asyncrat | 9ec95ba3045441faf26617148720dfeec0dccd106813ee6ab3fe9157579cf78e

Analysis

max time kernel
18s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2023 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Acordx_protected.exe
Size

7.6MB
MD5

2c973cde88509f88aeedddb30d78b7a1
SHA1

708b76a1d72cafeb1c5e80e54ba2f1881af42591
SHA256

9ec95ba3045441faf26617148720dfeec0dccd106813ee6ab3fe9157579cf78e
SHA512

52acfff5952e22e158a30f113b4427b8ee127ec920ed6a8f43e1dea9289565ee880bc16e06a3895fcf2b58af771c54701802975c3e45e41ad402e80da7ed2fea
SSDEEP

196608:RENPY7533CN1ac1mTWkKqiDnYYI0JFMWoAV/oc:GG5wvET/TiDnYK/o

Score

10^/10

asyncrat echelon redline remcos sectoprat cheat default host venom clients evasion infostealer persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

soon-lp.at.ply.gg:17209

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
svchost.exe
copy_folder
SystemFiles
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_yxpjpevccr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
svchost
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

redline

Botnet

cheat

soon-lp.at.ply.gg:17209

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

soon-lp.at.ply.gg:17209

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Elhost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

soon-lp.at.ply.gg:17209

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
WinDick.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

VenomRAT_HVNC 5.0.4

Botnet

Venom Clients

soon-lp.at.ply.gg:17209

Mutex

gegK1OS7D

Attributes

delay
0
install
true
install_file
WinDuck.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detects Echelon Stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x001100000002315c-389.dat	family_echelon
behavioral1/files/0x001100000002315c-396.dat	family_echelon
behavioral1/files/0x001100000002315c-395.dat	family_echelon
behavioral1/memory/2752-397-0x000001D893130000-0x000001D8931C8000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Backdoor2.exesvchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	Backdoor2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	Backdoor2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	svchost.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000200000001e593-232.dat	family_redline
behavioral1/files/0x000200000001e593-238.dat	family_redline
behavioral1/files/0x000200000001e593-239.dat	family_redline
behavioral1/memory/3876-240-0x0000000000820000-0x000000000083E000-memory.dmp	family_redline

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000200000001e593-232.dat	family_sectoprat
behavioral1/files/0x000200000001e593-238.dat	family_sectoprat
behavioral1/files/0x000200000001e593-239.dat	family_sectoprat
behavioral1/memory/3876-240-0x0000000000820000-0x000000000083E000-memory.dmp	family_sectoprat

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Async RAT payload 13 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x000a00000001ea53-276.dat	asyncrat
behavioral1/files/0x000a00000001ea53-282.dat	asyncrat
behavioral1/files/0x000a00000001ea53-283.dat	asyncrat
behavioral1/memory/3928-284-0x0000000000C60000-0x0000000000C76000-memory.dmp	asyncrat
behavioral1/files/0x0002000000022ca8-312.dat	asyncrat
behavioral1/files/0x0002000000022ca8-318.dat	asyncrat
behavioral1/files/0x0002000000022ca8-319.dat	asyncrat
behavioral1/memory/2796-321-0x0000000000800000-0x0000000000816000-memory.dmp	asyncrat
behavioral1/files/0x000200000001e3e1-350.dat	asyncrat
behavioral1/files/0x000200000001e3e1-356.dat	asyncrat
behavioral1/files/0x000200000001e3e1-357.dat	asyncrat
behavioral1/memory/4240-358-0x0000000000270000-0x0000000000286000-memory.dmp	asyncrat
behavioral1/memory/4240-359-0x000000001B020000-0x000000001B030000-memory.dmp	asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Acordx_protected.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Acordx_protected.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeBackdoor2.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Backdoor2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	Backdoor2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Acordx_protected.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Acordx_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Acordx_protected.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Acordx_protected.exeBackdoor2.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	Acordx_protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	Backdoor2.exe

Executes dropped EXE 3 IoCs

Processes:

Backdoor2.exesvchost.exebuild.exe

pid	Process
2396	Backdoor2.exe
3444	svchost.exe
3876	build.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2380-137-0x0000000000040000-0x0000000000D7A000-memory.dmp	themida
behavioral1/memory/2380-138-0x0000000000040000-0x0000000000D7A000-memory.dmp	themida

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Backdoor2.exesvchost.exeAcordx_protected.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	Backdoor2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Backdoor2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Backdoor2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Backdoor2.exe"	Acordx_protected.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Backdoor2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\build = "C:\\Users\\Admin\\AppData\\Local\\Temp\\build.exe"	Acordx_protected.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemFiles\\svchost.exe\""	Backdoor2.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Acordx_protected.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Acordx_protected.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
17	ip-api.com
32	api.ipify.org
33	api.ipify.org

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Backdoor2.exesvchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	Backdoor2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Acordx_protected.exe

pid	Process
2380	Acordx_protected.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description	pid	Process	procid_target
PID 3444 set thread context of 4580	3444	svchost.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2372	3928	WerFault.exe	107
1192	2796	WerFault.exe	110
1300	4240	WerFault.exe	116

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
4888	reg.exe
4660	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3808	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Acordx_protected.exepowershell.exepowershell.exe

pid	Process
2380	Acordx_protected.exe
2380	Acordx_protected.exe
4536	powershell.exe
4536	powershell.exe
4424	powershell.exe
4424	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Acordx_protected.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2380	Acordx_protected.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

Acordx_protected.exeBackdoor2.execmd.execmd.exesvchost.execmd.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 4536	2380	Acordx_protected.exe	83
PID 2380 wrote to memory of 4536	2380	Acordx_protected.exe	83
PID 2380 wrote to memory of 4536	2380	Acordx_protected.exe	83
PID 2380 wrote to memory of 2396	2380	Acordx_protected.exe	89
PID 2380 wrote to memory of 2396	2380	Acordx_protected.exe	89
PID 2380 wrote to memory of 2396	2380	Acordx_protected.exe	89
PID 2380 wrote to memory of 4424	2380	Acordx_protected.exe	90
PID 2380 wrote to memory of 4424	2380	Acordx_protected.exe	90
PID 2380 wrote to memory of 4424	2380	Acordx_protected.exe	90
PID 2396 wrote to memory of 684	2396	Backdoor2.exe	92
PID 2396 wrote to memory of 684	2396	Backdoor2.exe	92
PID 2396 wrote to memory of 684	2396	Backdoor2.exe	92
PID 2396 wrote to memory of 4676	2396	Backdoor2.exe	94
PID 2396 wrote to memory of 4676	2396	Backdoor2.exe	94
PID 2396 wrote to memory of 4676	2396	Backdoor2.exe	94
PID 684 wrote to memory of 4888	684	cmd.exe	96
PID 684 wrote to memory of 4888	684	cmd.exe	96
PID 684 wrote to memory of 4888	684	cmd.exe	96
PID 4676 wrote to memory of 3808	4676	cmd.exe	97
PID 4676 wrote to memory of 3808	4676	cmd.exe	97
PID 4676 wrote to memory of 3808	4676	cmd.exe	97
PID 4676 wrote to memory of 3444	4676	cmd.exe	98
PID 4676 wrote to memory of 3444	4676	cmd.exe	98
PID 4676 wrote to memory of 3444	4676	cmd.exe	98
PID 3444 wrote to memory of 3472	3444	svchost.exe	99
PID 3444 wrote to memory of 3472	3444	svchost.exe	99
PID 3444 wrote to memory of 3472	3444	svchost.exe	99
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 3444 wrote to memory of 4580	3444	svchost.exe	101
PID 2380 wrote to memory of 3876	2380	Acordx_protected.exe	102
PID 2380 wrote to memory of 3876	2380	Acordx_protected.exe	102
PID 2380 wrote to memory of 3876	2380	Acordx_protected.exe	102
PID 2380 wrote to memory of 3732	2380	Acordx_protected.exe	103
PID 2380 wrote to memory of 3732	2380	Acordx_protected.exe	103
PID 2380 wrote to memory of 3732	2380	Acordx_protected.exe	103
PID 3472 wrote to memory of 4660	3472	cmd.exe	106
PID 3472 wrote to memory of 4660	3472	cmd.exe	106
PID 3472 wrote to memory of 4660	3472	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\Acordx_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Acordx_protected.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe
  "C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies WinLogon
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3808
  - - C:\Users\Admin\AppData\Roaming\SystemFiles\svchost.exe
      "C:\Users\Admin\AppData\Roaming\SystemFiles\svchost.exe"
      4⤵
      Modifies WinLogon for persistence
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:4660
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:4580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\build.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe'
  2⤵
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe
  "C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe"
  2⤵
  PID:3928
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3928 -s 1136
    3⤵
    - Program crash
    PID:2372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe'
  2⤵
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe
  "C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe"
  2⤵
  PID:2796
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2796 -s 1132
    3⤵
    - Program crash
    PID:1192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe'
  2⤵
  PID:384
- C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe
  "C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe"
  2⤵
  PID:4240
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4240 -s 1112
    3⤵
    - Program crash
    PID:1300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Echelon.exe'
  2⤵
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\Echelon.exe
  "C:\Users\Admin\AppData\Local\Temp\Echelon.exe"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Infected.exe'
  2⤵
  PID:2756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 3928 -ip 3928
1⤵
PID:4716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 2796 -ip 2796
1⤵
PID:3312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 4240 -ip 4240
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
4eb87b291ee2e0e905a5849c544d75de

SHA1
f2a0993fb965093b7d5f56209af7f3183e28755e

SHA256
b95e96d1f89dfb750ab8d289ba3fe2f1a367588cc3fcd907832660aa4eb00da7

SHA512
bc7cd068a258fa4a57c1d68390deee84c924ba8c372c82f10499d78cbb48d762893eda2dac2fd05354a269f667e66db83915da9c924d4a54efa5d1e00ee52a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a969d921d6b502e0e352531146f2df1c

SHA1
37c95f709153a3c194e3c97ca5bcd041d4b2479c

SHA256
baf21d9cc681d13aa10663a8ec64bd002d58446248fefd6de2a400fd1cc95165

SHA512
e13e58f112a124cfa20478d07d389b1b3629f4e942ad44052930c6e7866952f15553dcebc1ca460196428d4da3fbacc3119bf588b55d8f5eca539878c406eb05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
92da32ba391e5a6fd1ad5ba737b2178f

SHA1
bfcd1f9f1cd5e2da17d35998212a7373d0d7c2d8

SHA256
dd03a0f3fdf6d58fafcd478168e6712634f8961a57eff3ff834999913b67c026

SHA512
604d6417797b3a5487847efd0ffc191c1cf375bc081b36e25b973e53c1a483796c6bfc98d27c18f94830848d044de41b0ef952609b95388e565627822b24baca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
87d9d748525366f4ccdf64749d2ce58c

SHA1
7fbeedf271ed6b812821404caa0d53c7bafe0614

SHA256
e2eefa8c5b0d0a7ef66c5f006333f2ee130dba25d5db9a569be9e7ad1aae39a3

SHA512
0fdb090d7dcfb66ffa61e419e7ed4be39ef6e34f6e449738de4ed6abc998b4da81616cb9a825b25953d45356a44a9bf979b6968d80bdae0ddc5cdaa29d2d132d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cb96d5d2a6d791ba39421a9a1a89ccef

SHA1
45b5cee93afb762f0b921494f14001b006dbb538

SHA256
a862ce9adb19b8ae3b4a7da7bba2358fb33f35e33ad6c8d5dcc3382913e9425d

SHA512
1467bc8cb3c62064d6db987cf1950668c6497585fdf178679a8eaa544cd17de04e4cc80c893b6641e64b1a886f0f72e12e3cd70c9239f81595358e499029dda6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8b2c9dc58706773a22fc29aa5d7923d5

SHA1
1d53cd5c9375978df8d0be4d31b5980da3cc1d8e

SHA256
bbc0e2f5f9ce840a3b647a78439c6876f98236d86bd8e69798f37e3801e86251

SHA512
57cb76c37fdd63eba5454d516e5333cd519ae4ea4c565bdc7b5aadcb3082b4e75e9e48a4b49f42447a0dab6de131be85da209603189a36ef21661904f781c309

Download Submit
C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe

Filesize
92KB

MD5
77db83de06f8b41b239b01134207e794

SHA1
c3b263c2baa7698737c88208d4febf2353e9fc9f

SHA256
402a7575a8f8338208ad825f205ecb458eb2a510ff773c9e0a86b0f9a2c8f470

SHA512
ff3c150a78652fac531107eaaffabcb0ea3022ba3821f761b5fd182cacd22818f3e24cd71b302a34addda5373d8ac94d49b052d9ff0a7f889d22a1f21401cb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe

Filesize
92KB

MD5
77db83de06f8b41b239b01134207e794

SHA1
c3b263c2baa7698737c88208d4febf2353e9fc9f

SHA256
402a7575a8f8338208ad825f205ecb458eb2a510ff773c9e0a86b0f9a2c8f470

SHA512
ff3c150a78652fac531107eaaffabcb0ea3022ba3821f761b5fd182cacd22818f3e24cd71b302a34addda5373d8ac94d49b052d9ff0a7f889d22a1f21401cb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Backdoor2.exe

Filesize
92KB

MD5
77db83de06f8b41b239b01134207e794

SHA1
c3b263c2baa7698737c88208d4febf2353e9fc9f

SHA256
402a7575a8f8338208ad825f205ecb458eb2a510ff773c9e0a86b0f9a2c8f470

SHA512
ff3c150a78652fac531107eaaffabcb0ea3022ba3821f761b5fd182cacd22818f3e24cd71b302a34addda5373d8ac94d49b052d9ff0a7f889d22a1f21401cb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe

Filesize
63KB

MD5
f5c08536342b567bd321df4194b42fab

SHA1
1b64ca8662da91319c8edbdc92373d1bb1d67bb1

SHA256
06ec8d1b69862cd07af3a225b33842fbfbc8ecb54e64e92cda95e61def468949

SHA512
bcee4c3efae7c8716288a84c13a8ba1e8fc963e194ac68003c0d6bee822961b44fe3b08f1e4a9f66988f53659f116b4a917c695cae2d186ed6389390d3a15aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe

Filesize
63KB

MD5
f5c08536342b567bd321df4194b42fab

SHA1
1b64ca8662da91319c8edbdc92373d1bb1d67bb1

SHA256
06ec8d1b69862cd07af3a225b33842fbfbc8ecb54e64e92cda95e61def468949

SHA512
bcee4c3efae7c8716288a84c13a8ba1e8fc963e194ac68003c0d6bee822961b44fe3b08f1e4a9f66988f53659f116b4a917c695cae2d186ed6389390d3a15aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientDcRAAT.exe

Filesize
63KB

MD5
f5c08536342b567bd321df4194b42fab

SHA1
1b64ca8662da91319c8edbdc92373d1bb1d67bb1

SHA256
06ec8d1b69862cd07af3a225b33842fbfbc8ecb54e64e92cda95e61def468949

SHA512
bcee4c3efae7c8716288a84c13a8ba1e8fc963e194ac68003c0d6bee822961b44fe3b08f1e4a9f66988f53659f116b4a917c695cae2d186ed6389390d3a15aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe

Filesize
63KB

MD5
f14e2085a04dfae9eac9c9ab3090fd7e

SHA1
13820d403e06710e8b922d51daad8c8f35281b7f

SHA256
2d9711659df55e3638872f788da97beadf34a06700f533730f49a4990dbe3f3c

SHA512
87574fb1ed6e3d75d702b1a4cce3ee28fc4b57fd2b2defb42c0b3b6f2dcedf13677728f7b22fc22d77ba81ca7bd8264cce4a21a4fbf62065086fb744a2480494

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe

Filesize
63KB

MD5
f14e2085a04dfae9eac9c9ab3090fd7e

SHA1
13820d403e06710e8b922d51daad8c8f35281b7f

SHA256
2d9711659df55e3638872f788da97beadf34a06700f533730f49a4990dbe3f3c

SHA512
87574fb1ed6e3d75d702b1a4cce3ee28fc4b57fd2b2defb42c0b3b6f2dcedf13677728f7b22fc22d77ba81ca7bd8264cce4a21a4fbf62065086fb744a2480494

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom.exe

Filesize
63KB

MD5
f14e2085a04dfae9eac9c9ab3090fd7e

SHA1
13820d403e06710e8b922d51daad8c8f35281b7f

SHA256
2d9711659df55e3638872f788da97beadf34a06700f533730f49a4990dbe3f3c

SHA512
87574fb1ed6e3d75d702b1a4cce3ee28fc4b57fd2b2defb42c0b3b6f2dcedf13677728f7b22fc22d77ba81ca7bd8264cce4a21a4fbf62065086fb744a2480494

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe

Filesize
65KB

MD5
d5bded77108cb381fb53374eed685c8a

SHA1
502310583d3862580e8582b8be3cba3bb40a2d9f

SHA256
ebb271d09c88d4387a700614870596e516e6056999d3b735415de1cb51231f71

SHA512
582e678cc38a91ef37207156ca77a8eb9d8ae65eb291d3295b4d164e58889ad6d62ec22749d4f63b874da23445f0532000a94020c11f4f3328c4aec5c1393301

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe

Filesize
65KB

MD5
d5bded77108cb381fb53374eed685c8a

SHA1
502310583d3862580e8582b8be3cba3bb40a2d9f

SHA256
ebb271d09c88d4387a700614870596e516e6056999d3b735415de1cb51231f71

SHA512
582e678cc38a91ef37207156ca77a8eb9d8ae65eb291d3295b4d164e58889ad6d62ec22749d4f63b874da23445f0532000a94020c11f4f3328c4aec5c1393301

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientVenom2.exe

Filesize
65KB

MD5
d5bded77108cb381fb53374eed685c8a

SHA1
502310583d3862580e8582b8be3cba3bb40a2d9f

SHA256
ebb271d09c88d4387a700614870596e516e6056999d3b735415de1cb51231f71

SHA512
582e678cc38a91ef37207156ca77a8eb9d8ae65eb291d3295b4d164e58889ad6d62ec22749d4f63b874da23445f0532000a94020c11f4f3328c4aec5c1393301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Echelon.exe

Filesize
581KB

MD5
21a292e7e184b1f76594b25db2e651b0

SHA1
101293648396481ff270e66aecaf0e061a38313b

SHA256
3dfee3703ea081d2abc9a6b23c5be666a11134086326869ff6a4acb53b9c5be9

SHA512
83e4c304662eb5e636cd2f2a5a235be8c301a2ee23d7b7e91b70d2b10acbbd7c8250f873fdb0d23f42a4ed4ca069b07ed1945acd1627169d07e913d2f9466f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Echelon.exe

Filesize
581KB

MD5
21a292e7e184b1f76594b25db2e651b0

SHA1
101293648396481ff270e66aecaf0e061a38313b

SHA256
3dfee3703ea081d2abc9a6b23c5be666a11134086326869ff6a4acb53b9c5be9

SHA512
83e4c304662eb5e636cd2f2a5a235be8c301a2ee23d7b7e91b70d2b10acbbd7c8250f873fdb0d23f42a4ed4ca069b07ed1945acd1627169d07e913d2f9466f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Echelon.exe

Filesize
581KB

MD5
21a292e7e184b1f76594b25db2e651b0

SHA1
101293648396481ff270e66aecaf0e061a38313b

SHA256
3dfee3703ea081d2abc9a6b23c5be666a11134086326869ff6a4acb53b9c5be9

SHA512
83e4c304662eb5e636cd2f2a5a235be8c301a2ee23d7b7e91b70d2b10acbbd7c8250f873fdb0d23f42a4ed4ca069b07ed1945acd1627169d07e913d2f9466f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pshfp5kh.3ta.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
95KB

MD5
0e141953b88b275c2d5361a45294b3d1

SHA1
cf7b272cd6ad3fbc4684aecae184595f2f23ce05

SHA256
12abfe88e3f6e6104993063130279a790fbb26f6f8737428445aa47bbe26496b

SHA512
023009aac8e4e650b8f23f41a9650c253450ab6f84ec2db408ea431c119e09cc7b3b4a73627e14269920d540a6e16139cbe0ddac29ab0e94eacf2ca2818530bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
95KB

MD5
0e141953b88b275c2d5361a45294b3d1

SHA1
cf7b272cd6ad3fbc4684aecae184595f2f23ce05

SHA256
12abfe88e3f6e6104993063130279a790fbb26f6f8737428445aa47bbe26496b

SHA512
023009aac8e4e650b8f23f41a9650c253450ab6f84ec2db408ea431c119e09cc7b3b4a73627e14269920d540a6e16139cbe0ddac29ab0e94eacf2ca2818530bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
95KB

MD5
0e141953b88b275c2d5361a45294b3d1

SHA1
cf7b272cd6ad3fbc4684aecae184595f2f23ce05

SHA256
12abfe88e3f6e6104993063130279a790fbb26f6f8737428445aa47bbe26496b

SHA512
023009aac8e4e650b8f23f41a9650c253450ab6f84ec2db408ea431c119e09cc7b3b4a73627e14269920d540a6e16139cbe0ddac29ab0e94eacf2ca2818530bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
105B

MD5
7a3cee59c3843389dd20473049f8bd05

SHA1
e5b37b1ea4e69f5bdb3e8b9c916282262380c66c

SHA256
8653b5094033b91b6f137947f70b4d8f6b5550848f899e4ce7f3e245a07257c7

SHA512
4d7edc5506b9b80e3bfd2dda088e7dd14f82a17ba1073dc7874b4ed93596b95c6ae0decf0c0d16b2c61966a0421c6cfe398b411ad75734b64f40a5710fafcac3

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\svchost.exe

Filesize
92KB

MD5
77db83de06f8b41b239b01134207e794

SHA1
c3b263c2baa7698737c88208d4febf2353e9fc9f

SHA256
402a7575a8f8338208ad825f205ecb458eb2a510ff773c9e0a86b0f9a2c8f470

SHA512
ff3c150a78652fac531107eaaffabcb0ea3022ba3821f761b5fd182cacd22818f3e24cd71b302a34addda5373d8ac94d49b052d9ff0a7f889d22a1f21401cb79

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\svchost.exe

Filesize
92KB

MD5
77db83de06f8b41b239b01134207e794

SHA1
c3b263c2baa7698737c88208d4febf2353e9fc9f

SHA256
402a7575a8f8338208ad825f205ecb458eb2a510ff773c9e0a86b0f9a2c8f470

SHA512
ff3c150a78652fac531107eaaffabcb0ea3022ba3821f761b5fd182cacd22818f3e24cd71b302a34addda5373d8ac94d49b052d9ff0a7f889d22a1f21401cb79

Download Submit
memory/384-332-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/384-335-0x000000006F9C0000-0x000000006FA0C000-memory.dmp

Filesize
304KB

Download
memory/384-333-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/2380-133-0x0000000000040000-0x0000000000D7A000-memory.dmp

Filesize
13.2MB

Download
memory/2380-139-0x00000000057E0000-0x000000000587C000-memory.dmp

Filesize
624KB

Download
memory/2380-137-0x0000000000040000-0x0000000000D7A000-memory.dmp

Filesize
13.2MB

Download
memory/2380-141-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/2380-221-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/2380-140-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/2380-138-0x0000000000040000-0x0000000000D7A000-memory.dmp

Filesize
13.2MB

Download
memory/2380-176-0x0000000000040000-0x0000000000D7A000-memory.dmp

Filesize
13.2MB

Download
memory/2752-397-0x000001D893130000-0x000001D8931C8000-memory.dmp

Filesize
608KB

Download
memory/2756-411-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/2756-412-0x000000006F9C0000-0x000000006FA0C000-memory.dmp

Filesize
304KB

Download
memory/2756-410-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

Filesize
64KB

Download
memory/2796-334-0x0000000000E80000-0x0000000000E90000-memory.dmp

Filesize
64KB

Download
memory/2796-321-0x0000000000800000-0x0000000000816000-memory.dmp

Filesize
88KB

Download
memory/2964-360-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/2964-361-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/2964-372-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/2964-373-0x000000006F9C0000-0x000000006FA0C000-memory.dmp

Filesize
304KB

Download
memory/2964-383-0x000000007F170000-0x000000007F180000-memory.dmp

Filesize
64KB

Download
memory/3732-242-0x00000000044B0000-0x00000000044C0000-memory.dmp

Filesize
64KB

Download
memory/3732-244-0x00000000044B0000-0x00000000044C0000-memory.dmp

Filesize
64KB

Download
memory/3732-258-0x000000006F9C0000-0x000000006FA0C000-memory.dmp

Filesize
304KB

Download
memory/3732-270-0x000000007FAB0000-0x000000007FAC0000-memory.dmp

Filesize
64KB

Download
memory/3732-269-0x00000000044B0000-0x00000000044C0000-memory.dmp

Filesize
64KB

Download
memory/3876-241-0x00000000057C0000-0x0000000005DD8000-memory.dmp

Filesize
6.1MB

Download
memory/3876-240-0x0000000000820000-0x000000000083E000-memory.dmp

Filesize
120KB

Download
memory/3876-256-0x0000000005380000-0x000000000548A000-memory.dmp

Filesize
1.0MB

Download
memory/3876-245-0x00000000050D0000-0x000000000510C000-memory.dmp

Filesize
240KB

Download
memory/3876-408-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3876-257-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3876-243-0x0000000005070000-0x0000000005082000-memory.dmp

Filesize
72KB

Download
memory/3928-284-0x0000000000C60000-0x0000000000C76000-memory.dmp

Filesize
88KB

Download
memory/3928-320-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Filesize
64KB

Download
memory/4240-359-0x000000001B020000-0x000000001B030000-memory.dmp

Filesize
64KB

Download
memory/4240-358-0x0000000000270000-0x0000000000286000-memory.dmp

Filesize
88KB

Download
memory/4424-222-0x000000007FAF0000-0x000000007FB00000-memory.dmp

Filesize
64KB

Download
memory/4424-207-0x00000000044B0000-0x00000000044C0000-memory.dmp

Filesize
64KB

Download
memory/4424-211-0x00000000700C0000-0x000000007010C000-memory.dmp

Filesize
304KB

Download
memory/4424-208-0x00000000044B0000-0x00000000044C0000-memory.dmp

Filesize
64KB

Download
memory/4536-160-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4536-156-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4536-179-0x0000000007D40000-0x0000000007D5A000-memory.dmp

Filesize
104KB

Download
memory/4536-178-0x0000000007C30000-0x0000000007C3E000-memory.dmp

Filesize
56KB

Download
memory/4536-177-0x0000000007C80000-0x0000000007D16000-memory.dmp

Filesize
600KB

Download
memory/4536-175-0x0000000007A70000-0x0000000007A7A000-memory.dmp

Filesize
40KB

Download
memory/4536-142-0x0000000002DE0000-0x0000000002E16000-memory.dmp

Filesize
216KB

Download
memory/4536-143-0x0000000005970000-0x0000000005F98000-memory.dmp

Filesize
6.2MB

Download
memory/4536-174-0x00000000079F0000-0x0000000007A0A000-memory.dmp

Filesize
104KB

Download
memory/4536-173-0x0000000008040000-0x00000000086BA000-memory.dmp

Filesize
6.5MB

Download
memory/4536-172-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

Filesize
120KB

Download
memory/4536-161-0x000000006FCA0000-0x000000006FCEC000-memory.dmp

Filesize
304KB

Download
memory/4536-162-0x000000007F5D0000-0x000000007F5E0000-memory.dmp

Filesize
64KB

Download
memory/4536-144-0x0000000005820000-0x0000000005842000-memory.dmp

Filesize
136KB

Download
memory/4536-159-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

Filesize
200KB

Download
memory/4536-157-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/4536-180-0x0000000007D20000-0x0000000007D28000-memory.dmp

Filesize
32KB

Download
memory/4536-155-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4536-145-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/4580-230-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4652-295-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/4652-296-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/4652-297-0x000000006F9C0000-0x000000006FA0C000-memory.dmp

Filesize
304KB

Download