buer | 20fb25cdc691c31b5b59ec871960363fedb13d10e2f0d274eecb3951811b7fe8

Analysis

max time kernel
111s
max time network
155s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-12-2023 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

220KB
MD5

1d6f355e2bff2e65ad8582c81ba8782b
SHA1

82b46f681ca938cf25380f33308edf380f532871
SHA256

20fb25cdc691c31b5b59ec871960363fedb13d10e2f0d274eecb3951811b7fe8
SHA512

bfa7ade490c2138184a81f8668a7a25f4eb38bc51ea068cfd3b89f7d323e3c963068e414033ca556aedb09f55edbe2126aa00ffa63acb86d9e29c2e2293fd6b2
SSDEEP

3072:115Kn8Ls+WqCZ1m7QJTCaB1LBoj/XsUz5AtiKhdGUZoVawtMTp9:H5Kl+WHvJTCaB1LBoj0jTcK8aEaP

Score

10^/10

buer smokeloader stealc autm pub1 backdoor collection discovery evasion loader persistence spyware stealer themida trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

http://legdfls2369.com/index.php

http://fpodsp0532xc.com/index.php

http://gucc352093520.com/index.php

http://humydrole.com/tmp/index.php

http://trunk-co.ru/tmp/index.php

http://weareelight.com/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

autm

Extracted

Family

smokeloader

Botnet

pub1

Signatures

Buer
Buer is a new modular loader first seen in August 2019.
loader buer
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DDA4.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DDA4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DDA4.exe

Deletes itself 1 IoCs

pid	Process
1208	Process not Found

Executes dropped EXE 8 IoCs

pid	Process
2344	C320.exe
2632	C582.exe
2796	C582.exe
2240	DDA4.exe
1736	F828.exe
2536	FFD7.exe
772	9E6.exe
1532	Adaptation.pif

Loads dropped DLL 5 IoCs

pid	Process
2632	C582.exe
2728	regsvr32.exe
2176	cmd.exe
1532	Adaptation.pif
1532	Adaptation.pif

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000a000000015eb8-50.dat	themida
behavioral1/memory/2240-88-0x0000000000B90000-0x000000000165A000-memory.dmp	themida

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-37-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-38-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/948-127-0x0000000007C20000-0x0000000007C60000-memory.dmp	upx
behavioral1/memory/2796-126-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-188-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-218-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2796-223-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	C582.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DDA4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2240	DDA4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 2796	2632	C582.exe	30
PID 772 set thread context of 2840	772	9E6.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C320.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C320.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C320.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F828.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F828.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Adaptation.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Adaptation.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2380	tasklist.exe
1620	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2012	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	file.exe
2568	file.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Process not Found

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
2568	file.exe
2344	C320.exe
1208	Process not Found
1208	Process not Found
1736	F828.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1208	Process not Found
Token: SeShutdownPrivilege	1208	Process not Found
Token: SeDebugPrivilege	2380	tasklist.exe
Token: SeDebugPrivilege	1620	tasklist.exe
Token: SeDebugPrivilege	2240	DDA4.exe
Token: SeDebugPrivilege	2840	AppLaunch.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1532	Adaptation.pif
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1532	Adaptation.pif
1532	Adaptation.pif
1208	Process not Found
1208	Process not Found

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1532	Adaptation.pif
1532	Adaptation.pif
1532	Adaptation.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2344	1208	Process not Found	28
PID 1208 wrote to memory of 2344	1208	Process not Found	28
PID 1208 wrote to memory of 2344	1208	Process not Found	28
PID 1208 wrote to memory of 2344	1208	Process not Found	28
PID 1208 wrote to memory of 2632	1208	Process not Found	29
PID 1208 wrote to memory of 2632	1208	Process not Found	29
PID 1208 wrote to memory of 2632	1208	Process not Found	29
PID 1208 wrote to memory of 2632	1208	Process not Found	29
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 2632 wrote to memory of 2796	2632	C582.exe	30
PID 1208 wrote to memory of 2240	1208	Process not Found	31
PID 1208 wrote to memory of 2240	1208	Process not Found	31
PID 1208 wrote to memory of 2240	1208	Process not Found	31
PID 1208 wrote to memory of 2240	1208	Process not Found	31
PID 1208 wrote to memory of 2676	1208	Process not Found	34
PID 1208 wrote to memory of 2676	1208	Process not Found	34
PID 1208 wrote to memory of 2676	1208	Process not Found	34
PID 1208 wrote to memory of 2676	1208	Process not Found	34
PID 1208 wrote to memory of 2676	1208	Process not Found	34
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 2676 wrote to memory of 2728	2676	regsvr32.exe	35
PID 1208 wrote to memory of 1736	1208	Process not Found	36
PID 1208 wrote to memory of 1736	1208	Process not Found	36
PID 1208 wrote to memory of 1736	1208	Process not Found	36
PID 1208 wrote to memory of 1736	1208	Process not Found	36
PID 1208 wrote to memory of 2536	1208	Process not Found	37
PID 1208 wrote to memory of 2536	1208	Process not Found	37
PID 1208 wrote to memory of 2536	1208	Process not Found	37
PID 1208 wrote to memory of 2536	1208	Process not Found	37
PID 1208 wrote to memory of 772	1208	Process not Found	39
PID 1208 wrote to memory of 772	1208	Process not Found	39
PID 1208 wrote to memory of 772	1208	Process not Found	39
PID 1208 wrote to memory of 772	1208	Process not Found	39
PID 1208 wrote to memory of 948	1208	Process not Found	40
PID 1208 wrote to memory of 948	1208	Process not Found	40
PID 1208 wrote to memory of 948	1208	Process not Found	40
PID 1208 wrote to memory of 948	1208	Process not Found	40
PID 1208 wrote to memory of 948	1208	Process not Found	40
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 1208 wrote to memory of 1160	1208	Process not Found	42
PID 1208 wrote to memory of 1160	1208	Process not Found	42
PID 1208 wrote to memory of 1160	1208	Process not Found	42
PID 1208 wrote to memory of 1160	1208	Process not Found	42
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41
PID 772 wrote to memory of 2840	772	9E6.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2568

C:\Users\Admin\AppData\Local\Temp\C320.exe
C:\Users\Admin\AppData\Local\Temp\C320.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2344

C:\Users\Admin\AppData\Local\Temp\C582.exe
C:\Users\Admin\AppData\Local\Temp\C582.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\C582.exe
  C:\Users\Admin\AppData\Local\Temp\C582.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2796

C:\Users\Admin\AppData\Local\Temp\DDA4.exe
C:\Users\Admin\AppData\Local\Temp\DDA4.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EE0A.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\EE0A.dll
  2⤵
  - Loads dropped DLL
  PID:2728

C:\Users\Admin\AppData\Local\Temp\F828.exe
C:\Users\Admin\AppData\Local\Temp\F828.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1736

C:\Users\Admin\AppData\Local\Temp\FFD7.exe
C:\Users\Admin\AppData\Local\Temp\FFD7.exe
1⤵
- Executes dropped EXE
PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /k cmd < Hottest & exit
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    PID:2176
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:1980
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe"
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir 299
      4⤵
      PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Span + Cigarette + Instances + Mfg + Cable 299\Adaptation.pif
      4⤵
      PID:1008
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Complex 299\G
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\7598\299\Adaptation.pif
      299\Adaptation.pif 299\G
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1532
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:2012

C:\Users\Admin\AppData\Local\Temp\9E6.exe
C:\Users\Admin\AppData\Local\Temp\9E6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2840

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:948

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1160

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2268

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3016

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1248

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2164

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2452

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2084

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2304

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1772

C:\Windows\system32\taskeng.exe
taskeng.exe {3EF14959-47FF-4F17-9625-A26A639B6B44} S-1-5-21-3618187007-3650799920-3290345941-1000:BPDFUYWR\Admin:Interactive:[1]
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CFIIIJJK

Filesize
92KB

MD5
8fff4afa5c28dcfdfb7bac7c3950841d

SHA1
dd3fbd23bf6ca1bcdd15e6c984d676e43cf4dfc4

SHA256
c454b6533ff9fb8d73697fb7845adc2463ecc3a69e926de5dadb17f1012f6203

SHA512
bcd79fa0ddef1138fe6b47295d5ea491546bb9399a723ce6984f3139ae6fc6e98d0ca764120aa65a670db46c75143b493676d161cabd863f26d1950ade69412a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a9dc08511382d69afa8b200cbcd399

SHA1
9c77531fac59ca8ad97146b547887867d4f3b380

SHA256
e238f440a4be457852bf3d6251457978e6b95ffaef9b7eb8894ae0a689fa35df

SHA512
2833ca7a030e6565713668a032a191a4b893a21272715f679ee14eb15b334c29d6e64ca277fbf2c357c0dba3179aef125d4fd7c0e778f0d1d2504a91a88cfa01

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
5bf98af569eb3146c9f6a7e13af7e9e9

SHA1
5c92685f2f8695d7d8b5a738e12b27a7b6effb5c

SHA256
5bf3de6c035bb65c93e839e5b25de4a3ccf20ae84cff88a1f6ed7a2ca434e91f

SHA512
14854e162b645541d077140cf1beb1f7226fbe90c2875bcc752f14e26f2abd895261bbde2218b20355119032e11ba6cc7b3c3f563a513cb60a7d3f1a87830814

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
9.1MB

MD5
35550befbc73f03f208471a5ba29a03b

SHA1
9ee7308ae80b0770963a90888d7f49a5e4ad08d2

SHA256
130af320d58d8a066822d0e125492da2559e8b401c5464d5848e0eec97926e0f

SHA512
88ff5a0fd2ec1c21c5d680be576140701ccd55620e288f9ed11980a371a990e5804193efb0f76315fdeaf68d07aa9ca74f998c529c109cfd6ac6c372bb09de1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\299\Adaptation.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\299\Adaptation.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\299\G

Filesize
481KB

MD5
daf7c95ffa3878edde190cf2528b89c7

SHA1
ce03b0a9cd957ecb89eb0ee3fb53e36dc48e589c

SHA256
362fe8651e59873d994c672f5e1bccc8e0cdd43495847e4cd68e9581dbe8da82

SHA512
014ab181c8b738f548a83336f04552924cc50fd1d31df30bd6449d79654e22e762da4c1b34d30f6695bc9be8f8ac29b1f896d44ee0399b698b732e95c1ed8ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Cable

Filesize
107KB

MD5
ea0984c12452e6529fa15b45d4c0db4a

SHA1
4ee04ddf92a5fb316bd0e5c07ebd01e42722cec9

SHA256
7d912eab3995c5afe59eb81769a4642a155f70be14e927f2c26aa4adfc0b4c3e

SHA512
ee0f8a91796e213416749a413dc4d14fa240c280e85f93e033c134ae409e9ee156e3f7b16be0498e85f1d73b88f7422994eccca6b4bcca582b1a5b5e69e734d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Cigarette

Filesize
152KB

MD5
6c6624c93751ad297285148c310ff274

SHA1
9773285a0cb3d80626b6cab3ff667562640f641a

SHA256
cf1f99ac18850df999db097dce5b94395540e27bed65c17b4c1e2aa37c0ad1ca

SHA512
cca0807a8b377c694a48c240990efcf593fedf8ea380e9c56cdc6f75e4a5006ec1b8eceddae089c7c7656266e2ffd8976d1e343bedddd6f170eee686228f3340

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Complex

Filesize
481KB

MD5
daf7c95ffa3878edde190cf2528b89c7

SHA1
ce03b0a9cd957ecb89eb0ee3fb53e36dc48e589c

SHA256
362fe8651e59873d994c672f5e1bccc8e0cdd43495847e4cd68e9581dbe8da82

SHA512
014ab181c8b738f548a83336f04552924cc50fd1d31df30bd6449d79654e22e762da4c1b34d30f6695bc9be8f8ac29b1f896d44ee0399b698b732e95c1ed8ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Hottest

Filesize
11KB

MD5
6c3db9d2ee7fdf582ee1ccc7a23b7790

SHA1
96fcea7cc3d585f4249bc8345787c35f299b65c9

SHA256
25784a61a1f3b4c01e071001e65ce34e8ee4e89e7fdbe875726f71865d37f011

SHA512
19dc63a80e3194d3e3f083f1906e69c9e443633051e69fc3c0e5342b064f12386bf5b46a6af623d59f2076211d8bed62671dc80bc2832db2750de91fc8d8c68f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Instances

Filesize
102KB

MD5
8716ba4268c997b3594e7cfd5ae8ffbe

SHA1
30f35dc0ebba1c0997d9f50ab01d6db37964dab7

SHA256
922ca4c9f27fdf74e3c3c7fd3ebe0c3cdf9ff5520be53038dd170164a7a4bad5

SHA512
29f4496763aa8a57b063ab8db53de062bd93236ff0651edca516d2711aae9d5e5c40f0b176819b4b38a518de30f6e7d796732df085951272ab0609cc793b522e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Mfg

Filesize
265KB

MD5
48c1ab8f82b10195b9ff4244d5bf9540

SHA1
40c3df2ed56058e474363097a50e3410dc3aae51

SHA256
71ab87b2e5ceccebe76ea2f60a3456d8a950662892c5bd50008ac7a40090cc50

SHA512
60bd24e06a5d8224e14479bc1300ae9a49c609f017f330a1cbec6315313fc663c0e7be85c38b165f44bf62ffdda89c346c7e2a68cf185ad33dddb244833df8b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7598\Span

Filesize
298KB

MD5
c3ac7e357a0c696c7b80c94053cc81b4

SHA1
0802eb8acccbe2e0924cacb5127f48054b5da38e

SHA256
ebe1b557f2979029744308f2ae5640cfcbdb1c3d4b667015a83a2b59ed6d6927

SHA512
3fc612476199780d56b2fcf3b2beff17fc17d70997a58e60f21ea29df54f39b6bd2bc5217f322238de72b41f5a8fa029843da57cacc41db5f3fdc1d5a5dec817

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E6.exe

Filesize
1.8MB

MD5
d91540ed753b8137486c21fcc71f5824

SHA1
16534b5421a6615cc3d90601f6e0a2d3e68ff567

SHA256
66389e8e3338eb2791929ec9768c90905587a4659dc24e82a8d0e3d09e03c4ee

SHA512
d15e1ae7c3704c3756a031842fb6853d744ff899d78b845962901151e7628cd76f494ad7ca1043f571da1eb8d3f11206b89a831b782e3a019bbf773c219f4b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E6.exe

Filesize
1.8MB

MD5
d91540ed753b8137486c21fcc71f5824

SHA1
16534b5421a6615cc3d90601f6e0a2d3e68ff567

SHA256
66389e8e3338eb2791929ec9768c90905587a4659dc24e82a8d0e3d09e03c4ee

SHA512
d15e1ae7c3704c3756a031842fb6853d744ff899d78b845962901151e7628cd76f494ad7ca1043f571da1eb8d3f11206b89a831b782e3a019bbf773c219f4b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C320.exe

Filesize
304KB

MD5
33a60439e95f0dfc10016075f97aeb0c

SHA1
fb3595f8a5f9c243e5ad108ff11bc5cb2400ec2b

SHA256
0f6db13c0239ca113c19ebeaec8f3243572fd365c3396eff1777115bc08849a1

SHA512
c08ff3d27eb92b369bbdcfb5ee3405e345bb3de3004b985ba48b4308d22851403cfc440b8242c1f4ccbbb75986feead1c800bddd58a225274386b878aaad9a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\C320.exe

Filesize
304KB

MD5
33a60439e95f0dfc10016075f97aeb0c

SHA1
fb3595f8a5f9c243e5ad108ff11bc5cb2400ec2b

SHA256
0f6db13c0239ca113c19ebeaec8f3243572fd365c3396eff1777115bc08849a1

SHA512
c08ff3d27eb92b369bbdcfb5ee3405e345bb3de3004b985ba48b4308d22851403cfc440b8242c1f4ccbbb75986feead1c800bddd58a225274386b878aaad9a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\C582.exe

Filesize
1.9MB

MD5
57c833bfd5042e34bec23dfd711cd151

SHA1
6bcd1915173d57d369e209943be31eebebdd535a

SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C582.exe

Filesize
1.9MB

MD5
57c833bfd5042e34bec23dfd711cd151

SHA1
6bcd1915173d57d369e209943be31eebebdd535a

SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C582.exe

Filesize
1.9MB

MD5
57c833bfd5042e34bec23dfd711cd151

SHA1
6bcd1915173d57d369e209943be31eebebdd535a

SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C582.exe

Filesize
1.9MB

MD5
57c833bfd5042e34bec23dfd711cd151

SHA1
6bcd1915173d57d369e209943be31eebebdd535a

SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95D3.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDA4.exe

Filesize
4.6MB

MD5
a3dea4c1f895c2729505cb4712ad469d

SHA1
fdfeebab437bf7f97fb848cd67abec9409adb3b2

SHA256
acfa700a776ef8622839fd22f3bcca3e7183e3ee2e21473ca0d9ccdc895c4afd

SHA512
9da049b6e9169e1079182ce04fd852e823d6bb31f0be3a814ee687047f3831c3cac58dd46b6a8592714afd102233d40a70a0b66e5f094d014c7059b119aa11c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EE0A.dll

Filesize
2.1MB

MD5
824ccd36914386ef3376494c93dc2e8f

SHA1
4fb7898a439b0cecd856f8e6ba434728e6b3e4dd

SHA256
cad7dbc2fbf4f4f0426a4f0a467d394d48534e22a3013d6b525fef5c3e976a28

SHA512
bfe6e970c5e44d56d9a1523ca3259a08daeaa4af1c9fb230afc58b216944165c44f44dc80f4a3cb510a04dc3921c76e8fd458112ae88aa11b75633690a5c9bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\F828.exe

Filesize
219KB

MD5
19580138ffde25abbd2be3108ae82049

SHA1
a09cb792d601ecf35612838495b1031c72bc4e13

SHA256
8c5b4f3361663db3d011b8f05555d90de7a213e7b747716ff2e9d84bb1922c99

SHA512
92b9fd029590dff1f0ba4408f72aa6b13f536ad76489970b4691e63c936cd2937bbfdfa166ce91993a379fe67e086e281c7a0d6b9efc763232e892089db8f9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F828.exe

Filesize
219KB

MD5
19580138ffde25abbd2be3108ae82049

SHA1
a09cb792d601ecf35612838495b1031c72bc4e13

SHA256
8c5b4f3361663db3d011b8f05555d90de7a213e7b747716ff2e9d84bb1922c99

SHA512
92b9fd029590dff1f0ba4408f72aa6b13f536ad76489970b4691e63c936cd2937bbfdfa166ce91993a379fe67e086e281c7a0d6b9efc763232e892089db8f9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\FFD7.exe

Filesize
1.3MB

MD5
663bef796cad090d04538b9b618c2134

SHA1
d47c6e447278e09cbd2bccbc6973ec93e381c451

SHA256
1c549f923ef59769eccf16055d1fb866881166831bceb8feb5d8d1337abab07f

SHA512
ea3e3a562ee2dae6dba947a792cbd94fc679ebca5d8724efbec1bd7c5c39c70be2dcac0930d07a73b515508b436ee9e83fd9cd648f7424e3dd1a72c1e0ffc8d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9750.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\7598\299\Adaptation.pif

Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
\Users\Admin\AppData\Local\Temp\C582.exe

Filesize
1.9MB

MD5
57c833bfd5042e34bec23dfd711cd151

SHA1
6bcd1915173d57d369e209943be31eebebdd535a

SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d

SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1

Download Submit
\Users\Admin\AppData\Local\Temp\EE0A.dll

Filesize
2.1MB

MD5
824ccd36914386ef3376494c93dc2e8f

SHA1
4fb7898a439b0cecd856f8e6ba434728e6b3e4dd

SHA256
cad7dbc2fbf4f4f0426a4f0a467d394d48534e22a3013d6b525fef5c3e976a28

SHA512
bfe6e970c5e44d56d9a1523ca3259a08daeaa4af1c9fb230afc58b216944165c44f44dc80f4a3cb510a04dc3921c76e8fd458112ae88aa11b75633690a5c9bd8

Download Submit
memory/948-128-0x0000000000130000-0x000000000019B000-memory.dmp

Filesize
428KB

Download
memory/948-141-0x0000000000130000-0x000000000019B000-memory.dmp

Filesize
428KB

Download
memory/948-127-0x0000000007C20000-0x0000000007C60000-memory.dmp

Filesize
256KB

Download
memory/948-125-0x0000000000130000-0x000000000019B000-memory.dmp

Filesize
428KB

Download
memory/1160-149-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download
memory/1160-147-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1160-151-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1208-80-0x0000000002B10000-0x0000000002B26000-memory.dmp

Filesize
88KB

Download
memory/1208-4-0x0000000002AE0000-0x0000000002AF6000-memory.dmp

Filesize
88KB

Download
memory/1208-142-0x0000000002BB0000-0x0000000002BC6000-memory.dmp

Filesize
88KB

Download
memory/1532-225-0x0000000003890000-0x0000000003ABE000-memory.dmp

Filesize
2.2MB

Download
memory/1532-224-0x0000000003890000-0x0000000003ABE000-memory.dmp

Filesize
2.2MB

Download
memory/1532-230-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1532-222-0x0000000003890000-0x0000000003ABE000-memory.dmp

Filesize
2.2MB

Download
memory/1532-220-0x0000000003890000-0x0000000003ABE000-memory.dmp

Filesize
2.2MB

Download
memory/1736-104-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/1736-103-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/1736-102-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/1736-143-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2240-170-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-163-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-51-0x0000000000B90000-0x000000000165A000-memory.dmp

Filesize
10.8MB

Download
memory/2240-92-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-57-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-82-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-58-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-59-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-81-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-76-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-77-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-78-0x0000000077460000-0x0000000077462000-memory.dmp

Filesize
8KB

Download
memory/2240-60-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-61-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-112-0x0000000007C20000-0x0000000007C60000-memory.dmp

Filesize
256KB

Download
memory/2240-62-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-63-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-64-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-75-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-74-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-73-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-72-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-175-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-71-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-70-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-69-0x0000000075510000-0x0000000075557000-memory.dmp

Filesize
284KB

Download
memory/2240-68-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-173-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-67-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-172-0x0000000075510000-0x0000000075557000-memory.dmp

Filesize
284KB

Download
memory/2240-66-0x0000000075510000-0x0000000075557000-memory.dmp

Filesize
284KB

Download
memory/2240-65-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-171-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-169-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-168-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-166-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-165-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-164-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2240-160-0x0000000000B90000-0x000000000165A000-memory.dmp

Filesize
10.8MB

Download
memory/2240-88-0x0000000000B90000-0x000000000165A000-memory.dmp

Filesize
10.8MB

Download
memory/2240-162-0x00000000768F0000-0x0000000076A00000-memory.dmp

Filesize
1.1MB

Download
memory/2344-40-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2344-83-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2344-43-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/2344-41-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/2536-212-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2536-111-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2536-216-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2568-5-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2568-1-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/2568-3-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2568-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/2632-32-0x00000000024F0000-0x00000000026A7000-memory.dmp

Filesize
1.7MB

Download
memory/2632-30-0x0000000002330000-0x00000000024E8000-memory.dmp

Filesize
1.7MB

Download
memory/2632-26-0x0000000002330000-0x00000000024E8000-memory.dmp

Filesize
1.7MB

Download
memory/2728-93-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/2728-90-0x0000000010000000-0x0000000010212000-memory.dmp

Filesize
2.1MB

Download
memory/2728-116-0x0000000002350000-0x0000000002462000-memory.dmp

Filesize
1.1MB

Download
memory/2728-109-0x0000000002220000-0x000000000234C000-memory.dmp

Filesize
1.2MB

Download
memory/2728-113-0x0000000002350000-0x0000000002462000-memory.dmp

Filesize
1.1MB

Download
memory/2728-117-0x0000000002350000-0x0000000002462000-memory.dmp

Filesize
1.1MB

Download
memory/2796-37-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-188-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-126-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-218-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-223-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2796-38-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-161-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-145-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-152-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-148-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-154-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2840-155-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-167-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download
memory/2840-153-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-157-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-159-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download