smokeloader | fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a

Analysis

max time kernel
52s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
Size

353KB
MD5

ef3a931a6252225a0a0a8ed3138f2e04
SHA1

768695769ac5c80e9a74e98dbfdc14f0d897aae8
SHA256

fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a
SHA512

423d87884e119c101763fc27253020434495104f45a015457b70963c1b48023e258e2fea1e91830c65b5c41c4efd303cf0fe467563fb75c06477140d5f3ec445
SSDEEP

6144:lcRE4IgwaxrLMbP+emFXFtLWFFcWt1Vn2:lcyfxaxrLMiestL+X

Score

10^/10

smokeloader vidar e749025c61b2caca10aa829a9e1a65a1 sprg backdoor discovery spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes

profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
66	4644	rundll32.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	C808.exe

Executes dropped EXE 4 IoCs

pid	Process
4396	C808.exe
1776	D3C1.exe
4524	DA0B.exe
1460	21626263273964711461.exe

Loads dropped DLL 2 IoCs

pid	Process
4396	C808.exe
4396	C808.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000022cb8-344.dat	upx
behavioral1/files/0x000a000000022cb8-349.dat	upx
behavioral1/files/0x000a000000022cb8-348.dat	upx
behavioral1/memory/1460-352-0x0000000000FC0000-0x0000000001E23000-memory.dmp	upx

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 4644	1776	D3C1.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2740	1776	WerFault.exe	83
2132	1776	WerFault.exe	83
2252	1776	WerFault.exe	83
1192	1776	WerFault.exe	83
3144	1776	WerFault.exe	83
100	4396	WerFault.exe	82

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe

Checks processor information in registry 2 TTPs 49 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	D3C1.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	D3C1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C808.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	D3C1.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C808.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	D3C1.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	D3C1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	D3C1.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	D3C1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	D3C1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3064	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
692	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2692	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
2692	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
692	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
2692	fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeDebugPrivilege	4524	DA0B.exe
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found
Token: SeShutdownPrivilege	692	Process not Found
Token: SeCreatePagefilePrivilege	692	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4644	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
692	Process not Found
692	Process not Found

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 4396	692	Process not Found	82
PID 692 wrote to memory of 4396	692	Process not Found	82
PID 692 wrote to memory of 4396	692	Process not Found	82
PID 692 wrote to memory of 1776	692	Process not Found	83
PID 692 wrote to memory of 1776	692	Process not Found	83
PID 692 wrote to memory of 1776	692	Process not Found	83
PID 692 wrote to memory of 4524	692	Process not Found	84
PID 692 wrote to memory of 4524	692	Process not Found	84
PID 692 wrote to memory of 4524	692	Process not Found	84
PID 692 wrote to memory of 3100	692	Process not Found	85
PID 692 wrote to memory of 3100	692	Process not Found	85
PID 692 wrote to memory of 3100	692	Process not Found	85
PID 692 wrote to memory of 3100	692	Process not Found	85
PID 692 wrote to memory of 2316	692	Process not Found	88
PID 692 wrote to memory of 2316	692	Process not Found	88
PID 692 wrote to memory of 2316	692	Process not Found	88
PID 692 wrote to memory of 4992	692	Process not Found	90
PID 692 wrote to memory of 4992	692	Process not Found	90
PID 692 wrote to memory of 4992	692	Process not Found	90
PID 692 wrote to memory of 4992	692	Process not Found	90
PID 692 wrote to memory of 1680	692	Process not Found	91
PID 692 wrote to memory of 1680	692	Process not Found	91
PID 692 wrote to memory of 1680	692	Process not Found	91
PID 692 wrote to memory of 2660	692	Process not Found	94
PID 692 wrote to memory of 2660	692	Process not Found	94
PID 692 wrote to memory of 2660	692	Process not Found	94
PID 692 wrote to memory of 2660	692	Process not Found	94
PID 1776 wrote to memory of 4644	1776	D3C1.exe	96
PID 1776 wrote to memory of 4644	1776	D3C1.exe	96
PID 1776 wrote to memory of 4644	1776	D3C1.exe	96
PID 1776 wrote to memory of 4644	1776	D3C1.exe	96
PID 692 wrote to memory of 4056	692	Process not Found	98
PID 692 wrote to memory of 4056	692	Process not Found	98
PID 692 wrote to memory of 4056	692	Process not Found	98
PID 692 wrote to memory of 4056	692	Process not Found	98
PID 692 wrote to memory of 2640	692	Process not Found	99
PID 692 wrote to memory of 2640	692	Process not Found	99
PID 692 wrote to memory of 2640	692	Process not Found	99
PID 692 wrote to memory of 2640	692	Process not Found	99
PID 692 wrote to memory of 4108	692	Process not Found	101
PID 692 wrote to memory of 4108	692	Process not Found	101
PID 692 wrote to memory of 4108	692	Process not Found	101
PID 692 wrote to memory of 2168	692	Process not Found	102
PID 692 wrote to memory of 2168	692	Process not Found	102
PID 692 wrote to memory of 2168	692	Process not Found	102
PID 692 wrote to memory of 2168	692	Process not Found	102
PID 4396 wrote to memory of 1460	4396	C808.exe	104
PID 4396 wrote to memory of 1460	4396	C808.exe	104
PID 1460 wrote to memory of 4084	1460	21626263273964711461.exe	106
PID 1460 wrote to memory of 4084	1460	21626263273964711461.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe
"C:\Users\Admin\AppData\Local\Temp\fba1d38fab52bac69ba86e1dbfba6619b1e15b161b86a2629cf85d660bdeb75a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2692

C:\Users\Admin\AppData\Local\Temp\C808.exe
C:\Users\Admin\AppData\Local\Temp\C808.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4396
- C:\ProgramData\21626263273964711461.exe
  "C:\ProgramData\21626263273964711461.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\21626263273964711461.exe
    3⤵
    PID:4084
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:3132
- C:\ProgramData\28234142671688868534.exe
  "C:\ProgramData\28234142671688868534.exe"
  2⤵
  PID:988
- - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
    "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
    3⤵
    PID:416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C808.exe" & exit
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 2232
  2⤵
  - Program crash
  PID:100

C:\Users\Admin\AppData\Local\Temp\D3C1.exe
C:\Users\Admin\AppData\Local\Temp\D3C1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 920
  2⤵
  - Program crash
  PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 920
  2⤵
  - Program crash
  PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1048
  2⤵
  - Program crash
  PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1056
  2⤵
  - Program crash
  PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 140
  2⤵
  - Program crash
  PID:3144

C:\Users\Admin\AppData\Local\Temp\DA0B.exe
C:\Users\Admin\AppData\Local\Temp\DA0B.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:3384

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1776 -ip 1776
1⤵
PID:4488

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4992

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1776 -ip 1776
1⤵
PID:3236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1776 -ip 1776
1⤵
PID:3428

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1776 -ip 1776
1⤵
PID:1212

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4108

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1776 -ip 1776
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4396 -ip 4396
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\21626263273964711461.exe

Filesize
4.3MB

MD5
c4ab3149ef02a36d663699a8c541933e

SHA1
67088f5eff9ec575775b711c9e3650d12d7f4d5c

SHA256
0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

SHA512
88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

Download Submit
C:\ProgramData\21626263273964711461.exe

Filesize
4.3MB

MD5
c4ab3149ef02a36d663699a8c541933e

SHA1
67088f5eff9ec575775b711c9e3650d12d7f4d5c

SHA256
0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

SHA512
88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

Download Submit
C:\ProgramData\21626263273964711461.exe

Filesize
4.3MB

MD5
c4ab3149ef02a36d663699a8c541933e

SHA1
67088f5eff9ec575775b711c9e3650d12d7f4d5c

SHA256
0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

SHA512
88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

Download Submit
C:\ProgramData\28234142671688868534.exe

Filesize
6.7MB

MD5
3bc6d011a6c3d265bcc0f04075eaaf0e

SHA1
a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

SHA256
c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

SHA512
0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

Download Submit
C:\ProgramData\28234142671688868534.exe

Filesize
6.7MB

MD5
3bc6d011a6c3d265bcc0f04075eaaf0e

SHA1
a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

SHA256
c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

SHA512
0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

Download Submit
C:\ProgramData\28234142671688868534.exe

Filesize
6.7MB

MD5
3bc6d011a6c3d265bcc0f04075eaaf0e

SHA1
a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d

SHA256
c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa

SHA512
0b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
0dd7f29838db01b2a94a190190e1aa0d

SHA1
d8c256e6dc224673de9a9cfb169aaff15b2c51e1

SHA256
a29020b772fb8794f6a84d830b92c0325507fa6c28b336fecc8b860eb96119e4

SHA512
ae6ae0195ffefccaba77ce79bee45fd6de61a3c92e14c279f8216f9a94624c40db184ff1d16e398ffbf57c3aeb382b1588802bf360a56299e05d4a17a86c077a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C808.exe

Filesize
466KB

MD5
18778e227b93e3cd1acc50e56673314b

SHA1
44aa803d630d0a7644c28a9c135f3fcdfca4bf0d

SHA256
54b4093ce9cb4534840b8dba2ff59f54a4c9dd85ccc62f001cbb1ea1082fc1ca

SHA512
fcb1c5ed94a70891ddcb01ba73fb06d326531d5f02a12e7cc12f95c0b0da54e76a9bc4649f96921c627a6fb4f3373dc9e4052d0f5fe3e16037c85d5be1f3c876

Download Submit
C:\Users\Admin\AppData\Local\Temp\C808.exe

Filesize
466KB

MD5
18778e227b93e3cd1acc50e56673314b

SHA1
44aa803d630d0a7644c28a9c135f3fcdfca4bf0d

SHA256
54b4093ce9cb4534840b8dba2ff59f54a4c9dd85ccc62f001cbb1ea1082fc1ca

SHA512
fcb1c5ed94a70891ddcb01ba73fb06d326531d5f02a12e7cc12f95c0b0da54e76a9bc4649f96921c627a6fb4f3373dc9e4052d0f5fe3e16037c85d5be1f3c876

Download Submit
C:\Users\Admin\AppData\Local\Temp\D3C1.exe

Filesize
5.4MB

MD5
19b50e116e3708c663672d9c6e5a02f7

SHA1
f2fcb880b1448f745dc525e192e0b13199363946

SHA256
a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e

SHA512
5b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\D3C1.exe

Filesize
5.4MB

MD5
19b50e116e3708c663672d9c6e5a02f7

SHA1
f2fcb880b1448f745dc525e192e0b13199363946

SHA256
a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e

SHA512
5b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA0B.exe

Filesize
1.4MB

MD5
50d71bbcdc326b964d33e0ed668ee274

SHA1
a86ff91a2d476140a8a948db6fe46bcd652256e5

SHA256
6c9a84b2d280a6bfafc9a3ee2401af74784585e81fa91569da189dedf29b297d

SHA512
fd61ae716c3b55753f512d5fb9ed023be99a5bc21bbc2ebb877ba81b29302bd25865e36dd4e3e412873036db6fe5962dd91bd192204ac1ae09e50d8e2a7e6696

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA0B.exe

Filesize
1.4MB

MD5
50d71bbcdc326b964d33e0ed668ee274

SHA1
a86ff91a2d476140a8a948db6fe46bcd652256e5

SHA256
6c9a84b2d280a6bfafc9a3ee2401af74784585e81fa91569da189dedf29b297d

SHA512
fd61ae716c3b55753f512d5fb9ed023be99a5bc21bbc2ebb877ba81b29302bd25865e36dd4e3e412873036db6fe5962dd91bd192204ac1ae09e50d8e2a7e6696

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
715.8MB

MD5
8c1cb533dee2cbd9baec3a44394e937a

SHA1
24b65bb66ecf32c2b6e81d435d86b12cda1f3def

SHA256
4322f6eed665e3ca72386937a846b5971c55c048aa89978b93c2433956d8e0a6

SHA512
8823767f402e4eace7beb5e7f0ea83bccdc89858ef46d6c2332fc5a158618a2086b93e11c569d51de485f5eefc62115e6f447f04f59e75b8e6509aa4ec5dd54b

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
714.2MB

MD5
5e239de50e89f61137f134cbcfe90dd5

SHA1
3cd183804911faa2c19807d58d4ae2c88388df94

SHA256
6d52def21b6f248a8f9e18eaea4bf34b8bbf5f12b33e860cf78358cd86b03187

SHA512
0d3aef3da287c92f846e1fb186fb9a5c02588b1b033303fe22ccc5943683c8e3ac745b8c8034e5fbbfe97235cf56073704149a2ab778b3a2a59f7e3ac3bb9859

Download Submit
memory/416-396-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/692-135-0x0000000002E70000-0x0000000002E86000-memory.dmp

Filesize
88KB

Download
memory/988-374-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1460-352-0x0000000000FC0000-0x0000000001E23000-memory.dmp

Filesize
14.4MB

Download
memory/1460-390-0x0000000000FC0000-0x0000000001E23000-memory.dmp

Filesize
14.4MB

Download
memory/1680-375-0x0000000001160000-0x0000000001169000-memory.dmp

Filesize
36KB

Download
memory/1680-266-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1680-264-0x0000000001160000-0x0000000001169000-memory.dmp

Filesize
36KB

Download
memory/1680-261-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1776-262-0x0000000008DD0000-0x0000000008DD1000-memory.dmp

Filesize
4KB

Download
memory/1776-281-0x0000000009230000-0x0000000009231000-memory.dmp

Filesize
4KB

Download
memory/1776-306-0x0000000000400000-0x0000000000962000-memory.dmp

Filesize
5.4MB

Download
memory/1776-181-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/1776-365-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/1776-169-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/1776-185-0x0000000008A00000-0x0000000008A01000-memory.dmp

Filesize
4KB

Download
memory/1776-155-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1776-263-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/1776-283-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-267-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-284-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-265-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/1776-268-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-269-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/1776-270-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-271-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-272-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/1776-173-0x00000000047A0000-0x0000000004C1B000-memory.dmp

Filesize
4.5MB

Download
memory/1776-274-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-275-0x0000000008A10000-0x0000000008B50000-memory.dmp

Filesize
1.2MB

Download
memory/1776-276-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/2168-309-0x0000000000AA0000-0x0000000000AAB000-memory.dmp

Filesize
44KB

Download
memory/2168-312-0x0000000000AA0000-0x0000000000AAB000-memory.dmp

Filesize
44KB

Download
memory/2316-186-0x0000000000A20000-0x0000000000A2F000-memory.dmp

Filesize
60KB

Download
memory/2316-187-0x0000000000A20000-0x0000000000A2F000-memory.dmp

Filesize
60KB

Download
memory/2640-300-0x0000000001160000-0x000000000116B000-memory.dmp

Filesize
44KB

Download
memory/2640-293-0x0000000001160000-0x000000000116B000-memory.dmp

Filesize
44KB

Download
memory/2660-277-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2660-376-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2660-280-0x0000000000430000-0x0000000000457000-memory.dmp

Filesize
156KB

Download
memory/2660-273-0x0000000000430000-0x0000000000457000-memory.dmp

Filesize
156KB

Download
memory/2692-136-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2692-134-0x0000000000980000-0x0000000000989000-memory.dmp

Filesize
36KB

Download
memory/3100-182-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/3100-179-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/3100-183-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/3100-366-0x0000000007DB0000-0x00000000088E3000-memory.dmp

Filesize
11.2MB

Download
memory/3384-409-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/3384-402-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3384-411-0x0000000004C80000-0x0000000004C92000-memory.dmp

Filesize
72KB

Download
memory/3384-412-0x0000000007610000-0x000000000771A000-memory.dmp

Filesize
1.0MB

Download
memory/4056-298-0x00000000009E0000-0x00000000009E9000-memory.dmp

Filesize
36KB

Download
memory/4056-285-0x00000000009E0000-0x00000000009E9000-memory.dmp

Filesize
36KB

Download
memory/4056-297-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4056-379-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4108-308-0x0000000001160000-0x000000000116B000-memory.dmp

Filesize
44KB

Download
memory/4108-303-0x00000000007C0000-0x00000000007CD000-memory.dmp

Filesize
52KB

Download
memory/4108-310-0x00000000007C0000-0x00000000007CD000-memory.dmp

Filesize
52KB

Download
memory/4396-278-0x0000000000400000-0x000000000081A000-memory.dmp

Filesize
4.1MB

Download
memory/4396-150-0x00000000009C0000-0x0000000000A17000-memory.dmp

Filesize
348KB

Download
memory/4396-188-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4524-391-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-180-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/4524-174-0x0000000000C70000-0x0000000000DE2000-memory.dmp

Filesize
1.4MB

Download
memory/4524-175-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/4524-177-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/4524-389-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-184-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-378-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-377-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-282-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-178-0x00000000058C0000-0x000000000595C000-memory.dmp

Filesize
624KB

Download
memory/4524-367-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4524-279-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/4644-286-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download
memory/4644-314-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-291-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-301-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-302-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-292-0x0000000000960000-0x0000000001374000-memory.dmp

Filesize
10.1MB

Download
memory/4644-294-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-296-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4644-311-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-289-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/4644-333-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-287-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-307-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-304-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-299-0x0000000002B20000-0x0000000003653000-memory.dmp

Filesize
11.2MB

Download
memory/4644-290-0x0000000003720000-0x0000000003860000-memory.dmp

Filesize
1.2MB

Download
memory/4644-288-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/4992-229-0x0000000001170000-0x0000000001175000-memory.dmp

Filesize
20KB

Download
memory/4992-239-0x0000000001160000-0x0000000001169000-memory.dmp

Filesize
36KB

Download
memory/4992-228-0x0000000001160000-0x0000000001169000-memory.dmp

Filesize
36KB

Download
memory/4992-368-0x0000000001170000-0x0000000001175000-memory.dmp

Filesize
20KB

Download