redline | f62e04bed2383a126445fe9cfd4671a649cb162069b712da592a8cb300f7e0fe

Analysis

max time kernel
207s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Eulen.Menu.by.1msorry.rar
Size

2.3MB
MD5

0fb5fbf947ce20a5b1a78327d7b3533b
SHA1

2b988ef70d4b6c2b2c4b22600366d9ce1ce9565c
SHA256

f62e04bed2383a126445fe9cfd4671a649cb162069b712da592a8cb300f7e0fe
SHA512

30256b1aaf06f93bbc80b16559f1ee20c7f47dac0440a90bff8fd4e501366b5d8a712d74858fddb01ced5752ce7a1a285a6c41a7142da1f96412ce99c767f2fa
SSDEEP

49152:ahBpu25Y5Nt7n2nX99a7vUP3MwCc3G4VEfYmqY4pvPqCjtnUlHbDPVBp3fc:y8j57SN9aQBG2hY4p3T5WE

Score

10^/10

redline spoofer discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

SPOOFER

20.197.226.40:32619

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1988-162-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

Loader.exelicense.exelicense.exeUpdater.exeUpdater.exeUpdater.exeUpdater.exe

pid process

4432 Loader.exe
3940 license.exe
1988 license.exe
3816 Updater.exe
2460 Updater.exe
1620 Updater.exe
3740 Updater.exe

pid	process
4432	Loader.exe
3940	license.exe
1988	license.exe
3816	Updater.exe
2460	Updater.exe
1620	Updater.exe
3740	Updater.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

license.exelicense.exeUpdater.exeUpdater.exeUpdater.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	license.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	license.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Updater.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

Processes:

license.exeUpdater.exeUpdater.exe

description	pid	process	target process
PID 3940 set thread context of 1988	3940	license.exe	license.exe
PID 3816 set thread context of 2460	3816	Updater.exe	Updater.exe
PID 1620 set thread context of 3740	1620	Updater.exe	Updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Applications\7z.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Applications\7z.exe	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\\ = "rar_auto_file"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002155d75a1000372d5a6970003c0009000400efbe2155d75a2155d75a2e0000009e23020000000f0000000000000000000000000000009ca4570037002d005a0069007000000014000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Applications\7z.exe\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\tFolderﹿ鬀蠀臨媈翼\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\ࢰ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.rar	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Applications\7z.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000021557d5b110050524f4752417e310000740009000400efbe874fdb4921557d5b2e0000003f0000000000010000000000000000004a000000000057010700500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Applications\7z.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\rar_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\rar_auto_file\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\ࢰ\ = "rar_auto_file"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exelicense.exepowershell.exeUpdater.exepowershell.exepowershell.exeUpdater.exe

pid	process
552	powershell.exe
552	powershell.exe
1308	powershell.exe
1308	powershell.exe
4840	powershell.exe
4840	powershell.exe
1988	license.exe
1988	license.exe
1512	powershell.exe
1512	powershell.exe
3816	Updater.exe
3760	powershell.exe
3760	powershell.exe
4048	powershell.exe
4048	powershell.exe
1620	Updater.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

2324 OpenWith.exe
3384 7zFM.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

7z.exe7zFM.exepowershell.exepowershell.exelicense.exepowershell.exelicense.exepowershell.exeUpdater.exeUpdater.exepowershell.exepowershell.exeUpdater.exeUpdater.exe

description	pid	process
Token: SeRestorePrivilege	944	7z.exe
Token: 35	944	7z.exe
Token: SeRestorePrivilege	3384	7zFM.exe
Token: 35	3384	7zFM.exe
Token: SeSecurityPrivilege	3384	7zFM.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	3940	license.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	1988	license.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	3816	Updater.exe
Token: SeDebugPrivilege	2460	Updater.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	1620	Updater.exe
Token: SeDebugPrivilege	3740	Updater.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

3384 7zFM.exe
3384 7zFM.exe

pid	process
3384	7zFM.exe
3384	7zFM.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

OpenWith.exe

pid	process
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe
2324	OpenWith.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

OpenWith.exeLoader.execmd.execmd.exepowershell.exelicense.exelicense.exeUpdater.exeUpdater.exeUpdater.exe

description	pid	process	target process
PID 2324 wrote to memory of 944	2324	OpenWith.exe	7z.exe
PID 2324 wrote to memory of 944	2324	OpenWith.exe	7z.exe
PID 4432 wrote to memory of 1488	4432	Loader.exe	cmd.exe
PID 4432 wrote to memory of 1488	4432	Loader.exe	cmd.exe
PID 1488 wrote to memory of 552	1488	cmd.exe	powershell.exe
PID 1488 wrote to memory of 552	1488	cmd.exe	powershell.exe
PID 4432 wrote to memory of 3128	4432	Loader.exe	cmd.exe
PID 4432 wrote to memory of 3128	4432	Loader.exe	cmd.exe
PID 3128 wrote to memory of 1308	3128	cmd.exe	powershell.exe
PID 3128 wrote to memory of 1308	3128	cmd.exe	powershell.exe
PID 1308 wrote to memory of 3940	1308	powershell.exe	license.exe
PID 1308 wrote to memory of 3940	1308	powershell.exe	license.exe
PID 1308 wrote to memory of 3940	1308	powershell.exe	license.exe
PID 3940 wrote to memory of 4840	3940	license.exe	powershell.exe
PID 3940 wrote to memory of 4840	3940	license.exe	powershell.exe
PID 3940 wrote to memory of 4840	3940	license.exe	powershell.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 3940 wrote to memory of 1988	3940	license.exe	license.exe
PID 1988 wrote to memory of 3816	1988	license.exe	Updater.exe
PID 1988 wrote to memory of 3816	1988	license.exe	Updater.exe
PID 3816 wrote to memory of 1512	3816	Updater.exe	powershell.exe
PID 3816 wrote to memory of 1512	3816	Updater.exe	powershell.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 3816 wrote to memory of 2460	3816	Updater.exe	Updater.exe
PID 2460 wrote to memory of 3760	2460	Updater.exe	powershell.exe
PID 2460 wrote to memory of 3760	2460	Updater.exe	powershell.exe
PID 1620 wrote to memory of 4048	1620	Updater.exe	powershell.exe
PID 1620 wrote to memory of 4048	1620	Updater.exe	powershell.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe
PID 1620 wrote to memory of 3740	1620	Updater.exe	Updater.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Eulen.Menu.by.1msorry.rar
1⤵
PID:4960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\AppData\Local\Temp\Eulen.Menu.by.1msorry.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3308

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Eulen.Menu.by.1msorry.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3384

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\system32\cmd.exe
"cmd.exe" /C "powershell -w Hidden -ep bypass -nop -C Set-MpPreference -ExclusionPath C:\\"
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w Hidden -ep bypass -nop -C Set-MpPreference -ExclusionPath C:\\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\cmd.exe
"cmd.exe" /C "powershell.exe -w Hidden -ep Bypass -C Start-Process C:\\ProgramData\\license.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -w Hidden -ep Bypass -C Start-Process C:\\ProgramData\\license.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308

C:\ProgramData\license.exe
"C:\ProgramData\license.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\ProgramData\license.exe
C:\ProgramData\license.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\Updater.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Users\Admin\AppData\Local\Temp\Updater.exe
C:\Users\Admin\AppData\Local\Temp\Updater.exe
7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Users\Admin\AppData\Roaming\Updater.exe
C:\Users\Admin\AppData\Roaming\Updater.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Users\Admin\AppData\Roaming\Updater.exe
C:\Users\Admin\AppData\Roaming\Updater.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\license.exe
Filesize
638KB

MD5
fcee7bf402dedeaf3fcf18a52a56d75b

SHA1
f99c8a99be241fc82c06c2c0155bee4ce26e2e5e

SHA256
55fa30deba49d1278145e3ab083182e50146fdc55643c54d3126a7b8a76c0684

SHA512
0bac4d1f9e3c7d6ba58a4370a59a233506a6565debc81148a40a743188902abbc1e6e822c45a1cf5267f3e3227d913689fdd76bc3d812598b928fcd835c84c68

Download Submit
C:\ProgramData\license.exe
Filesize
638KB

MD5
fcee7bf402dedeaf3fcf18a52a56d75b

SHA1
f99c8a99be241fc82c06c2c0155bee4ce26e2e5e

SHA256
55fa30deba49d1278145e3ab083182e50146fdc55643c54d3126a7b8a76c0684

SHA512
0bac4d1f9e3c7d6ba58a4370a59a233506a6565debc81148a40a743188902abbc1e6e822c45a1cf5267f3e3227d913689fdd76bc3d812598b928fcd835c84c68

Download Submit
C:\ProgramData\license.exe
Filesize
638KB

MD5
fcee7bf402dedeaf3fcf18a52a56d75b

SHA1
f99c8a99be241fc82c06c2c0155bee4ce26e2e5e

SHA256
55fa30deba49d1278145e3ab083182e50146fdc55643c54d3126a7b8a76c0684

SHA512
0bac4d1f9e3c7d6ba58a4370a59a233506a6565debc81148a40a743188902abbc1e6e822c45a1cf5267f3e3227d913689fdd76bc3d812598b928fcd835c84c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Updater.exe.log
Filesize
1KB

MD5
45e54c812172d4a7b2140b9c47099881

SHA1
f921a1c60b7b73d873381a2830ea51e0bca71db5

SHA256
2107ccfed0e139683670414c7d74744b43a0b54234b30efa8f8cbb9463e857d2

SHA512
497291bfbaa277761ea81e4aafc1cb7600ac759917ee39aaaaaa03c102d1a7828f34d1abe5aeea4d08f83705ccac4691c6b8ecb09282b97d87ef3131191b00d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\license.exe.log
Filesize
1KB

MD5
dc464d62de128521567362201cf8d7b1

SHA1
e57a8c8aad4ed18d0138b0dd99f395e97662bff8

SHA256
d35faa203ecb0c712dc9bf60e75a18b80423cd3054f28ea9e556339ef30de652

SHA512
f6728bbbedde65776479b705e5af49485a1886355e4bfc867531bf7d59f8e7188eff5b193845e3ad6a77aa59518f529fd6e4ace4504a2a153a8cbdb20dfc8005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
28KB

MD5
cd0cc05cc65e20b7123c5bd97ab13bee

SHA1
7b574d6d23052d42d4057fb8f997ee89db3c7abf

SHA256
7ba82cfe1b592af5f5ba96536e3a3c131b17c327bde1565688b7470071c46ac1

SHA512
53b6918dccf724c48697141123f222da6d45568645a0a3fe4a8dab63ce1a4e71d4303f5c8f7bbfabd1109e9c2947b21e51305edff8c2e7fe60441bf3be7584d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
687ff3bb8a8b15736d686119a681097c

SHA1
18f43aa14e56d4fb158a8804f79fc3c604903991

SHA256
51fd45579a0bee4beabbf7aa825ccc646f907dfdf27b2fc1791fa47dc90d5aa2

SHA512
047b21b92e74c93f264e2547900decd295f3089b22165372c4060b76bb813ffa6f2af924974936e25a2db551ea1eec722329ae78e1fff08f6f104d041090094a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
d88c19790214c97542dc0049a5062dae

SHA1
04771bade7a400825c849cf594870614423c58c0

SHA256
89921b732601dfe90926bc6df9a6bb2b21284f42f346e6db046d0b64138bf531

SHA512
87828475fbda44a2dc58c4921b63171c07f760d6a439c9dbbdf8281f9571ca1792b8d2aef4da2b1e1a7d6cd21ced7819b498f29e97d4a30db9d4de13cd1830c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
d8ab91466df8dba1654dad63dbd849fa

SHA1
8d97c06e119258f7122640d281e383eb303c07ef

SHA256
208b1ea77a2e37a71d973b45bebaaa22be9d613bed1dff00c3384cb139d8d77f

SHA512
4bb41cff853d32e7727079c46f9dd20789ad2b98bb0fee4c9d0c3aa37929d9017b2d56568c01956e5b6e43c05eb85686b107f299bc210b205929cfaf98b58179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
bb1c33a1a3bbff8ced39d26308f77211

SHA1
c59c693e72c74c349b245b33b907dfb4e4ba4c3a

SHA256
8685999934d4786f68afbe0f7ceeecd3e308fe8886cd2bc269ba7e3d43bf3c90

SHA512
2d07992b52f2826969a4d5549f2812fad0999d9b858ae3e56b3ded04d058dfcada1987ae3b0c2c0cbbfed4a3ac734500a89d8750dd1b85351b6efd05202669b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
e936ffde1732f536cc835ed3e6c83842

SHA1
05a7c09e599c32003ea21329932a032ace4f592c

SHA256
da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552

SHA512
35d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\AppData\Roaming\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\AppData\Roaming\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\AppData\Roaming\Updater.exe
Filesize
1.0MB

MD5
bb233d4542a170be01c2d14cbb4a1d8a

SHA1
3f5b38c62ab67eb8612af6280294b524d94891cd

SHA256
5e6259b44a9bd71bfa23de11910ac94d336a6d4d988082afaf94d60065069352

SHA512
fac8a98136e7c244d34e2bb8afeb5365597994030ba266f0640808addd990f90395be95a3e518c7406c3872cdf333a054da9537ebd266511918011ce7a747bb3

Download Submit
C:\Users\Admin\Desktop\Loader.exe
Filesize
5.9MB

MD5
9f893501b787cfdffdd9a98dc5b489e9

SHA1
8767c07438ca5816cd76789d4accd2a2e894acb8

SHA256
1c7f6002ff994762d284f7b4e6b7c4f87fc368775179715f58d698a804df9e2e

SHA512
179d13f1561f7d688f32cb53e030fff691ad50dd75d0f23b634f01d54de8bade6a2d01b4ca0c4e0e581755971b4d815c56b74476a856d00b92ed5149681b8bfd

Download Submit
C:\Users\Admin\Desktop\Loader.exe
Filesize
5.9MB

MD5
9f893501b787cfdffdd9a98dc5b489e9

SHA1
8767c07438ca5816cd76789d4accd2a2e894acb8

SHA256
1c7f6002ff994762d284f7b4e6b7c4f87fc368775179715f58d698a804df9e2e

SHA512
179d13f1561f7d688f32cb53e030fff691ad50dd75d0f23b634f01d54de8bade6a2d01b4ca0c4e0e581755971b4d815c56b74476a856d00b92ed5149681b8bfd

Download Submit
memory/552-139-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/552-138-0x0000021BDFD60000-0x0000021BDFD82000-memory.dmp

Filesize
136KB

Download
memory/552-137-0x0000000000000000-mapping.dmp

Download
memory/944-132-0x0000000000000000-mapping.dmp

Download
memory/1308-147-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1308-143-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1308-141-0x0000000000000000-mapping.dmp

Download
memory/1488-136-0x0000000000000000-mapping.dmp

Download
memory/1512-183-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-181-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-184-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-178-0x0000000000000000-mapping.dmp

Download
memory/1620-197-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-206-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-213-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-172-0x00000000072B0000-0x00000000072CE000-memory.dmp

Filesize
120KB

Download
memory/1988-166-0x00000000056D0000-0x00000000056E2000-memory.dmp

Filesize
72KB

Download
memory/1988-170-0x00000000073C0000-0x00000000078EC000-memory.dmp

Filesize
5.2MB

Download
memory/1988-171-0x00000000071B0000-0x0000000007226000-memory.dmp

Filesize
472KB

Download
memory/1988-168-0x00000000059E0000-0x0000000005AEA000-memory.dmp

Filesize
1.0MB

Download
memory/1988-161-0x0000000000000000-mapping.dmp

Download
memory/1988-167-0x0000000005730000-0x000000000576C000-memory.dmp

Filesize
240KB

Download
memory/1988-169-0x0000000006CC0000-0x0000000006E82000-memory.dmp

Filesize
1.8MB

Download
memory/1988-162-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1988-165-0x0000000005DA0000-0x00000000063B8000-memory.dmp

Filesize
6.1MB

Download
memory/2460-185-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/2460-186-0x0000000140000000-mapping.dmp

Download
memory/2460-190-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/2460-194-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3128-140-0x0000000000000000-mapping.dmp

Download
memory/3740-215-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3740-211-0x0000000140000000-mapping.dmp

Download
memory/3740-214-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-191-0x0000000000000000-mapping.dmp

Download
memory/3760-198-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-205-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-203-0x00000277711B0000-0x00000277711B8000-memory.dmp

Filesize
32KB

Download
memory/3760-204-0x00000277711C0000-0x00000277711CA000-memory.dmp

Filesize
40KB

Download
memory/3760-202-0x00000277711A0000-0x00000277711AA000-memory.dmp

Filesize
40KB

Download
memory/3760-201-0x0000027757430000-0x000002775744C000-memory.dmp

Filesize
112KB

Download
memory/3816-182-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3816-189-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3816-173-0x0000000000000000-mapping.dmp

Download
memory/3816-176-0x000002F083BF0000-0x000002F083CF4000-memory.dmp

Filesize
1.0MB

Download
memory/3816-177-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/3940-151-0x0000000005320000-0x0000000005342000-memory.dmp

Filesize
136KB

Download
memory/3940-150-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/3940-145-0x0000000000000000-mapping.dmp

Download
memory/3940-148-0x0000000000730000-0x00000000007D6000-memory.dmp

Filesize
664KB

Download
memory/3940-149-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/4048-199-0x0000000000000000-mapping.dmp

Download
memory/4048-207-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/4048-209-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/4048-200-0x00007FFC44B20000-0x00007FFC455E1000-memory.dmp

Filesize
10.8MB

Download
memory/4840-158-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Filesize
120KB

Download
memory/4840-155-0x00000000050D0000-0x0000000005136000-memory.dmp

Filesize
408KB

Download
memory/4840-159-0x0000000007580000-0x0000000007BFA000-memory.dmp

Filesize
6.5MB

Download
memory/4840-154-0x0000000005210000-0x0000000005838000-memory.dmp

Filesize
6.2MB

Download
memory/4840-160-0x0000000006410000-0x000000000642A000-memory.dmp

Filesize
104KB

Download
memory/4840-156-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/4840-153-0x0000000002620000-0x0000000002656000-memory.dmp

Filesize
216KB

Download
memory/4840-152-0x0000000000000000-mapping.dmp

Download