bandook | hxxps://drive[.]google[.]com/file/d/1rYu6z5c-rOLnOx-4rHXXMG-BRkX_zFsc/view?usp=drive_web

Analysis

max time kernel
926s
max time network
927s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1rYu6z5c-rOLnOx-4rHXXMG-BRkX_zFsc/view?usp=drive_web

Score

10^/10

bandook persistence rat trojan upx

Malware Config

Extracted

Family

bandook

bomes.ru

Signatures

Bandook RAT
Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.
rat trojan bandook

Bandook payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3480-170-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/3480-171-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/3480-172-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook
behavioral1/memory/404-177-0x0000000013140000-0x0000000014009000-memory.dmp	family_bandook

Executes dropped EXE 2 IoCs

Processes:

FACTURA_SOLICITADA1.exeFACTURA_SOLICITADA1.exe

pid process

1324 FACTURA_SOLICITADA1.exe
508 FACTURA_SOLICITADA1.exe

pid	process
1324	FACTURA_SOLICITADA1.exe
508	FACTURA_SOLICITADA1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3480-168-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/3480-169-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/3480-170-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/3480-171-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/3480-172-0x0000000013140000-0x0000000014009000-memory.dmp	upx
behavioral1/memory/404-177-0x0000000013140000-0x0000000014009000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exemsinfo32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msinfo32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WRV = "C:\\Users\\Admin\\AppData\\Roaming\\WRV\\WRV.exe"	msinfo32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\89f826ff-5318-4309-8fc9-c3d9872238c1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230122213009.pma	setup.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exetaskmgr.exeperfmon.exeperfmon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 5 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

NETSTAT.EXENETSTAT.EXENETSTAT.EXENETSTAT.EXENETSTAT.EXE

pid process

364 NETSTAT.EXE
5064 NETSTAT.EXE
3984 NETSTAT.EXE
396 NETSTAT.EXE
5000 NETSTAT.EXE

pid	process
364	NETSTAT.EXE
5064	NETSTAT.EXE
3984	NETSTAT.EXE
396	NETSTAT.EXE
5000	NETSTAT.EXE

Modifies registry class 2 IoCs

Processes:

firefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.rar:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exetaskmgr.exe

pid	process
4288	msedge.exe
4288	msedge.exe
4496	msedge.exe
4496	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

taskmgr.exeperfmon.exeperfmon.exetaskmgr.exe

pid process

1904 taskmgr.exe
4464 perfmon.exe
2928 perfmon.exe
948 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4496 msedge.exe
4496 msedge.exe
4496 msedge.exe
4496 msedge.exe
4496 msedge.exe
4496 msedge.exe

pid	process
1904	taskmgr.exe
4464	perfmon.exe
2928	perfmon.exe
948	taskmgr.exe

pid	process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

firefox.exe7zG.exeAUDIODG.EXEtaskmgr.exesvchost.exeperfmon.exeNETSTAT.EXEtaskmgr.exeperfmon.exeNETSTAT.EXENETSTAT.EXENETSTAT.EXENETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	1528	firefox.exe
Token: SeDebugPrivilege	1528	firefox.exe
Token: SeDebugPrivilege	1528	firefox.exe
Token: SeRestorePrivilege	3212	7zG.exe
Token: 35	3212	7zG.exe
Token: SeSecurityPrivilege	3212	7zG.exe
Token: SeSecurityPrivilege	3212	7zG.exe
Token: 33	3760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3760	AUDIODG.EXE
Token: SeDebugPrivilege	1904	taskmgr.exe
Token: SeSystemProfilePrivilege	1904	taskmgr.exe
Token: SeCreateGlobalPrivilege	1904	taskmgr.exe
Token: SeSecurityPrivilege	1904	taskmgr.exe
Token: SeTakeOwnershipPrivilege	1904	taskmgr.exe
Token: SeBackupPrivilege	4788	svchost.exe
Token: SeRestorePrivilege	4788	svchost.exe
Token: SeSecurityPrivilege	4788	svchost.exe
Token: SeTakeOwnershipPrivilege	4788	svchost.exe
Token: 35	4788	svchost.exe
Token: SeDebugPrivilege	4464	perfmon.exe
Token: SeSystemProfilePrivilege	4464	perfmon.exe
Token: SeCreateGlobalPrivilege	4464	perfmon.exe
Token: 33	4464	perfmon.exe
Token: SeIncBasePriorityPrivilege	4464	perfmon.exe
Token: 33	1904	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1904	taskmgr.exe
Token: SeDebugPrivilege	364	NETSTAT.EXE
Token: SeDebugPrivilege	948	taskmgr.exe
Token: SeSystemProfilePrivilege	948	taskmgr.exe
Token: SeCreateGlobalPrivilege	948	taskmgr.exe
Token: SeDebugPrivilege	2928	perfmon.exe
Token: SeSystemProfilePrivilege	2928	perfmon.exe
Token: SeCreateGlobalPrivilege	2928	perfmon.exe
Token: SeDebugPrivilege	5064	NETSTAT.EXE
Token: SeDebugPrivilege	3984	NETSTAT.EXE
Token: SeDebugPrivilege	396	NETSTAT.EXE
Token: SeDebugPrivilege	5000	NETSTAT.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exe7zG.exemsedge.exetaskmgr.exe

pid	process
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
3212	7zG.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe
1904	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

firefox.exe

pid process

1528 firefox.exe
1528 firefox.exe
1528 firefox.exe
1528 firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1224 wrote to memory of 1528	1224	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4848	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 4848	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 3584	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe
PID 1528 wrote to memory of 204	1528	firefox.exe	firefox.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://drive.google.com/file/d/1rYu6z5c-rOLnOx-4rHXXMG-BRkX_zFsc/view?usp=drive_web
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://drive.google.com/file/d/1rYu6z5c-rOLnOx-4rHXXMG-BRkX_zFsc/view?usp=drive_web
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.0.125682219\762149499" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1604 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 1800 gpu
3⤵
PID:4848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.3.1138879842\315350756" -childID 1 -isForBrowser -prefsHandle 1548 -prefMapHandle 1544 -prefsLen 112 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2452 tab
3⤵
PID:3584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.13.78715658\305857081" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 6894 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3592 tab
3⤵
PID:204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4188

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap23542:100:7zEvent1958
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?launchContext1=Microsoft.Windows.Cortana_cw5n1h2txyewy&url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dtask%2BManagertask%26form%3DWNSGPH%26qs%3DSW%26cvid%3Dc1dc8c2e7dde44e7a010b6ac24695245%26pq%3Dtask%2BManagertask%26cc%3DUS%26setlang%3Den-US%26nclid%3D9C0DA10A27A69B5F4DC9FC093B60234D%26ts%3D1674422996605%26nclidts%3D1674422996%26tsms%3D605
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8122646f8,0x7ff812264708,0x7ff812264718
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 /prefetch:8
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
2⤵
PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5520 /prefetch:8
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5928 /prefetch:8
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7fd5c5460,0x7ff7fd5c5470,0x7ff7fd5c5480
3⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,4466552818244323862,3038259632755980108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x47c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1904

C:\Windows\system32\resmon.exe
"C:\Windows\system32\resmon.exe"
2⤵
PID:636

C:\Windows\System32\perfmon.exe
"C:\Windows\System32\perfmon.exe" /res
3⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe
"C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe"
1⤵
- Executes dropped EXE
PID:1324

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
2⤵
PID:3480

C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe ooooooooooooooo
2⤵
- Executes dropped EXE
PID:508

C:\windows\SysWOW64\msinfo32.exe
C:\windows\syswow64\msinfo32.exe
3⤵
- Adds Run key to start application
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4968

C:\Windows\system32\NETSTAT.EXE
netstat -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\system32\NETSTAT.EXE
netstat -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\find.exe
find 508
2⤵
PID:636

C:\Windows\system32\NETSTAT.EXE
netstat -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\system32\find.exe
find "508"
2⤵
PID:4132

C:\Windows\system32\NETSTAT.EXE
netstat -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\find.exe
find "1324"
2⤵
PID:4288

C:\Windows\system32\NETSTAT.EXE
netstat -ano
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\find.exe
find "516"
2⤵
PID:2508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\system32\resmon.exe
"C:\Windows\system32\resmon.exe"
2⤵
PID:4404

C:\Windows\System32\perfmon.exe
"C:\Windows\System32\perfmon.exe" /res
3⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
Filesize
7KB

MD5
317c6df2a3082773db98c4c0a04077bd

SHA1
0a8990750ebed816afb87695d4374b55d069558b

SHA256
775864f4bc0a1d0a2459bb26df1098487621fdf33a7f6c810085fd5add37da48

SHA512
12caf24978a57b467406418007e0fcb6cd01d27bb8e5251f6c058c5c07a8e2167100821f941c31fd8d2adc217720b2c98fc182283a14a3a7ca1a79bf4ae96b79

Download Submit
C:\Users\Admin\AppData\Roaming\WRV\WRV.exe
Filesize
2.6MB

MD5
6570630f7d586a4e603f2080fa66025c

SHA1
bd9820d4c0d6b4abcbcaf9e11440d856b7752764

SHA256
19a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166

SHA512
36187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f

Download Submit
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe
Filesize
2.6MB

MD5
6570630f7d586a4e603f2080fa66025c

SHA1
bd9820d4c0d6b4abcbcaf9e11440d856b7752764

SHA256
19a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166

SHA512
36187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f

Download Submit
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe
Filesize
2.6MB

MD5
6570630f7d586a4e603f2080fa66025c

SHA1
bd9820d4c0d6b4abcbcaf9e11440d856b7752764

SHA256
19a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166

SHA512
36187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f

Download Submit
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.exe
Filesize
2.6MB

MD5
6570630f7d586a4e603f2080fa66025c

SHA1
bd9820d4c0d6b4abcbcaf9e11440d856b7752764

SHA256
19a125871b86cb2b1cdafc7bbc93715c574edefd8ea8676022e81205dc311166

SHA512
36187161ce0a77a71f91f672eb2b6cd8ff5f38bfd6408889883b86f82c5861e9fefe5eb9bbf2b7a51b66b7ee6cc58e854e166fdcc95fbf355d6fd8aaf8649d6f

Download Submit
C:\Users\Admin\Downloads\FACTURA_SOLICITADA1.rar
Filesize
1.9MB

MD5
d7b1f46591973af7b434d5d9a27472f4

SHA1
3883bcd250e1fe5f2270afe6534eb3502e34b176

SHA256
a69178f4f570bf140a5def281b614c6dd52f3f748e22c152c9b040ef10d0ef5e

SHA512
6a139ee07f667633035a2bec2fd14e1d7add6a7bc4aa06de89fdd03af51aa03036321432fa9a2b598cf3079398775c40df6839e846134e43fcfaacd7ab07aa14

Download Submit
\??\pipe\LOCAL\crashpad_4496_DOGRNNBONIQVQXRR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/364-178-0x0000000000000000-mapping.dmp

Download
memory/396-190-0x0000000000000000-mapping.dmp

Download
memory/404-177-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/404-173-0x0000000000000000-mapping.dmp

Download
memory/508-165-0x0000000000000000-mapping.dmp

Download
memory/636-187-0x0000000000000000-mapping.dmp

Download
memory/636-163-0x0000000000000000-mapping.dmp

Download
memory/672-149-0x0000000000000000-mapping.dmp

Download
memory/1384-159-0x0000000000000000-mapping.dmp

Download
memory/2084-158-0x0000000000000000-mapping.dmp

Download
memory/2244-143-0x0000000000000000-mapping.dmp

Download
memory/2508-193-0x0000000000000000-mapping.dmp

Download
memory/2560-135-0x0000000000000000-mapping.dmp

Download
memory/2776-157-0x0000000000000000-mapping.dmp

Download
memory/2928-184-0x0000000000000000-mapping.dmp

Download
memory/3032-139-0x0000000000000000-mapping.dmp

Download
memory/3388-141-0x0000000000000000-mapping.dmp

Download
memory/3480-167-0x0000000000000000-mapping.dmp

Download
memory/3480-172-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3480-170-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3480-169-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3480-168-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3480-171-0x0000000013140000-0x0000000014009000-memory.dmp

Filesize
14.8MB

Download
memory/3488-145-0x0000000000000000-mapping.dmp

Download
memory/3664-133-0x0000000000000000-mapping.dmp

Download
memory/3784-155-0x0000000000000000-mapping.dmp

Download
memory/3968-153-0x0000000000000000-mapping.dmp

Download
memory/3984-188-0x0000000000000000-mapping.dmp

Download
memory/4128-151-0x0000000000000000-mapping.dmp

Download
memory/4132-189-0x0000000000000000-mapping.dmp

Download
memory/4288-136-0x0000000000000000-mapping.dmp

Download
memory/4288-191-0x0000000000000000-mapping.dmp

Download
memory/4404-183-0x0000000000000000-mapping.dmp

Download
memory/4464-164-0x0000000000000000-mapping.dmp

Download
memory/4876-160-0x0000000000000000-mapping.dmp

Download
memory/5000-192-0x0000000000000000-mapping.dmp

Download
memory/5064-186-0x0000000000000000-mapping.dmp

Download
memory/5068-147-0x0000000000000000-mapping.dmp

Download