raccoon | c49ea7a66f5a817b2feaf9fc3665670202732e46dc56f76f90de8781644b40af

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

269KB
MD5

03a4d9eba10a22f5c3ae9e8a9a45b96c
SHA1

b772e17ab4b9b95d6487125b5e979f991cac2e6b
SHA256

c49ea7a66f5a817b2feaf9fc3665670202732e46dc56f76f90de8781644b40af
SHA512

4f3eda1ecc4e2b195fea9c2af56b768d0b1be853b91f5162d766044074c272331098d5139420665a27cedaef373967146d5799d24694f8054c4de4ddf3f37f4c
SSDEEP

3072:HIRltOe5BJIiAyVYTfwjJUyFxs9wt/T55hQipI8DDv/nIzkRoHBl1XNC9z4:oRX/Ai3VYzwd/djhQT8DDbw1s

Score

10^/10

raccoon redline smokeloader redtest backdoor collection discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

rc4.i32

Extracted

Family

redline

Botnet

redtest

107.173.58.91:32870

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4804-23-0x0000000002D20000-0x0000000002E20000-memory.dmp	family_raccoon_v2
behavioral2/memory/4804-24-0x0000000002CE0000-0x0000000002CF6000-memory.dmp	family_raccoon_v2
behavioral2/memory/4804-26-0x0000000000400000-0x0000000002ABF000-memory.dmp	family_raccoon_v2
behavioral2/memory/4804-153-0x0000000000400000-0x0000000002ABF000-memory.dmp	family_raccoon_v2

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2432-209-0x0000000000600000-0x000000000063C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Imported.pif

description pid process target process

PID 4920 created 3276 4920 Imported.pif Explorer.EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

1DF6.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1DF6.exe
Downloads MZ/PE file

description	pid	process	target process
PID 4920 created 3276	4920	Imported.pif	Explorer.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1DF6.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1DF6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1DF6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1DF6.exe

Deletes itself 1 IoCs

Processes:

Explorer.EXE

pid process

3276 Explorer.EXE
Executes dropped EXE 6 IoCs

Processes:

1373.exe148E.exe1DF6.exe200A.exeImported.pifjsc.exe

pid process

1500 1373.exe
4804 148E.exe
3160 1DF6.exe
4676 200A.exe
4920 Imported.pif
2432 jsc.exe
Loads dropped DLL 4 IoCs

Processes:

Imported.pif148E.exe

pid process

4920 Imported.pif
4804 148E.exe
4804 148E.exe
4804 148E.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3276	Explorer.EXE

pid	process
1500	1373.exe
4804	148E.exe
3160	1DF6.exe
4676	200A.exe
4920	Imported.pif
2432	jsc.exe

pid	process
4920	Imported.pif
4804	148E.exe
4804	148E.exe
4804	148E.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1DF6.exe	themida
C:\Users\Admin\AppData\Local\Temp\1DF6.exe	themida
behavioral2/memory/3160-68-0x0000000000380000-0x0000000000D02000-memory.dmp	themida

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

1DF6.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1DF6.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1DF6.exe

pid process

3160 1DF6.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

1373.exe

description pid process target process

PID 1500 set thread context of 952 1500 1373.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1908 1500 WerFault.exe 1373.exe
3476 4804 WerFault.exe 148E.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1DF6.exe

pid	process
3160	1DF6.exe

description	pid	process	target process
PID 1500 set thread context of 952	1500	1373.exe	AppLaunch.exe

pid	pid_target	process	target process
1908	1500	WerFault.exe	1373.exe
3476	4804	WerFault.exe	148E.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

1336 tasklist.exe
4296 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3964 PING.EXE

pid	process
1336	tasklist.exe
4296	tasklist.exe

pid	process
3964	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exeExplorer.EXE

pid	process
4304	file.exe
4304	file.exe
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE
3276	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3276 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

file.exeExplorer.EXE

pid process

4304 file.exe
3276 Explorer.EXE
3276 Explorer.EXE
3276 Explorer.EXE
3276 Explorer.EXE

pid	process
3276	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

Explorer.EXEtasklist.exetasklist.exeAppLaunch.exejsc.exe1DF6.exe

description	pid	process
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeDebugPrivilege	1336	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	952	AppLaunch.exe
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeDebugPrivilege	2432	jsc.exe
Token: SeShutdownPrivilege	3276	Explorer.EXE
Token: SeCreatePagefilePrivilege	3276	Explorer.EXE
Token: SeDebugPrivilege	3160	1DF6.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Imported.pifExplorer.EXE

pid process

4920 Imported.pif
3276 Explorer.EXE
3276 Explorer.EXE
4920 Imported.pif
4920 Imported.pif
3276 Explorer.EXE
3276 Explorer.EXE
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Imported.pif

pid process

4920 Imported.pif
4920 Imported.pif
4920 Imported.pif
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3276 Explorer.EXE

pid	process
4920	Imported.pif
3276	Explorer.EXE
3276	Explorer.EXE
4920	Imported.pif
4920	Imported.pif
3276	Explorer.EXE
3276	Explorer.EXE

pid	process
4920	Imported.pif
4920	Imported.pif
4920	Imported.pif

pid	process
3276	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXEregsvr32.exe1373.exe200A.execmd.execmd.exe

description	pid	process	target process
PID 3276 wrote to memory of 1500	3276	Explorer.EXE	1373.exe
PID 3276 wrote to memory of 1500	3276	Explorer.EXE	1373.exe
PID 3276 wrote to memory of 1500	3276	Explorer.EXE	1373.exe
PID 3276 wrote to memory of 4804	3276	Explorer.EXE	148E.exe
PID 3276 wrote to memory of 4804	3276	Explorer.EXE	148E.exe
PID 3276 wrote to memory of 4804	3276	Explorer.EXE	148E.exe
PID 3276 wrote to memory of 3400	3276	Explorer.EXE	regsvr32.exe
PID 3276 wrote to memory of 3400	3276	Explorer.EXE	regsvr32.exe
PID 3400 wrote to memory of 4920	3400	regsvr32.exe	regsvr32.exe
PID 3400 wrote to memory of 4920	3400	regsvr32.exe	Imported.pif
PID 3400 wrote to memory of 4920	3400	regsvr32.exe	Imported.pif
PID 3276 wrote to memory of 3160	3276	Explorer.EXE	1DF6.exe
PID 3276 wrote to memory of 3160	3276	Explorer.EXE	1DF6.exe
PID 3276 wrote to memory of 3160	3276	Explorer.EXE	1DF6.exe
PID 3276 wrote to memory of 4676	3276	Explorer.EXE	200A.exe
PID 3276 wrote to memory of 4676	3276	Explorer.EXE	200A.exe
PID 3276 wrote to memory of 4676	3276	Explorer.EXE	200A.exe
PID 3276 wrote to memory of 4836	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 4836	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 4836	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 4836	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 1936	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 1936	3276	Explorer.EXE	explorer.exe
PID 3276 wrote to memory of 1936	3276	Explorer.EXE	explorer.exe
PID 1500 wrote to memory of 1108	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 1108	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 1108	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 1500 wrote to memory of 952	1500	1373.exe	AppLaunch.exe
PID 4676 wrote to memory of 5028	4676	200A.exe	cmd.exe
PID 4676 wrote to memory of 5028	4676	200A.exe	cmd.exe
PID 4676 wrote to memory of 5028	4676	200A.exe	cmd.exe
PID 5028 wrote to memory of 1112	5028	cmd.exe	cmd.exe
PID 5028 wrote to memory of 1112	5028	cmd.exe	cmd.exe
PID 5028 wrote to memory of 1112	5028	cmd.exe	cmd.exe
PID 1112 wrote to memory of 1336	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 1336	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 1336	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 3088	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 3088	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 3088	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 4296	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 4296	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 4296	1112	cmd.exe	tasklist.exe
PID 1112 wrote to memory of 3892	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 3892	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 3892	1112	cmd.exe	findstr.exe
PID 1112 wrote to memory of 3268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 3268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 3268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 2268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 2268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 2268	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 3720	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 3720	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 3720	1112	cmd.exe	cmd.exe
PID 1112 wrote to memory of 4920	1112	cmd.exe	Imported.pif
PID 1112 wrote to memory of 4920	1112	cmd.exe	Imported.pif

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3276

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4304

C:\Users\Admin\AppData\Local\Temp\1373.exe
C:\Users\Admin\AppData\Local\Temp\1373.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 312
3⤵
- Program crash
PID:1908

C:\Users\Admin\AppData\Local\Temp\148E.exe
C:\Users\Admin\AppData\Local\Temp\148E.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 32104
3⤵
- Program crash
PID:3476

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16F0.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\16F0.dll
3⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\1DF6.exe
C:\Users\Admin\AppData\Local\Temp\1DF6.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Users\Admin\AppData\Local\Temp\200A.exe
C:\Users\Admin\AppData\Local\Temp\200A.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\cmd.exe
cmd /k cmd < Properly & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
5⤵
PID:3088

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe"
5⤵
PID:3892

C:\Windows\SysWOW64\cmd.exe
cmd /c mkdir 1024
5⤵
PID:3268

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Mandatory + Aging + Fathers + Granny + Plymouth 1024\Imported.pif
5⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Rod + Animation 1024\t
5⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\16104\1024\Imported.pif
1024\Imported.pif 1024\t
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920

C:\Windows\SysWOW64\PING.EXE
ping -n 5 localhost
5⤵
- Runs ping.exe
PID:3964

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4836

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\16104\1024\jsc.exe
C:\Users\Admin\AppData\Local\Temp\16104\1024\jsc.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1500 -ip 1500
1⤵
PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4804 -ip 4804
1⤵
PID:644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\BbDIp87ShlP9
Filesize
92KB

MD5
44de9f4a837691e623c12425421c22d1

SHA1
5229b2b16468353e9ae72ae2d97840448b055e55

SHA256
683050f55ee81e6cdd868cad8df884f327f903bca54f06f19e24d196d514fcae

SHA512
5f15e672310ef2f67e7517e4b23d3d1500fe18c4e53785ed8191d0b74139ccb2142e5b7495ec966e207fd46ead84bbd929d2d169b71d9477fbac4b383b0b55c5

Download Submit
C:\Users\Admin\AppData\LocalLow\HRSjQn76kIu8
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\LocalLow\mozglue.dll
Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll
Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll
Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1373.exe
Filesize
263KB

MD5
8984791137a338a066c32502b6ab7342

SHA1
1041dfabf8dbf8e67914cb82fa94b201c36c6afd

SHA256
c71f495f0867c7fb4d588bce1f91ff1ddfbe0e1452e696a1a9113551871a0b07

SHA512
b20cf0d32a7bdc849301f249eb42cc6e3931a79fecc6f119f67e4f4bac4b2b1d8af9d7ccff3c58efbe448b2078d3bb51f2b2979e5ef283d4354d8976660d5e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\1373.exe
Filesize
263KB

MD5
8984791137a338a066c32502b6ab7342

SHA1
1041dfabf8dbf8e67914cb82fa94b201c36c6afd

SHA256
c71f495f0867c7fb4d588bce1f91ff1ddfbe0e1452e696a1a9113551871a0b07

SHA512
b20cf0d32a7bdc849301f249eb42cc6e3931a79fecc6f119f67e4f4bac4b2b1d8af9d7ccff3c58efbe448b2078d3bb51f2b2979e5ef283d4354d8976660d5e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\148E.exe
Filesize
291KB

MD5
1de5eb2944545479b07139c4b4227cb4

SHA1
6baf1786af938b22a92b5f515f9d4ee131e6495a

SHA256
876ba20dfdae7014531937bf45a1a94757b01e72ae4e6ce5bee66665f1763dd1

SHA512
75322c0a9f12a74a69fc342c24ab3fe622dff26545f679b4baa9ffca6e1962e13d7455146bf332db24162aac595d31f5d9f28a4c8dc5685bd94e8ce87aec023a

Download Submit
C:\Users\Admin\AppData\Local\Temp\148E.exe
Filesize
291KB

MD5
1de5eb2944545479b07139c4b4227cb4

SHA1
6baf1786af938b22a92b5f515f9d4ee131e6495a

SHA256
876ba20dfdae7014531937bf45a1a94757b01e72ae4e6ce5bee66665f1763dd1

SHA512
75322c0a9f12a74a69fc342c24ab3fe622dff26545f679b4baa9ffca6e1962e13d7455146bf332db24162aac595d31f5d9f28a4c8dc5685bd94e8ce87aec023a

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\1024\Imported.pif
Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\1024\Imported.pif
Filesize
924KB

MD5
848164d084384c49937f99d5b894253e

SHA1
3055ef803eeec4f175ebf120f94125717ee12444

SHA256
f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3

SHA512
aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\1024\jsc.exe
Filesize
46KB

MD5
94c8e57a80dfca2482dedb87b93d4fd9

SHA1
5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

SHA256
39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

SHA512
1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\1024\jsc.exe
Filesize
46KB

MD5
94c8e57a80dfca2482dedb87b93d4fd9

SHA1
5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

SHA256
39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

SHA512
1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\1024\t
Filesize
633KB

MD5
fe3cdb342fa79c9e1cb79f4544a8a975

SHA1
0c37d9c0b63af3bd99f7e1612024a469d757ae1d

SHA256
fad17a4f9fc911f208337c2fb9b38dff422373297ce9fab60faae36771307803

SHA512
b50cf641b621eaac56a6805c59298b9857bc149b2d51202aefb53247d2410ca723320db624e4b6b24638809e3f87dfa332ae7dde00c624b12784a825490b9697

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Aging
Filesize
265KB

MD5
c724d5bd5c18d2bbe5fe2c7946c1b6b2

SHA1
7beed9c36d52db96557049da7fb3fd9765ab06da

SHA256
86b3e35e182ef64c4119084416a1009c365629360d954a4a9a53ec6d737a2d8f

SHA512
8841cb5ff4425ecaa89f691510276e42cb68450514439766d1e82769f0a498295961681e02bd2c0251b082e50eee599a516b19f7dde345a30f81f743f94e48a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Animation
Filesize
156KB

MD5
5dbdebec65c149f9303357aeb35f3f13

SHA1
971b53aad088edbbd9185c5390b82e41324e964b

SHA256
50e9ea749c805b70e45e35d0ec59f5380e5ff8f0b677d099e19b3d6b782163c6

SHA512
df410166f1eff8f08453dc110227e947f3c94de59da6a4c5953ff27d8d133df3acad89640f948d4133f4e367809a754f43586bf397acd01133cb291111b7f065

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Fathers
Filesize
134KB

MD5
19840b560c884e4575f325fbf6dde028

SHA1
58a5840b9163d586ea83535d02197a30fe04f3d0

SHA256
698f94e57b0edc595e35cd9ea0a6ded21fd383c559e349b2d4b6bae01a0a445f

SHA512
1a3921f8a9a3fd2d0394b811dbfa0fffdc72be5047fe17533cdeae3d2ec6cbdf5a0951a0744f0c1a372de809f3af502ff940fc679f3ff40d0eb55cb78b9d460e

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Granny
Filesize
290KB

MD5
4ee0ce02c9a6966cf83884c8b614077f

SHA1
2052c40fbc6ae0bd2fc085161e42e500556c27dd

SHA256
ec33283a90016ceae05ad793143d10679d430c2aa3fc2d1026f6c6acc5b028fb

SHA512
8dbee460fb43696834f62352852f58fdb6e4f160dcdfb1d4a7d81b2fe8cfb730e797af4c97095abbbce19f5569afac6da3eeadb6465ff5c216b6a4e79964a4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Mandatory
Filesize
161KB

MD5
f95a9af4657f69267464287ead8d12d2

SHA1
6171891ae7a8206b76ef4d9cf88f274987f21485

SHA256
96aa51fdf657cdc4e28744f2383ad53d45085d7f312264c9d786c751bc778307

SHA512
0ee28b7b6a767958058c775a1df42e81a97151b37511686902b29f54d0bc5769d10978c297a90f166018cd34fbc5d85f8f146576a19d78ddc5ed37083de1f6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Plymouth
Filesize
74KB

MD5
265a4f252616accea4a910e76e612f0b

SHA1
7002ca5e385a2bfa58200c08fd2821acf0072122

SHA256
22424b9c63b2b5d882cc25335dbfb2f1872c1186f43fe1caf16d87b808f6e3e9

SHA512
f77dfe13c67ba3235bc1dc88041a7266430bedd6f35d3f2ba0c46314346de61305256b144eb9c49842edb4d21741e31161fbe025a92cb85b7aeface781cdd5e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Properly
Filesize
12KB

MD5
fdf171249c22f3f45c53408bfa0d2f2b

SHA1
95e96312015058c60c83a8e38733371311722593

SHA256
b0d4a9769a644c418419050c5b2b7f796f06a7d4c48010e8498e2596c7a935bd

SHA512
52d21473972162cd29e403d1e3eee209ac5e4c2051a7e07455ec96971a94f5ac045ba3c539066bf5abd2fe3995334a4683f58f0f11dc5c28488ae1dbce91968d

Download Submit
C:\Users\Admin\AppData\Local\Temp\16104\Rod
Filesize
477KB

MD5
4ea38f8c80b7060a80c79ab03d5d1c7c

SHA1
cfddc34a9e809c7c3f9fc0e457522bfb0457ab67

SHA256
b4ea21811ef45cd914cefd4fa272715c295e7673bfdd3976ef4c1b7c2f00a85a

SHA512
0e2e22e503b9938fe356aaef78197621f98ece3c705a2451b6b87ccd50cff92a67d809f81673b66e58ea8c5f82ffb28e955a8eac2782a00430a134fe522cc06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\16F0.dll
Filesize
2.6MB

MD5
c73569915305ac15c46f6b0565bc39b0

SHA1
744e80ad9f09ee6a2e32fd1700f93ac45a270d53

SHA256
e08c706b8e7c518be2606ff7f3274918330b03ed2cd0bf2120a6676fb85dec8b

SHA512
a4c85815b872475858913c3dbad6a3820ceb93a317b0749c034948b80ddd4fb3c3a4b9da9740f578a662b8a9f7b8fe2841ef5ddf7152840182d6a0b76f6eca40

Download Submit
C:\Users\Admin\AppData\Local\Temp\16F0.dll
Filesize
2.6MB

MD5
c73569915305ac15c46f6b0565bc39b0

SHA1
744e80ad9f09ee6a2e32fd1700f93ac45a270d53

SHA256
e08c706b8e7c518be2606ff7f3274918330b03ed2cd0bf2120a6676fb85dec8b

SHA512
a4c85815b872475858913c3dbad6a3820ceb93a317b0749c034948b80ddd4fb3c3a4b9da9740f578a662b8a9f7b8fe2841ef5ddf7152840182d6a0b76f6eca40

Download Submit
C:\Users\Admin\AppData\Local\Temp\1DF6.exe
Filesize
4.1MB

MD5
41960f214e4314caa2f5157b11b00a18

SHA1
c405bffc785505bab364208c24e29eefe80f1e32

SHA256
69f5aca8d40511fbf3523b1e8e2cee4ff64b65ab94a7e734e9810ef0f617a327

SHA512
7cfcb85c84e493fc2362d96495da0b40f01d7884ba5cc0346714d487cb249379b2dec689f9958177aae49e71f6dafbfb9b7b9c046decb1b4356937052f8e9140

Download Submit
C:\Users\Admin\AppData\Local\Temp\1DF6.exe
Filesize
4.1MB

MD5
41960f214e4314caa2f5157b11b00a18

SHA1
c405bffc785505bab364208c24e29eefe80f1e32

SHA256
69f5aca8d40511fbf3523b1e8e2cee4ff64b65ab94a7e734e9810ef0f617a327

SHA512
7cfcb85c84e493fc2362d96495da0b40f01d7884ba5cc0346714d487cb249379b2dec689f9958177aae49e71f6dafbfb9b7b9c046decb1b4356937052f8e9140

Download Submit
C:\Users\Admin\AppData\Local\Temp\200A.exe
Filesize
1.3MB

MD5
bf1229435270f85c47a561c29ee5e1e0

SHA1
129857639c5cb4feffb0a674be2baf81f1c90bd3

SHA256
08ac62d87943f67a0ec0a16d1f9c3f7dc9cef7479afed610847fbb926c9cd1af

SHA512
941cb25b836e769dfe68f42df7ba4ee8b9e4e2fac2bd985b3a8b2d1da53c04f46f2380d8977f3a22650b2be37b962f4a7f54552699ebdfdf93adfce2643d966d

Download Submit
C:\Users\Admin\AppData\Local\Temp\200A.exe
Filesize
1.3MB

MD5
bf1229435270f85c47a561c29ee5e1e0

SHA1
129857639c5cb4feffb0a674be2baf81f1c90bd3

SHA256
08ac62d87943f67a0ec0a16d1f9c3f7dc9cef7479afed610847fbb926c9cd1af

SHA512
941cb25b836e769dfe68f42df7ba4ee8b9e4e2fac2bd985b3a8b2d1da53c04f46f2380d8977f3a22650b2be37b962f4a7f54552699ebdfdf93adfce2643d966d

Download Submit
memory/952-170-0x00000000063D0000-0x0000000006446000-memory.dmp

Filesize
472KB

Download
memory/952-204-0x00000000728F0000-0x00000000730A0000-memory.dmp

Filesize
7.7MB

Download
memory/952-167-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/952-173-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/952-161-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/952-159-0x00000000728F0000-0x00000000730A0000-memory.dmp

Filesize
7.7MB

Download
memory/952-152-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/952-175-0x0000000006880000-0x00000000068D0000-memory.dmp

Filesize
320KB

Download
memory/952-176-0x00000000072C0000-0x0000000007482000-memory.dmp

Filesize
1.8MB

Download
memory/952-177-0x00000000080D0000-0x00000000085FC000-memory.dmp

Filesize
5.2MB

Download
memory/1936-64-0x0000000000B70000-0x0000000000B77000-memory.dmp

Filesize
28KB

Download
memory/1936-63-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/1936-73-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/2432-216-0x00000000728F0000-0x00000000730A0000-memory.dmp

Filesize
7.7MB

Download
memory/2432-209-0x0000000000600000-0x000000000063C000-memory.dmp

Filesize
240KB

Download
memory/2432-213-0x0000000006FC0000-0x0000000006FD0000-memory.dmp

Filesize
64KB

Download
memory/2432-212-0x00000000728F0000-0x00000000730A0000-memory.dmp

Filesize
7.7MB

Download
memory/3160-47-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-46-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-101-0x0000000008CF0000-0x0000000009308000-memory.dmp

Filesize
6.1MB

Download
memory/3160-193-0x0000000000380000-0x0000000000D02000-memory.dmp

Filesize
9.5MB

Download
memory/3160-37-0x0000000000380000-0x0000000000D02000-memory.dmp

Filesize
9.5MB

Download
memory/3160-120-0x0000000007FB0000-0x00000000080BA000-memory.dmp

Filesize
1.0MB

Download
memory/3160-136-0x0000000007E10000-0x0000000007E22000-memory.dmp

Filesize
72KB

Download
memory/3160-199-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-198-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-68-0x0000000000380000-0x0000000000D02000-memory.dmp

Filesize
9.5MB

Download
memory/3160-137-0x0000000007EA0000-0x0000000007EDC000-memory.dmp

Filesize
240KB

Download
memory/3160-151-0x0000000007EE0000-0x0000000007F2C000-memory.dmp

Filesize
304KB

Download
memory/3160-42-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-197-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-195-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-40-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-98-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

Filesize
40KB

Download
memory/3160-194-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-196-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-201-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-96-0x0000000007C10000-0x0000000007CA2000-memory.dmp

Filesize
584KB

Download
memory/3160-56-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-51-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-49-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-57-0x0000000077254000-0x0000000077256000-memory.dmp

Filesize
8KB

Download
memory/3160-200-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-44-0x0000000077000000-0x00000000770F0000-memory.dmp

Filesize
960KB

Download
memory/3160-95-0x0000000008120000-0x00000000086C4000-memory.dmp

Filesize
5.6MB

Download
memory/3276-4-0x0000000002480000-0x0000000002496000-memory.dmp

Filesize
88KB

Download
memory/4304-1-0x0000000000C60000-0x0000000000D60000-memory.dmp

Filesize
1024KB

Download
memory/4304-2-0x00000000028E0000-0x00000000028EB000-memory.dmp

Filesize
44KB

Download
memory/4304-3-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/4304-5-0x0000000000400000-0x0000000000B9E000-memory.dmp

Filesize
7.6MB

Download
memory/4676-164-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/4676-191-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/4676-67-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4804-24-0x0000000002CE0000-0x0000000002CF6000-memory.dmp

Filesize
88KB

Download
memory/4804-26-0x0000000000400000-0x0000000002ABF000-memory.dmp

Filesize
38.7MB

Download
memory/4804-166-0x0000000002D20000-0x0000000002E20000-memory.dmp

Filesize
1024KB

Download
memory/4804-157-0x0000000061E00000-0x0000000061EF1000-memory.dmp

Filesize
964KB

Download
memory/4804-153-0x0000000000400000-0x0000000002ABF000-memory.dmp

Filesize
38.7MB

Download
memory/4804-23-0x0000000002D20000-0x0000000002E20000-memory.dmp

Filesize
1024KB

Download
memory/4836-60-0x0000000000910000-0x0000000000990000-memory.dmp

Filesize
512KB

Download
memory/4836-54-0x00000000008A0000-0x000000000090B000-memory.dmp

Filesize
428KB

Download
memory/4836-58-0x00000000008A0000-0x000000000090B000-memory.dmp

Filesize
428KB

Download
memory/4836-100-0x00000000008A0000-0x000000000090B000-memory.dmp

Filesize
428KB

Download
memory/4920-97-0x0000000002E40000-0x0000000002F48000-memory.dmp

Filesize
1.0MB

Download
memory/4920-206-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4920-66-0x0000000002E40000-0x0000000002F48000-memory.dmp

Filesize
1.0MB

Download
memory/4920-74-0x0000000002E40000-0x0000000002F48000-memory.dmp

Filesize
1.0MB

Download
memory/4920-65-0x0000000002E40000-0x0000000002F48000-memory.dmp

Filesize
1.0MB

Download
memory/4920-31-0x00000000010B0000-0x00000000010B6000-memory.dmp

Filesize
24KB

Download
memory/4920-29-0x0000000010000000-0x000000001028E000-memory.dmp

Filesize
2.6MB

Download
memory/4920-36-0x0000000002D10000-0x0000000002E34000-memory.dmp

Filesize
1.1MB

Download