smokeloader | dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2023 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe
Size

363KB
MD5

dccb60fb185d8098f3844b5d5777a045
SHA1

2b8e3b905310d713a443b844e110dbb71359b09c
SHA256

dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4
SHA512

edb8ee6fda1764a2958e9b932828e579c2408cdd29919331f461a02107d01be48d3e03f51329410630c614d933302b4df380efe38616cdaa7754cd267d566639
SSDEEP

3072:wwH52YRs4UEbwIeG+p1C3nIsP3ozz6rRZ+pr4/lGW/o2xNbr7ZwVRU/qIUgd1Uvc:tEYC4UmwIeG/I+3Ks/UC7ZwV8Pyo

Score

10^/10

smokeloader 0024 backdoor collection evasion trojan

Malware Config

Extracted

Family

smokeloader

Botnet

0024

Extracted

Family

smokeloader

Version

2022

https://utah-saints.com/search.php

https://atlanta-newspaper.com/search.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1140	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe

Executes dropped EXE 2 IoCs

pid	Process
852	7524685051.exe
2224	bwsgvhc

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	776	WerFault.exe	81

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwsgvhc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwsgvhc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bwsgvhc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7524685051.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7524685051.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7524685051.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4992	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4344	NETSTAT.EXE
4692	ipconfig.exe
5028	ipconfig.exe
568	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2560	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
608	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31062127"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9070c259a7e7d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31062127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{80F860A2-539A-11EE-9359-C68ECCB5A471} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023945248a016ff4caf831eebccac29d800000000020000000000106600000001000020000000742be8f44ab835d59c67bb0610460ae3ae1bd7f109fabd149f1a88c4b88ad9ce000000000e8000000002000020000000613db7650900dffd86d59db9f58d5f4085f8f871b989197716e7739e1626a007200000002f0869135a560b46f186283136b829bf023e390bcde34e5561c31fd878bf03b6400000007c20a4e9328f0ba42e34d4a4747a15c5abb5ef44a4198ae4babd0aa8c3853c17ed67e418f16f00758c17bb2187e2226fae852e90209947f3270398ea6bc6a7b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Main	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3151064888"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31062127"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3150752222"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31062127"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04a9c59a7e7d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3151064888"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403373604"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023945248a016ff4caf831eebccac29d8000000000200000000001066000000010000200000008c7ace235b382407af957c1db00e612b044f33956c5aaff629f587c18d70fa19000000000e80000000020000200000004b41e307b9c925271a169409617780e8c324b05a27e4a0fa9651a92fedff96cf20000000a9fe9d9b421c3233a65dc4faea4428fe107b293239d33f345ea85c3aff61554f400000000efb2fc6497f1f0cf419fe018826b64634a549b6b842a7711550d3b70b468c02389261047c0f04d4e7df1cae604bc4ff3a2c41a4e57bcdfd20b761e6534ef113	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3150752222"	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
852	7524685051.exe
852	7524685051.exe
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
536	Process not Found

Suspicious behavior: MapViewOfSection 26 IoCs

pid	Process
852	7524685051.exe
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
4644	explorer.exe
4644	explorer.exe
536	Process not Found
536	Process not Found
4412	explorer.exe
4412	explorer.exe
536	Process not Found
536	Process not Found
3336	explorer.exe
3336	explorer.exe
536	Process not Found
536	Process not Found
3292	explorer.exe
3292	explorer.exe
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
2224	bwsgvhc

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeIncreaseQuotaPrivilege	3376	WMIC.exe
Token: SeSecurityPrivilege	3376	WMIC.exe
Token: SeTakeOwnershipPrivilege	3376	WMIC.exe
Token: SeLoadDriverPrivilege	3376	WMIC.exe
Token: SeSystemProfilePrivilege	3376	WMIC.exe
Token: SeSystemtimePrivilege	3376	WMIC.exe
Token: SeProfSingleProcessPrivilege	3376	WMIC.exe
Token: SeIncBasePriorityPrivilege	3376	WMIC.exe
Token: SeCreatePagefilePrivilege	3376	WMIC.exe
Token: SeBackupPrivilege	3376	WMIC.exe
Token: SeRestorePrivilege	3376	WMIC.exe
Token: SeShutdownPrivilege	3376	WMIC.exe
Token: SeDebugPrivilege	3376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3376	WMIC.exe
Token: SeRemoteShutdownPrivilege	3376	WMIC.exe
Token: SeUndockPrivilege	3376	WMIC.exe
Token: SeManageVolumePrivilege	3376	WMIC.exe
Token: 33	3376	WMIC.exe
Token: 34	3376	WMIC.exe
Token: 35	3376	WMIC.exe
Token: 36	3376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3376	WMIC.exe
Token: SeSecurityPrivilege	3376	WMIC.exe
Token: SeTakeOwnershipPrivilege	3376	WMIC.exe
Token: SeLoadDriverPrivilege	3376	WMIC.exe
Token: SeSystemProfilePrivilege	3376	WMIC.exe
Token: SeSystemtimePrivilege	3376	WMIC.exe
Token: SeProfSingleProcessPrivilege	3376	WMIC.exe
Token: SeIncBasePriorityPrivilege	3376	WMIC.exe
Token: SeCreatePagefilePrivilege	3376	WMIC.exe
Token: SeBackupPrivilege	3376	WMIC.exe
Token: SeRestorePrivilege	3376	WMIC.exe
Token: SeShutdownPrivilege	3376	WMIC.exe
Token: SeDebugPrivilege	3376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3376	WMIC.exe
Token: SeRemoteShutdownPrivilege	3376	WMIC.exe
Token: SeUndockPrivilege	3376	WMIC.exe
Token: SeManageVolumePrivilege	3376	WMIC.exe
Token: 33	3376	WMIC.exe
Token: 34	3376	WMIC.exe
Token: 35	3376	WMIC.exe
Token: 36	3376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2792	WMIC.exe
Token: SeSecurityPrivilege	2792	WMIC.exe
Token: SeTakeOwnershipPrivilege	2792	WMIC.exe
Token: SeLoadDriverPrivilege	2792	WMIC.exe
Token: SeSystemProfilePrivilege	2792	WMIC.exe
Token: SeSystemtimePrivilege	2792	WMIC.exe
Token: SeProfSingleProcessPrivilege	2792	WMIC.exe
Token: SeIncBasePriorityPrivilege	2792	WMIC.exe
Token: SeCreatePagefilePrivilege	2792	WMIC.exe
Token: SeBackupPrivilege	2792	WMIC.exe
Token: SeRestorePrivilege	2792	WMIC.exe
Token: SeShutdownPrivilege	2792	WMIC.exe
Token: SeDebugPrivilege	2792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2792	WMIC.exe
Token: SeRemoteShutdownPrivilege	2792	WMIC.exe
Token: SeUndockPrivilege	2792	WMIC.exe
Token: SeManageVolumePrivilege	2792	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1356	iexplore.exe
1356	iexplore.exe
1256	IEXPLORE.EXE
1256	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
536	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 4436	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	89
PID 776 wrote to memory of 4436	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	89
PID 776 wrote to memory of 4436	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	89
PID 4436 wrote to memory of 852	4436	cmd.exe	91
PID 4436 wrote to memory of 852	4436	cmd.exe	91
PID 4436 wrote to memory of 852	4436	cmd.exe	91
PID 776 wrote to memory of 1504	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	94
PID 776 wrote to memory of 1504	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	94
PID 776 wrote to memory of 1504	776	NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe	94
PID 1504 wrote to memory of 608	1504	cmd.exe	97
PID 1504 wrote to memory of 608	1504	cmd.exe	97
PID 1504 wrote to memory of 608	1504	cmd.exe	97
PID 536 wrote to memory of 4516	536	Process not Found	105
PID 536 wrote to memory of 4516	536	Process not Found	105
PID 4516 wrote to memory of 3376	4516	cmd.exe	107
PID 4516 wrote to memory of 3376	4516	cmd.exe	107
PID 4516 wrote to memory of 2792	4516	cmd.exe	108
PID 4516 wrote to memory of 2792	4516	cmd.exe	108
PID 4516 wrote to memory of 3916	4516	cmd.exe	109
PID 4516 wrote to memory of 3916	4516	cmd.exe	109
PID 4516 wrote to memory of 4188	4516	cmd.exe	110
PID 4516 wrote to memory of 4188	4516	cmd.exe	110
PID 4516 wrote to memory of 4700	4516	cmd.exe	111
PID 4516 wrote to memory of 4700	4516	cmd.exe	111
PID 4516 wrote to memory of 3012	4516	cmd.exe	114
PID 4516 wrote to memory of 3012	4516	cmd.exe	114
PID 4516 wrote to memory of 776	4516	cmd.exe	115
PID 4516 wrote to memory of 776	4516	cmd.exe	115
PID 4516 wrote to memory of 4668	4516	cmd.exe	116
PID 4516 wrote to memory of 4668	4516	cmd.exe	116
PID 4516 wrote to memory of 3320	4516	cmd.exe	117
PID 4516 wrote to memory of 3320	4516	cmd.exe	117
PID 4516 wrote to memory of 1448	4516	cmd.exe	118
PID 4516 wrote to memory of 1448	4516	cmd.exe	118
PID 4516 wrote to memory of 2304	4516	cmd.exe	119
PID 4516 wrote to memory of 2304	4516	cmd.exe	119
PID 4516 wrote to memory of 640	4516	cmd.exe	120
PID 4516 wrote to memory of 640	4516	cmd.exe	120
PID 4516 wrote to memory of 1684	4516	cmd.exe	121
PID 4516 wrote to memory of 1684	4516	cmd.exe	121
PID 4516 wrote to memory of 2776	4516	cmd.exe	122
PID 4516 wrote to memory of 2776	4516	cmd.exe	122
PID 4516 wrote to memory of 5028	4516	cmd.exe	123
PID 4516 wrote to memory of 5028	4516	cmd.exe	123
PID 4516 wrote to memory of 3700	4516	cmd.exe	124
PID 4516 wrote to memory of 3700	4516	cmd.exe	124
PID 4516 wrote to memory of 1140	4516	cmd.exe	125
PID 4516 wrote to memory of 1140	4516	cmd.exe	125
PID 4516 wrote to memory of 2560	4516	cmd.exe	126
PID 4516 wrote to memory of 2560	4516	cmd.exe	126
PID 4516 wrote to memory of 4992	4516	cmd.exe	129
PID 4516 wrote to memory of 4992	4516	cmd.exe	129
PID 4516 wrote to memory of 2316	4516	cmd.exe	130
PID 4516 wrote to memory of 2316	4516	cmd.exe	130
PID 2316 wrote to memory of 2244	2316	net.exe	131
PID 2316 wrote to memory of 2244	2316	net.exe	131
PID 4516 wrote to memory of 2368	4516	cmd.exe	132
PID 4516 wrote to memory of 2368	4516	cmd.exe	132
PID 2368 wrote to memory of 2772	2368	net.exe	133
PID 2368 wrote to memory of 2772	2368	net.exe	133
PID 4516 wrote to memory of 3584	4516	cmd.exe	134
PID 4516 wrote to memory of 3584	4516	cmd.exe	134
PID 3584 wrote to memory of 4628	3584	net.exe	135
PID 3584 wrote to memory of 4628	3584	net.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7524685051.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\7524685051.exe
    "C:\Users\Admin\AppData\Local\Temp\7524685051.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "NEAS.dfa1030b49da1997953542e47d394a5e3327ce225bc779a20a93f3f1ea7502f4_JC.exe" /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 1916
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 776 -ip 776
1⤵
PID:4420

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:3916
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:4188
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:4700
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:3012
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:776
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:4668
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:3320
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:1448
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:2304
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:640
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:1684
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:2776
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:5028
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:3700
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  - Modifies Windows Firewall
  PID:1140
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:2560
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:4992
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /domain
    3⤵
    PID:2244
- C:\Windows\system32\net.exe
  net share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2772
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:4628
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  PID:3860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:2508
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:3296
- C:\Windows\system32\net.exe
  net group
  2⤵
  PID:2452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:1864
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:3940
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:3008
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:2208
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:4344
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:1020
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:4692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2012

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2984

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3080

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4644

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4412

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3336

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3292

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:416

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4172

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:5008

C:\Users\Admin\AppData\Roaming\bwsgvhc
C:\Users\Admin\AppData\Roaming\bwsgvhc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
ca7aa1552b8e746b223230ee151b13ad

SHA1
bea0fcff66046ee3002a086ee83c5f6157953b07

SHA256
05de90ef59ac33a56f11962fbf63dd0c4f0c6e64dacdb4683fb5fdd5c082f4fa

SHA512
1acac953c6267aeb8327699eadcdca503bd184cb3799db868eacda29e63e30a10d8fa51e1fb38674dddaff2bff5b61a96e8755c74c74001d87eb4112286a695b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7793.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OSZCC7QI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\7524685051.exe

Filesize
274KB

MD5
ea6e8732d13f02bcb8cde4af291590a5

SHA1
49dfe71339cf21b1f749859f27ee6b4c29378caa

SHA256
4ccc468fd4c83387a765113d8006dcc8ee047813c788f2ac41534d5158eaae22

SHA512
fb3e837cdac980c4265321d5074316992f7c7ebeece9cac02f562d65639c65d0344020dea7bff83e79e32878569486218a5268b338dcfe2f2f5508a249bb206c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7524685051.exe

Filesize
274KB

MD5
ea6e8732d13f02bcb8cde4af291590a5

SHA1
49dfe71339cf21b1f749859f27ee6b4c29378caa

SHA256
4ccc468fd4c83387a765113d8006dcc8ee047813c788f2ac41534d5158eaae22

SHA512
fb3e837cdac980c4265321d5074316992f7c7ebeece9cac02f562d65639c65d0344020dea7bff83e79e32878569486218a5268b338dcfe2f2f5508a249bb206c

Download Submit
C:\Users\Admin\AppData\Roaming\bwsgvhc

Filesize
274KB

MD5
ea6e8732d13f02bcb8cde4af291590a5

SHA1
49dfe71339cf21b1f749859f27ee6b4c29378caa

SHA256
4ccc468fd4c83387a765113d8006dcc8ee047813c788f2ac41534d5158eaae22

SHA512
fb3e837cdac980c4265321d5074316992f7c7ebeece9cac02f562d65639c65d0344020dea7bff83e79e32878569486218a5268b338dcfe2f2f5508a249bb206c

Download Submit
C:\Users\Admin\AppData\Roaming\bwsgvhc

Filesize
274KB

MD5
ea6e8732d13f02bcb8cde4af291590a5

SHA1
49dfe71339cf21b1f749859f27ee6b4c29378caa

SHA256
4ccc468fd4c83387a765113d8006dcc8ee047813c788f2ac41534d5158eaae22

SHA512
fb3e837cdac980c4265321d5074316992f7c7ebeece9cac02f562d65639c65d0344020dea7bff83e79e32878569486218a5268b338dcfe2f2f5508a249bb206c

Download Submit
C:\Users\Admin\AppData\Roaming\bwsgvhc

Filesize
274KB

MD5
ea6e8732d13f02bcb8cde4af291590a5

SHA1
49dfe71339cf21b1f749859f27ee6b4c29378caa

SHA256
4ccc468fd4c83387a765113d8006dcc8ee047813c788f2ac41534d5158eaae22

SHA512
fb3e837cdac980c4265321d5074316992f7c7ebeece9cac02f562d65639c65d0344020dea7bff83e79e32878569486218a5268b338dcfe2f2f5508a249bb206c

Download Submit
memory/416-145-0x0000000000890000-0x000000000089B000-memory.dmp

Filesize
44KB

Download
memory/416-144-0x00000000008A0000-0x00000000008A6000-memory.dmp

Filesize
24KB

Download
memory/416-143-0x0000000000890000-0x000000000089B000-memory.dmp

Filesize
44KB

Download
memory/536-141-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/536-151-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-37-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-36-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-39-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-40-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-41-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-43-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-45-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-46-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-47-0x0000000003130000-0x0000000003140000-memory.dmp

Filesize
64KB

Download
memory/536-48-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-49-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-51-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-53-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/536-55-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-52-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-50-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/536-59-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-60-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-57-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-61-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-63-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-62-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-65-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-64-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-66-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-67-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-68-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-69-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/536-35-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-76-0x0000000003130000-0x000000000313F000-memory.dmp

Filesize
60KB

Download
memory/536-77-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/536-191-0x0000000002CC0000-0x0000000002CD6000-memory.dmp

Filesize
88KB

Download
memory/536-31-0x00000000030C0000-0x00000000030D6000-memory.dmp

Filesize
88KB

Download
memory/536-160-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-164-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-162-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-163-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-161-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-159-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-157-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-156-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-155-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/536-154-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-149-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-150-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/536-38-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-146-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-148-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-142-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-135-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-125-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-126-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-127-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/536-140-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-129-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-130-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-131-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-133-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-138-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/536-136-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/776-2-0x0000000003FF0000-0x000000000402E000-memory.dmp

Filesize
248KB

Download
memory/776-3-0x0000000000400000-0x00000000022A1000-memory.dmp

Filesize
30.6MB

Download
memory/776-1-0x0000000002380000-0x0000000002480000-memory.dmp

Filesize
1024KB

Download
memory/776-4-0x0000000000400000-0x00000000022A1000-memory.dmp

Filesize
30.6MB

Download
memory/776-29-0x0000000000400000-0x00000000022A1000-memory.dmp

Filesize
30.6MB

Download
memory/776-23-0x0000000002380000-0x0000000002480000-memory.dmp

Filesize
1024KB

Download
memory/776-25-0x0000000003FF0000-0x000000000402E000-memory.dmp

Filesize
248KB

Download
memory/852-26-0x0000000002310000-0x0000000002410000-memory.dmp

Filesize
1024KB

Download
memory/852-33-0x0000000000400000-0x000000000228B000-memory.dmp

Filesize
30.5MB

Download
memory/852-28-0x0000000000400000-0x000000000228B000-memory.dmp

Filesize
30.5MB

Download
memory/852-27-0x0000000002410000-0x0000000002419000-memory.dmp

Filesize
36KB

Download
memory/2224-192-0x0000000000400000-0x000000000228B000-memory.dmp

Filesize
30.5MB

Download
memory/2984-86-0x0000000000930000-0x00000000009A5000-memory.dmp

Filesize
468KB

Download
memory/2984-87-0x00000000008C0000-0x000000000092B000-memory.dmp

Filesize
428KB

Download
memory/2984-112-0x00000000008C0000-0x000000000092B000-memory.dmp

Filesize
428KB

Download
memory/3080-107-0x00000000003C0000-0x00000000003C7000-memory.dmp

Filesize
28KB

Download
memory/3080-103-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/3080-108-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/3292-124-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/3292-122-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/3292-123-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/3292-152-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/3336-121-0x00000000008C0000-0x00000000008C9000-memory.dmp

Filesize
36KB

Download
memory/3336-119-0x00000000008D0000-0x00000000008D5000-memory.dmp

Filesize
20KB

Download
memory/3336-120-0x00000000008C0000-0x00000000008C9000-memory.dmp

Filesize
36KB

Download
memory/3336-139-0x00000000008D0000-0x00000000008D5000-memory.dmp

Filesize
20KB

Download
memory/4172-165-0x00000000005D0000-0x00000000005DD000-memory.dmp

Filesize
52KB

Download
memory/4412-116-0x0000000000320000-0x0000000000329000-memory.dmp

Filesize
36KB

Download
memory/4412-118-0x0000000000310000-0x000000000031F000-memory.dmp

Filesize
60KB

Download
memory/4412-117-0x0000000000310000-0x000000000031F000-memory.dmp

Filesize
60KB

Download
memory/4412-137-0x0000000000310000-0x000000000031F000-memory.dmp

Filesize
60KB

Download
memory/4644-113-0x00000000008D0000-0x00000000008D7000-memory.dmp

Filesize
28KB

Download
memory/4644-132-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/4644-115-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/4644-128-0x00000000008D0000-0x00000000008D7000-memory.dmp

Filesize
28KB

Download