smokeloader | 78fdd3d64acf475e6f2eb9af6e97ed3022ba5369cb47c704e397fbe9186ba0bf

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2022, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 257KB
Sample221231-x3szesad39
SHA256 78fdd3d64acf475e6f2eb9af6e97ed3022ba5369cb47c704e397fbe9186ba0bf
MD5 ef1e4c82a2982a0ceb0cf15d742ad5d7
SHA1 c9490e829f7be20b6f3da69c2a000be7bbe5ac26
SHA512 73013ff0367798ccdc375ada89ef0e58d4a24756e42b92c3809df18b3ce235ec5871eacb86771bbc4eb4cb87d25cfdfc57c1c102ec735a33fc6c51fb9914e4bf
SSDEEP 3072:VwPEvi8gLEV9Sr0JRHpLai67p+fgzdHW7YFjPOua9iH70kNmqJdSIjBF27hZY:RULkSr0oiUpxbagb0XijBQZY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/2072-133-0x00000000004D0000-0x00000000004D9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4788	C633.exe
1416	Iqpoqhfidqa.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	C633.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1012	Process not Found
4672	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4788 set thread context of 3592	4788	C633.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3812	4788	WerFault.exe	88
3628	4788	WerFault.exe	88
4364	4788	WerFault.exe	88
1460	4788	WerFault.exe	88
3604	4788	WerFault.exe	88
532	4788	WerFault.exe	88
4896	4788	WerFault.exe	88
2124	1416	WerFault.exe	102
4256	4672	WerFault.exe	108
4632	4788	WerFault.exe	88

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	C633.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	C633.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	C633.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	C633.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	C633.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1012	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2072	file.exe
2072	file.exe
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found
1012	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1012	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2072	file.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeDebugPrivilege	1416	Iqpoqhfidqa.exe
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeDebugPrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found
Token: SeShutdownPrivilege	1012	Process not Found
Token: SeCreatePagefilePrivilege	1012	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3592	rundll32.exe
1416	Iqpoqhfidqa.exe
4672	chrome.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1416	Iqpoqhfidqa.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1012	Process not Found
1012	Process not Found
4672	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4788	1012	Process not Found	88
PID 1012 wrote to memory of 4788	1012	Process not Found	88
PID 1012 wrote to memory of 4788	1012	Process not Found	88
PID 4788 wrote to memory of 1416	4788	C633.exe	102
PID 4788 wrote to memory of 1416	4788	C633.exe	102
PID 4788 wrote to memory of 1416	4788	C633.exe	102
PID 4788 wrote to memory of 3592	4788	C633.exe	105
PID 4788 wrote to memory of 3592	4788	C633.exe	105
PID 4788 wrote to memory of 3592	4788	C633.exe	105
PID 4788 wrote to memory of 3592	4788	C633.exe	105
PID 1012 wrote to memory of 4672	1012	Process not Found	108
PID 1012 wrote to memory of 4672	1012	Process not Found	108
PID 4672 wrote to memory of 1164	4672	chrome.exe	109
PID 4672 wrote to memory of 1164	4672	chrome.exe	109
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 2156	4672	chrome.exe	112
PID 4672 wrote to memory of 1848	4672	chrome.exe	113
PID 4672 wrote to memory of 1848	4672	chrome.exe	113
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115
PID 4672 wrote to memory of 4020	4672	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2072

C:\Users\Admin\AppData\Local\Temp\C633.exe
C:\Users\Admin\AppData\Local\Temp\C633.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 936
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1080
  2⤵
  - Program crash
  PID:3628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1156
  2⤵
  - Program crash
  PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1028
  2⤵
  - Program crash
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1188
  2⤵
  - Program crash
  PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1028
  2⤵
  - Program crash
  PID:532
- C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
  "C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 472
    3⤵
    - Program crash
    PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1456
  2⤵
  - Program crash
  PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1216
  2⤵
  - Program crash
  PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4788 -ip 4788
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4788 -ip 4788
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4788 -ip 4788
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4788 -ip 4788
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4788 -ip 4788
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4788 -ip 4788
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4788 -ip 4788
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1416 -ip 1416
1⤵
PID:5108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3e7a4f50,0x7ffd3e7a4f60,0x7ffd3e7a4f70
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,15672385583066619732,2644880067391258016,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,15672385583066619732,2644880067391258016,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,15672385583066619732,2644880067391258016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,15672385583066619732,2644880067391258016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:3144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4672 -s 3632
  2⤵
  - Program crash
  PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 4672 -ip 4672
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4788 -ip 4788
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a66bfbc-2b3c-42f2-a104-4311972f02b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a66bfbc-2b3c-42f2-a104-4311972f02b8.tmp
Size 21KB
SHA256 7f4e382d1c6724a5f173f3617e35d5ad74c28ffce9a918f00b48c88f978dc34e
MD5 301ea18f32584b0102b1e4f710c6054d
SHA1 e970ec47138c443ec94a4c3671622f578ed09a26
SHA512 3c1dd0687ff4a98324f8f0c054e2bf24a3adc2edb28a4ee095f5e71d5943702bcdf36b4c5b2e163e17cc207833194539ed98b7830e94ac446a9d48d29837627b
SSDEEP 192:kQ3oiVaUq4aaL/ytEQp1HQfjVa02W3NfNpEqn744ohU8A4/MBJZR3K4DBHAgaZCh:Jo6aUqw+1wbV+OEq3EU3qMXZTtH1PxvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

238c27f5-0a3b-4a19-a78d-9f1e363d70e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\238c27f5-0a3b-4a19-a78d-9f1e363d70e0.tmp
Size 23KB
SHA256 3884df97009ac7e97143743660ed8e010d5f77edcf611bf85276e876fc70754b
MD5 2e0a52964e4f43a9830f01775bcb061b
SHA1 deedc2124380dcc834798466b7ae8ca986aba82f
SHA512 56c28175bfeb1adfa70761dbf3d46f60b3545de1dd879b346658a2701a173c5fd1959dcb6ecb931f7589f8178fa46d026da0edcfef0471f0fc9d65df7bc6ea44
SSDEEP 384:Kf8dqwQFeqz/pS6LK+0DQDIjRdaB9t84OfwSduIf:LMeXJDfK9+4C7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
Size 1KB
SHA256 637f39c5e12f7ff56488cfa4308c244bd2473ff770eced6da50b1823e7371240
MD5 370d6612d816d478f4df487e9245c131
SHA1 eeeee15b342895a05852e3bf517a050efe9bd67c
SHA512 e07bc4e4e1a044644c0d4411ba36f3fb91c33e61d9e637f3673ebf7c0775e223146aba2264b4254e774c4c041f1079ac9dab421536b03c96d4c42f02abe0a62e
MD5 SHA1 SHA512

Submit Download

C633.exe

Path C:\Users\Admin\AppData\Local\Temp\C633.exe
Size 6.6MB
SHA256 55054d7dd67fa5e02e014e92761470d3b43f1d6a42846a6c17b266ccca38eaf5
MD5 626bc845cac86f0d2cfaa34d7777a77c
SHA1 913b8bcfea8c03e11fc86fd0af1c275c4ca2f665
SHA512 adf31dcba3223c8d2272109ebd2ddb68369ceae933487207e0172b31b8f4de01f66a918bb4a7019c1bb9af8feef81f651d52c6587d958d4b88225a2c8f8091cc
SSDEEP 196608:/xEdNo7ijr+Q5IupHmFsehQRq6HO8FfhVKUbfh:/+wiWQ53pGiRHQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

C633.exe

Path C:\Users\Admin\AppData\Local\Temp\C633.exe
Size 6.6MB
SHA256 55054d7dd67fa5e02e014e92761470d3b43f1d6a42846a6c17b266ccca38eaf5
MD5 626bc845cac86f0d2cfaa34d7777a77c
SHA1 913b8bcfea8c03e11fc86fd0af1c275c4ca2f665
SHA512 adf31dcba3223c8d2272109ebd2ddb68369ceae933487207e0172b31b8f4de01f66a918bb4a7019c1bb9af8feef81f651d52c6587d958d4b88225a2c8f8091cc
SSDEEP 196608:/xEdNo7ijr+Q5IupHmFsehQRq6HO8FfhVKUbfh:/+wiWQ53pGiRHQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

COXNLIOB-20221111-1350.log

Path C:\Users\Admin\AppData\Local\Temp\COXNLIOB-20221111-1350.log
Size 56KB
SHA256 b0ccec98a8b0840dca4263fa4243620790fb48548c1cb9f6816cfac49c844f9b
MD5 4c7d17ce1a0d8c47ef1a4665c0f81ae9
SHA1 207e46a34dff9e9624016225ede3520c710ee183
SHA512 6933ac3fea8b9c2581c608d3e5fb0e12a2a87c4a2d96a6cbdb2de29f7c50794baf1f47944f7ae792c1700d7a3f6333b668e81fa53dbcf843388cee1a5dcb05dd
SSDEEP 1536:/izpK9hu3ohW5D2yow4KIENezl8RgNYvC2NiIPBatWStrBA3ov40P+e2Qolkx+Mn:/rS3PBnRgNY6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iqpoqhfidqa.exe

Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
Size 1.4MB
SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
MD5 526b7ca434081a2cde3a52401145e6d1
SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iqpoqhfidqa.exe

Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
Size 1.4MB
SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
MD5 526b7ca434081a2cde3a52401145e6d1
SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iqpoqhfidqa.tmp

Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.tmp
Size 3.5MB
SHA256 c34565954052e885c9978fc2b50cf32cc98a67ba9851689101ed5bfffa9bdce4
MD5 e46489e6f67972c624a8ef215d26db53
SHA1 304fdfc6918d97480f65c80891baeb63e55ee3e0
SHA512 6c65ad50bde38b2d6b5880f998e67ac431daa783be6baf925a84f1bb439b04806d1a612f4537363940325bb2aa6d1e692379215a63d1e80ac997fc1a9eb47ac1
SSDEEP 49152:GRptgqJtySbKTpj5ADb4QR3YTsAyTGQn++LKzqoJMhT2gmhsyBPX5+q65XNTwO7F:GCSbIeuT9yTGQ+ZzqAlB/a51px
MD5 SHA1 SHA512 SSDEEP

Submit Download

abac0e8a-ef82-4347-8d85-b964d1e5e69f.tmp

Path C:\Users\Admin\AppData\Local\Temp\abac0e8a-ef82-4347-8d85-b964d1e5e69f.tmp
Size 23KB
SHA256 ee80340a02c0f96a3f9d01e635857d38d7b92444d6102ee29804f559f2eaa7f4
MD5 7cd73270bd735f9fe77bc9278f9f2b8b
SHA1 b27a898970297c750fb7e4d70ad8f87c1e6c1739
SHA512 1fe70455d4d8c0fbab9ef20cf85d0de55fea9f18499c653af5d234462aa5c45eaacceadab39e9be62dc548af4f710362dd34970e1d8a666bf09fe4101bf32077
SSDEEP 384:+PozM0g8b+IyYEu8ME0Tj0spid7jUQuG+1BkJVT9jZw:+Po+8bpyjuW0X0sY7jZuGQBoTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 1KB
SHA256 f4ca10554a2b88353fd54b42bfcc334ea966c7196579f6f8350548a6e5fd246a
MD5 88a093693ae37fb4e207fda8f805a248
SHA1 ce63b70e5e8368a29e63505b40d78ac366a88c03
SHA512 e6fe1dcee88905c0d9d459d71f363f2fcc3c4b0c21a7c1ff3ea3245ff90a64be7fab12f6900b77b47249bf31898dd30d6a02f18c94944e830acb770d63a4b0b6
MD5 SHA1 SHA512

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 25f35edabc8437112683082f607e3fbf818364f4276449b138eb460e328c015e
MD5 4b2ee88ed1187adc84730fa94ddfe39a
SHA1 cb410e786bf5f5d6838bb2794c6c8cd02be64650
SHA512 df7822b9e0a8d6e9e835959fa0143bdac873d9ef567cd7dd6a0c456340ead745554d6a3c4a921eeff15a882690def000cd3d105447c7b84aac7e583d1d8c2cba
MD5 SHA1 SHA512

Submit Download

dd_vcredistUI1873.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1873.txt
Size 11KB
SHA256 af96341c24e024c059bda9ca676233293a040d9e2c69a97aeba159cc7cb98549
MD5 a22f3b2bcac3c65d1563546f74d32d80
SHA1 9b833db58df7d217bf278545015f1a338713f2af
SHA512 12131d49ab5d9bd1133321c63059c37421ba1ab2515a37438788d7fdd6ac942eccade1309183d26108cccf3a67be5ad381ac6783de673ae95d1ca99300146d7a
SSDEEP 192:ZZpox91QXi4JfnXnzdnXnlMARnlnEHYX8BBwI8sf:5ox91QXi4JfXBXlMARlJMMsf
MD5 SHA1 SHA512 SSDEEP

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 266KB
SHA256 73d396c0df66e8f16658167a61fb6d1548d33f8c93c660e9eb68bb699555d5cd
MD5 3720de23b150caa8a8a42bac9f9c2b4e
SHA1 81ad37441685870c2df574f0745eb940eaced6f4
SHA512 26dd6c397c51efe3e2e15b7f233dbc8f9eff3a629a90a45a0b4ef256f552cbd548fde1fbabe518cd9f43273d63574332add2e3ac74cad1f17a47c641196a8061
SSDEEP 3072:ri/xMFR9nfrASqXSNu25l0Dsy8y5aVPQQWS7iT/i/VF2XJPdJhaFONhaLxTFdBGm:l
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 3KB
SHA256 820c39ecfc4a27c7a3e3809ae95ffd4c6abc50997c6a01ea6be96459e2f1779c
MD5 a2767c12f44d335748a550b609c53d88
SHA1 334b09e4622739b3d9afe3a8fa81f8c6912237e2
SHA512 f397cb6fc372f2925277d379caa9d3b62dba2cfb48476b1fdede4d959f04b71803b6261cdc5ba18d2cc718f8694ddec5e702e790566f0bd04495bf59c75f07c9
MD5 SHA1 SHA512

Submit Download

memory/1012-162-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-217-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-151-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-152-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-163-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-154-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-155-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-156-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-157-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-158-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-159-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-160-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-150-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-161-0x0000000007A40000-0x0000000007A50000-memory.dmp

Download

memory/1012-153-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-164-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-147-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-146-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-145-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-144-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-213-0x000000000B8CA000-0x000000000B8CF000-memory.dmp

Download

memory/1012-214-0x000000000FCB0000-0x000000000FDD8000-memory.dmp

Download

memory/1012-216-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-149-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-218-0x0000000007A70000-0x0000000007A80000-memory.dmp

Download

memory/1012-219-0x000000000FCB0000-0x000000000FDD8000-memory.dmp

Download

memory/1012-148-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/1012-223-0x000000000FCB0000-0x000000000FDD8000-memory.dmp

Download

memory/1416-199-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-211-0x0000000000400000-0x0000000000588000-memory.dmp

Download

memory/1416-212-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-210-0x00000000024F0000-0x0000000002645000-memory.dmp

Download

memory/1416-209-0x00000000023AF000-0x00000000024EF000-memory.dmp

Download

memory/1416-208-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-207-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-206-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-205-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/1416-204-0x00000000028D0000-0x0000000002A04000-memory.dmp

Download

memory/2072-132-0x000000000061D000-0x000000000062E000-memory.dmp

Download

memory/2072-133-0x00000000004D0000-0x00000000004D9000-memory.dmp

Download

memory/2072-134-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2072-135-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3592-182-0x0000000003E90000-0x0000000003FD0000-memory.dmp

Download

memory/3592-197-0x0000000003E90000-0x0000000003FD0000-memory.dmp

Download

memory/3592-180-0x0000000000C40000-0x0000000001672000-memory.dmp

Download

memory/3592-198-0x0000000003E90000-0x0000000003FD0000-memory.dmp

Download

memory/3592-183-0x0000000003180000-0x0000000003CD2000-memory.dmp

Download

memory/3592-184-0x0000000003E90000-0x0000000003FD0000-memory.dmp

Download

memory/3592-202-0x0000000003180000-0x0000000003CD2000-memory.dmp

Download

memory/4788-178-0x00000000049C0000-0x0000000005512000-memory.dmp

Download

memory/4788-142-0x0000000000400000-0x0000000000CD0000-memory.dmp

Download

memory/4788-177-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-172-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-174-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-143-0x0000000000400000-0x0000000000CD0000-memory.dmp

Download

memory/4788-173-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-168-0x00000000049C0000-0x0000000005512000-memory.dmp

Download

memory/4788-176-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-175-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-141-0x0000000003140000-0x0000000003A03000-memory.dmp

Download

memory/4788-215-0x0000000000400000-0x0000000000CD0000-memory.dmp

Download

memory/4788-139-0x0000000000400000-0x0000000000CD0000-memory.dmp

Download

memory/4788-140-0x0000000002AC9000-0x000000000313F000-memory.dmp

Download

memory/4788-169-0x00000000049C0000-0x0000000005512000-memory.dmp

Download

memory/4788-170-0x0000000005730000-0x0000000005870000-memory.dmp

Download

memory/4788-221-0x00000000049C0000-0x0000000005512000-memory.dmp

Download

memory/4788-222-0x0000000000400000-0x0000000000CD0000-memory.dmp

Download

memory/4788-171-0x0000000005730000-0x0000000005870000-memory.dmp

Download