B115.exe
PID 2572 wrote to memory of 220	2572		B115.exe
PID 2572 wrote to memory of 2272	2572		B21F.exe
PID 2572 wrote to memory of 2272	2572		B21F.exe
PID 2572 wrote to memory of 2272	2572		B21F.exe
PID 2272 wrote to memory of 3708	2272	B21F.exe	AppLaunch.exe
PID 2272 wrote to memory of 3708	2272	B21F.exe	AppLaunch.exe
PID 2272 wrote to memory of 3708	2272	B21F.exe	AppLaunch.exe
PID 2272 wrote to memory of 3708	2272	B21F.exe	AppLaunch.exe
PID 2572 wrote to memory of 2632	2572		B368.exe
PID 2572 wrote to memory of 2632	2572		B368.exe
PID 2572 wrote to memory of 2632	2572		B368.exe
PID 2272 wrote to memory of 3708	2272	B21F.exe	AppLaunch.exe
PID 2572 wrote to memory of 2096	2572		B696.exe
PID 2572 wrote to memory of 2096	2572		B696.exe
PID 2572 wrote to memory of 2096	2572		B696.exe
PID 2572 wrote to memory of 2636	2572		B8BA.exe
PID 2572 wrote to memory of 2636	2572		B8BA.exe
PID 2572 wrote to memory of 2636	2572		B8BA.exe
PID 2572 wrote to memory of 3148	2572		BBD8.exe
PID 2572 wrote to memory of 3148	2572		BBD8.exe
PID 2572 wrote to memory of 3148	2572		BBD8.exe
PID 2572 wrote to memory of 2264	2572		C36A.exe
PID 2572 wrote to memory of 2264	2572		C36A.exe
PID 2572 wrote to memory of 3800	2572		explorer.exe
PID 2572 wrote to memory of 3800	2572		explorer.exe
PID 2572 wrote to memory of 3800	2572		explorer.exe
PID 2572 wrote to memory of 3800	2572		explorer.exe
PID 2572 wrote to memory of 428	2572		explorer.exe
PID 2572 wrote to memory of 428	2572		explorer.exe
PID 2572 wrote to memory of 428	2572		explorer.exe
PID 2264 wrote to memory of 4056	2264	C36A.exe	wmic.exe
PID 2264 wrote to memory of 4056	2264	C36A.exe	wmic.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 3148 wrote to memory of 2380	3148	BBD8.exe	BBD8.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 220 wrote to memory of 4572	220	B115.exe	InstallUtil.exe
PID 2264 wrote to memory of 1392	2264	C36A.exe	cmd.exe
PID 2264 wrote to memory of 1392	2264	C36A.exe	cmd.exe
PID 1392 wrote to memory of 4820	1392	cmd.exe	WMIC.exe
PID 1392 wrote to memory of 4820	1392	cmd.exe	WMIC.exe
PID 2380 wrote to memory of 4292	2380	BBD8.exe	icacls.exe
PID 2380 wrote to memory of 4292	2380	BBD8.exe	icacls.exe
PID 2380 wrote to memory of 4292	2380	BBD8.exe	icacls.exe
PID 2264 wrote to memory of 1416	2264	C36A.exe	cmd.exe
PID 2264 wrote to memory of 1416	2264	C36A.exe	cmd.exe
PID 1416 wrote to memory of 1708	1416	cmd.exe	WMIC.exe
PID 1416 wrote to memory of 1708	1416	cmd.exe	WMIC.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe
"C:\Users\Admin\AppData\Local\Temp\70e846a262cb9f34098394ea08353429c59ae387d83d7999c8b440401361a870.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2340

C:\Users\Admin\AppData\Local\Temp\B115.exe
C:\Users\Admin\AppData\Local\Temp\B115.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\B21F.exe
C:\Users\Admin\AppData\Local\Temp\B21F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 140
2⤵
- Program crash
PID:4000

C:\Users\Admin\AppData\Local\Temp\B368.exe
C:\Users\Admin\AppData\Local\Temp\B368.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2272 -ip 2272
1⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\B696.exe
C:\Users\Admin\AppData\Local\Temp\B696.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2096

C:\Users\Admin\AppData\Local\Temp\B8BA.exe
C:\Users\Admin\AppData\Local\Temp\B8BA.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 340
2⤵
- Program crash
PID:4844

C:\Users\Admin\AppData\Local\Temp\BBD8.exe
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\BBD8.exe
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\ebdecb6b-f5b6-4fd0-ac27-cca04c6f2d16" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4292

C:\Users\Admin\AppData\Local\Temp\BBD8.exe
"C:\Users\Admin\AppData\Local\Temp\BBD8.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3824

C:\Users\Admin\AppData\Local\Temp\BBD8.exe
"C:\Users\Admin\AppData\Local\Temp\BBD8.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
PID:4260

C:\Users\Admin\AppData\Local\Temp\C36A.exe
C:\Users\Admin\AppData\Local\Temp\C36A.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:1708

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3800

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2636 -ip 2636
1⤵
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
602cebd424613d514b439fe78f14a48d

SHA1
d5d7580e513e9b4af91e1a8bcdd5401ab98636f6

SHA256
29fabef3eb6d67f8ff9b015375b8fa6b6bced5e8c1651f2199fcb183f33578aa

SHA512
fb2cda553e81eee089a166a0da126f9b4cff2ce5dba999ea87a4bfd1d396198f93e17391f408b2b5fa76e5a021717c4c349dede102e3e7eb1f51b44d407cb8b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
13ed5d9cdfe44b69986cdcda2709fae4

SHA1
6f1ac25238f31888d91eda34e7b2dd92a4f379db

SHA256
c19bb0d55abcc511665e003cb64e5900a9a93dea9e6a8261356ea9f7f02d8126

SHA512
8b34e9dea82332ad2098fe1fdc24f9be1c2722b07d6c8427c4b8348b5dd014780933b369bdf97408e473d84259925c4427a005e86df3a83bd9cae3a93d5f3982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
eff2316d0be5cd830817a9d0caba41ab

SHA1
4b3d6bff74d686260f569580a83306b5bd980549

SHA256
8e0a80b5e83889fbae63e467eca0b5c5734cbe78fbbb9614555e1e68efb86925

SHA512
26c94e6dad991561030e257677e2b2bc743aaa6ea7570e7d102bfddf5324b8926467d96a4c71eb0c62171b54e7b2b029e6df37351ce663adf23a6332ec82b6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
3e9bcdd59daa43c9a01185a3fbba2918

SHA1
3760561272280232e50aa1c97c70757ebc3faff0

SHA256
88a782d183e050da344a7e8427e9cc56c533bb224066d6f2d2f4bc937af3cfe0

SHA512
1e97c311141728bb46ff488c03a9da36bfad5887d062b9988a90d8e6a828a4f58a54f341d4651d8540488ab0afa069d14321a590b2847882f7f2fcda7de92f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\B115.exe
Filesize
588KB

MD5
9bb6fc051ce66030059a1c1123b13cca

SHA1
8731879c637aacaf09c38fc3893d44b626907971

SHA256
2e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f

SHA512
bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\B115.exe
Filesize
588KB

MD5
9bb6fc051ce66030059a1c1123b13cca

SHA1
8731879c637aacaf09c38fc3893d44b626907971

SHA256
2e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f

SHA512
bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\B21F.exe
Filesize
408KB

MD5
98552eb4257cb3f0cc646bc48cca07f3

SHA1
2a86d8f2bcc25f11f5d3e79bf90afbbca6aeb782

SHA256
e475a91abd7ac9518100aa7e934399f81bff275d70a84295aa43f0134d6aa6bf

SHA512
277a384a70d51e88762254fa6fa213705279cdb6799f666646fec35200b946303b0503523bfd7bf7dd362b6a370a6ec67a748ffbcbb7e15c3a080d6ce1fd2da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B21F.exe
Filesize
408KB

MD5
98552eb4257cb3f0cc646bc48cca07f3

SHA1
2a86d8f2bcc25f11f5d3e79bf90afbbca6aeb782

SHA256
e475a91abd7ac9518100aa7e934399f81bff275d70a84295aa43f0134d6aa6bf

SHA512
277a384a70d51e88762254fa6fa213705279cdb6799f666646fec35200b946303b0503523bfd7bf7dd362b6a370a6ec67a748ffbcbb7e15c3a080d6ce1fd2da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B368.exe
Filesize
552KB

MD5
27503351226b133437242663d8f339a3

SHA1
97baa24723a0eae9c9926839332e057e76c77013

SHA256
d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe

SHA512
527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B368.exe
Filesize
552KB

MD5
27503351226b133437242663d8f339a3

SHA1
97baa24723a0eae9c9926839332e057e76c77013

SHA256
d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe

SHA512
527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B696.exe
Filesize
334KB

MD5
480f56163f8ffe25920ed6fa4d288716

SHA1
febe21af00720c0bfa2523fd89978974b65442b7

SHA256
08cf85c4162adda30bee63dc591f658bfed4d825a92341821685b58bfd962c00

SHA512
eba32290c3c1bdabb9b0af181719cdc5b5acf293b2ae9d9f91003708a3e1b2b19f02cc15c8b23e348c60bb0e47e326894efa86bd3b0d842bd014fd84c4dc3a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\B696.exe
Filesize
334KB

MD5
480f56163f8ffe25920ed6fa4d288716

SHA1
febe21af00720c0bfa2523fd89978974b65442b7

SHA256
08cf85c4162adda30bee63dc591f658bfed4d825a92341821685b58bfd962c00

SHA512
eba32290c3c1bdabb9b0af181719cdc5b5acf293b2ae9d9f91003708a3e1b2b19f02cc15c8b23e348c60bb0e47e326894efa86bd3b0d842bd014fd84c4dc3a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\B8BA.exe
Filesize
326KB

MD5
5e273c316a7ac41b5aaba3b1ae9e1a42

SHA1
c9116f50adead9d7d073e156059ac2e536b1c8c5

SHA256
34e0b9c82724b2189b7892530388a77c6ac83ba46cbea73d842c3604b52e4929

SHA512
e905e4637ef5bbfddb68608f537464ac2676318e5696ab6014eefb2a5d56fc88c01b344c2014dbda1ad62a9ad3360c71cc5b8b5e28a021a5b9285d841f7acf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\B8BA.exe
Filesize
326KB

MD5
5e273c316a7ac41b5aaba3b1ae9e1a42

SHA1
c9116f50adead9d7d073e156059ac2e536b1c8c5

SHA256
34e0b9c82724b2189b7892530388a77c6ac83ba46cbea73d842c3604b52e4929

SHA512
e905e4637ef5bbfddb68608f537464ac2676318e5696ab6014eefb2a5d56fc88c01b344c2014dbda1ad62a9ad3360c71cc5b8b5e28a021a5b9285d841f7acf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\C36A.exe
Filesize
3.0MB

MD5
d5b603260c623ff7fc4024e7ecb2200d

SHA1
7be59515bf53f21717b95777558c8c45b4bee1bb

SHA256
f5b28c24c679be9c30458a15efc7e2f22b4eaa535ded0fb7ee53c25fd9eabd41

SHA512
6c5494fe2e6688b7be0a41d3787e7608fa5ea0c4cd50b14e1c17d27ba5aefe701cb774ba291990916e0608f8afdedabbddbc4d2016e6895e0e58c90b6c156489

Download Submit
C:\Users\Admin\AppData\Local\Temp\C36A.exe
Filesize
3.0MB

MD5
d5b603260c623ff7fc4024e7ecb2200d

SHA1
7be59515bf53f21717b95777558c8c45b4bee1bb

SHA256
f5b28c24c679be9c30458a15efc7e2f22b4eaa535ded0fb7ee53c25fd9eabd41

SHA512
6c5494fe2e6688b7be0a41d3787e7608fa5ea0c4cd50b14e1c17d27ba5aefe701cb774ba291990916e0608f8afdedabbddbc4d2016e6895e0e58c90b6c156489

Download Submit
C:\Users\Admin\AppData\Local\ebdecb6b-f5b6-4fd0-ac27-cca04c6f2d16\BBD8.exe
Filesize
827KB

MD5
cca94bf467754e3a015e85722243ad29

SHA1
dba82f9ae36f2b33bf39254f407cab7cccc43864

SHA256
cb7b57dc35075060052b45cb95352c84da19240e64ceb9a432726887e55847b2

SHA512
28e07f83064288535ce67eaf2276f84e2c3075e4b0f2c3886da983b154b1fd893a92a0515bf03e2e7001f33bf0ca8d06d68c138baa652ff06fcbb93b92175a1e

Download Submit
memory/220-143-0x00007FFED8D30000-0x00007FFED97F1000-memory.dmp

Filesize
10.8MB

Download
memory/220-197-0x00007FFED8D30000-0x00007FFED97F1000-memory.dmp

Filesize
10.8MB

Download
memory/220-136-0x0000000000000000-mapping.dmp

Download
memory/220-139-0x000001B934E10000-0x000001B934EA6000-memory.dmp

Filesize
600KB

Download
memory/428-175-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Filesize
48KB

Download
memory/428-173-0x0000000000000000-mapping.dmp

Download
memory/1392-199-0x0000000000000000-mapping.dmp

Download
memory/1416-205-0x0000000000000000-mapping.dmp

Download
memory/1708-210-0x0000000000000000-mapping.dmp

Download
memory/2096-153-0x0000000000000000-mapping.dmp

Download
memory/2096-236-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2096-182-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2096-178-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/2096-177-0x00000000007A9000-0x00000000007BF000-memory.dmp

Filesize
88KB

Download
memory/2264-167-0x0000000000000000-mapping.dmp

Download
memory/2272-154-0x0000000000D00000-0x0000000000D69000-memory.dmp

Filesize
420KB

Download
memory/2272-140-0x0000000000000000-mapping.dmp

Download
memory/2340-135-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2340-132-0x00000000006D8000-0x00000000006EE000-memory.dmp

Filesize
88KB

Download
memory/2340-133-0x00000000006B0000-0x00000000006B9000-memory.dmp

Filesize
36KB

Download
memory/2340-134-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2380-200-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2380-188-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2380-231-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2380-183-0x0000000000000000-mapping.dmp

Download
memory/2380-185-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2380-190-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2572-218-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-234-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/2572-237-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-232-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-235-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-223-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-227-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/2572-229-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-228-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-225-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-226-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-224-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/2572-222-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-220-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-217-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-214-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-216-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-212-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-211-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-208-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2572-206-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/2632-181-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2632-180-0x00000000007F0000-0x000000000085B000-memory.dmp

Filesize
428KB

Download
memory/2632-179-0x00000000004E3000-0x0000000000544000-memory.dmp

Filesize
388KB

Download
memory/2632-146-0x0000000000000000-mapping.dmp

Download
memory/2632-174-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2636-186-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2636-184-0x0000000000539000-0x000000000054E000-memory.dmp

Filesize
84KB

Download
memory/2636-157-0x0000000000000000-mapping.dmp

Download
memory/3148-163-0x0000000000000000-mapping.dmp

Download
memory/3148-189-0x0000000001FD3000-0x0000000002065000-memory.dmp

Filesize
584KB

Download
memory/3148-191-0x0000000002250000-0x000000000236B000-memory.dmp

Filesize
1.1MB

Download
memory/3708-144-0x0000000000000000-mapping.dmp

Download
memory/3708-207-0x0000000006920000-0x0000000006EC4000-memory.dmp

Filesize
5.6MB

Download
memory/3708-215-0x0000000008AF0000-0x000000000901C000-memory.dmp

Filesize
5.2MB

Download
memory/3708-158-0x0000000005860000-0x0000000005E78000-memory.dmp

Filesize
6.1MB

Download
memory/3708-145-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3708-213-0x00000000065E0000-0x00000000067A2000-memory.dmp

Filesize
1.8MB

Download
memory/3708-161-0x0000000005390000-0x000000000549A000-memory.dmp

Filesize
1.0MB

Download
memory/3708-162-0x00000000052A0000-0x00000000052B2000-memory.dmp

Filesize
72KB

Download
memory/3708-164-0x0000000005300000-0x000000000533C000-memory.dmp

Filesize
240KB

Download
memory/3708-204-0x0000000005610000-0x0000000005676000-memory.dmp

Filesize
408KB

Download
memory/3708-209-0x0000000006370000-0x0000000006402000-memory.dmp

Filesize
584KB

Download
memory/3800-171-0x0000000000920000-0x0000000000995000-memory.dmp

Filesize
468KB

Download
memory/3800-172-0x00000000008B0000-0x000000000091B000-memory.dmp

Filesize
428KB

Download
memory/3800-192-0x00000000008B0000-0x000000000091B000-memory.dmp

Filesize
428KB

Download
memory/3800-170-0x0000000000000000-mapping.dmp

Download
memory/3824-230-0x0000000000000000-mapping.dmp

Download
memory/3824-242-0x0000000001FCC000-0x000000000205E000-memory.dmp

Filesize
584KB

Download
memory/4056-176-0x0000000000000000-mapping.dmp

Download
memory/4260-238-0x0000000000000000-mapping.dmp

Download
memory/4260-241-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4260-243-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4260-248-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4292-202-0x0000000000000000-mapping.dmp

Download
memory/4572-193-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4572-194-0x000000000040779C-mapping.dmp

Download
memory/4572-196-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4572-198-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4820-201-0x0000000000000000-mapping.dmp

Download