agenttesla | d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12-12-2023 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank_Confirmation.exe
Size

882KB
MD5

f82b121e447bb312a0c383d78a90490f
SHA1

a2570c68231136bb0d7b260f906d1e5a78c25f48
SHA256

d61fdb59b0176c8e329052c1b577dd366f17f206b79769bf3ae56ed6d52575de
SHA512

cfcf833f59f3f47aea75ea62b79d5ca57fcad8e56943bb60cd4af0212baf3c6720d9f991a3dd8964a9e272b2b82f0416fa5d06988e90dc9fda2a0e56d649dc31
SSDEEP

12288:r6zcyAwHWZJOLMZ7vgg24T4xT0Wm6y7+uSm0POeB83mAQuaPc19LW1lVmt1XS/2E:r6TH2gK0xxm64+ut1F2fuaG35Cy

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
kex#-rHjHM4qKk52
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1820-2-0x0000000002100000-0x00000000021A8000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-4-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-5-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-9-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-7-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-11-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-13-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-17-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-21-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-23-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-25-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-27-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-29-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-19-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-31-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-15-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-35-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-39-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-43-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-51-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-49-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-53-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-47-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-45-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-55-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-65-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-67-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-63-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-61-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-59-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-57-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-41-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-37-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-33-0x0000000002100000-0x00000000021A3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1820-930-0x0000000004A60000-0x0000000004AA0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bank_Confirmation.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdf = "C:\\Users\\Admin\\AppData\\Roaming\\pdf.exe"	Bank_Confirmation.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank_Confirmation.exe

description pid process target process

PID 1820 set thread context of 1548 1820 Bank_Confirmation.exe Bank_Confirmation.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

2192 ipconfig.exe
1524 ipconfig.exe

description	pid	process	target process
PID 1820 set thread context of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe

pid	process
2192	ipconfig.exe
1524	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09ba56c052dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000b0f0b88665180692376961dd0d54415995db1856f34f94aa5d4133e6cd52949c000000000e80000000020000200000001eb9f022aecd237ffd23c12bf017709362bce0f2de70d442e584ce4f98ea03e0900000003555508f15d2ea8b9478673dd83983b8360e52aaba62ec9e38132a384908a01a9e922b2b0e1bc60d1cbc6404cd328d0854dbf13bf5c355c6fa49ae225c08c79ed60f6f209b91cd24bb06725b9504719c0dcd9dcdbef8ce31732e70508e8d9ddd5b9877a07da0334e274a72328d93b52a4b1233ab6141d7b760f5f54ce3bce7c05e9b4c6fa20c959f5dafa97f596ea7ae40000000f24714441d885b109fcc7fa0ce4cb9bfd7560938982198910575f44d9c9ed4f93470aa454b9f112c1a3847e0a55fcf7ac5310c71dc2f9bfc71bc28dceacc667f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "408552262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96783DF1-98F8-11EE-BE11-4EC251E35083} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f5400000000020000000000106600000001000020000000cbb63118fb7e8b15a187ac798bc4408f2fdc9e409d700845a7841027a89c7118000000000e8000000002000020000000813727abb9d6c8fa2bbbcc4dabc4b83bbf3690ab3cd647bcc6d939cbe2c55caa20000000eec82f4dac8103cfd7447155862ba21c67c3daa80d035991f3c7cde17dbe0b1a400000001650276d4a1a84c3bd70b79bf087cd1310b82a038ecfc2de9d966668ab07251cd4c19d2cd4c40c4061e45c85eeb0ae7027196b55a87007038452763fc25b6da8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exe

pid process

1820 Bank_Confirmation.exe
2944 powershell.exe
1548 Bank_Confirmation.exe
1548 Bank_Confirmation.exe

pid	process
1820	Bank_Confirmation.exe
2944	powershell.exe
1548	Bank_Confirmation.exe
1548	Bank_Confirmation.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Bank_Confirmation.exepowershell.exeBank_Confirmation.exe

description	pid	process
Token: SeDebugPrivilege	1820	Bank_Confirmation.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1548	Bank_Confirmation.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1212 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1212 iexplore.exe
1212 iexplore.exe
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE
1336 IEXPLORE.EXE

pid	process
1212	iexplore.exe

pid	process
1212	iexplore.exe
1212	iexplore.exe
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

Bank_Confirmation.execmd.execmd.exepowershell.exeiexplore.exe

description	pid	process	target process
PID 1820 wrote to memory of 2680	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 2680	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 2680	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 2680	1820	Bank_Confirmation.exe	cmd.exe
PID 2680 wrote to memory of 2192	2680	cmd.exe	ipconfig.exe
PID 2680 wrote to memory of 2192	2680	cmd.exe	ipconfig.exe
PID 2680 wrote to memory of 2192	2680	cmd.exe	ipconfig.exe
PID 2680 wrote to memory of 2192	2680	cmd.exe	ipconfig.exe
PID 1820 wrote to memory of 2944	1820	Bank_Confirmation.exe	powershell.exe
PID 1820 wrote to memory of 2944	1820	Bank_Confirmation.exe	powershell.exe
PID 1820 wrote to memory of 2944	1820	Bank_Confirmation.exe	powershell.exe
PID 1820 wrote to memory of 2944	1820	Bank_Confirmation.exe	powershell.exe
PID 1820 wrote to memory of 1900	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 1900	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 1900	1820	Bank_Confirmation.exe	cmd.exe
PID 1820 wrote to memory of 1900	1820	Bank_Confirmation.exe	cmd.exe
PID 1900 wrote to memory of 1524	1900	cmd.exe	ipconfig.exe
PID 1900 wrote to memory of 1524	1900	cmd.exe	ipconfig.exe
PID 1900 wrote to memory of 1524	1900	cmd.exe	ipconfig.exe
PID 1900 wrote to memory of 1524	1900	cmd.exe	ipconfig.exe
PID 2944 wrote to memory of 1212	2944	powershell.exe	iexplore.exe
PID 2944 wrote to memory of 1212	2944	powershell.exe	iexplore.exe
PID 2944 wrote to memory of 1212	2944	powershell.exe	iexplore.exe
PID 2944 wrote to memory of 1212	2944	powershell.exe	iexplore.exe
PID 1212 wrote to memory of 1336	1212	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 1336	1212	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 1336	1212	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 1336	1212	iexplore.exe	IEXPLORE.EXE
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe
PID 1820 wrote to memory of 1548	1820	Bank_Confirmation.exe	Bank_Confirmation.exe

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:1524

C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
C:\Users\Admin\AppData\Local\Temp\Bank_Confirmation.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e47b8507e0f53e76afcff10486b361ba

SHA1
1bdf32e283bdf2f462721dd7384531102df492f5

SHA256
8778529fecdf7e21acd4201c913e7255d0e374e3fa0d707d00840f5935bc1198

SHA512
0ab9f9c8b3139120f99cd4930b33e23f198e0d5e40ed899c78bbcf105b897b2c18e2ed3b8f65c1c7835148d82262ad191eed008b39c9b379dcaca96c073d064d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e83835aaeaca1074b47e70c84c69d59

SHA1
5cb286871f6e067b08e34bffb70050e4371c49ca

SHA256
c3cc10ef1600d65ec3a6485fc2780beac3f3768f3d42e13a2e28513412431cd2

SHA512
fc31bfa1f413c85f63a9dc9d064f74cb9ddb85795b72b83bc990b50c538a80b9ee640d4a4b84cda918bb17c06d9c340212717c9e1174b54414f63e4a4ad4eb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74ad56b77c558528f19b267cbdf16252

SHA1
6e5a65ac4210e02229a163c9bd2c6a90c33c4036

SHA256
f45f4df471d847dbf5b0890088470f12290881e98431d42d94a7100536d54020

SHA512
00ddc013402d1a53488440ce08f5a67c3704362955c509546259a75b40e0faddfd316f217806f2e8ddb9c7781fc2d00cd2ba9d4eb3e7297e5332c5584a814525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8da5e9336a3a72c2765be6ee936203

SHA1
62e770c0668c6765b89f309a63e280db9dc58f94

SHA256
2fb193e19600c0a8cbab703c1c9db376909ee6ac0926b1bc8ab13edd259d3a1a

SHA512
2ddbea46fc156c57974d8415737f28e660899a4fce6be8d2fd279f1e54522dfdb48dcffea392e329153d36369dbdb9e2c9e383f2b22b7121e9dee34a2e868d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a4de2990ff9adb180568638d63993b

SHA1
7b86148894df77e48a3c41d4ec943ca35637f28d

SHA256
af8198a1b99f48e0e7fb296c364104b980d757c6c0fd679a215bdc2dca7a9b3c

SHA512
1ef06e2b38d064dacf4298034c1729d466ac33d972d3ef940b687ea0c38f408ecdc9418b4af684b13f77fedda2fc2d0167e195c584029e3b7cc9d08e7187236e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d7c17d6fadc197ce20d824e04865ad7

SHA1
fdd187c8ac9299bc54729dcbe5ce834abe8ee63c

SHA256
676105c23a0b142a10e15d453eb8690c700afc7ca77511b57d7359637e6ad1d3

SHA512
4c9a0068d1ec3c1a6089631aece6775d1280730b4bad298f6d73ec407b6e9036b51d799f83a3feb1b55c378a6b3425e3bc2640b3370a2066ce530596cb4ea4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24731b5b67c53660f6de8ace4f01081b

SHA1
53265854b105d451bdcd1919ee11ee3e91127df1

SHA256
1a6ae5ad41d2e90cf8aea43f87b04389043ad032ea8b8fe5aa864540da2a4d34

SHA512
4a90079d6c8b5e12e95a90a40ec90e3e88dc2cdfcc1eb53d11e61524ce8770295149f15a52f9623a8b83b27e98bb07671c3608ef3c8da7952fa5548a9e76c1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a10b5b3d9a013e7bebd90c4348c7e4

SHA1
e2172fe72f8174b588c510f80ce1142e545d00f9

SHA256
f91f2911d33612e38e2cadc1eacc1ff8d68533305c90282c8bc405b569c80674

SHA512
05b947d3cddde042f7c89ae7d0f894cc7ea464f262925d5ce36b286a7a06a0a4242c85938cbfe7ba6c899c1f67440b06b7f76e09bf44b13226eccb045d37d5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1548ec899e1a26b154f9848a592d57

SHA1
28aee6225857aaf7484f498cec9a9178c18ab0ce

SHA256
d2079526ed4e6763c0073880c0a09df5fe5a172cc436ee1c44d5cffba24185ec

SHA512
f3f2e4b4864ed1f00377391b5020b62071e44c77be20419e29b2564abda34fe77ea1fdf30db12bfb0876d6c4443b5a62a59483aaeea36a89d2923459eadcc256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c87ff70c16d502116f53fb129c82fb

SHA1
06018f1ef7c6773f140f5a1f07047a0000b1f26b

SHA256
effc2e90df3691e903aa42c3c111317fd4b338c6d7662b3056ba009aacefde59

SHA512
6c15aeefcbe62fc213f53f8a60ff5506a009605921441cc948406eda576202df7520a72e568bccf460d2d53fca184b9a5c8bd2daca5d6292d347ee39fe662b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de740798a655f6c93b6e7757cca8c6c9

SHA1
7d84b009631f64ccb6ae447d10d783bb425e5af3

SHA256
1aff2d3a3b449ae01be548bac7c2d8dc74ebf4d89bc202096c19e4bd6e7a23c0

SHA512
54a291e786250ffd70e068b41eb1f872975b72d483ad1b33edde33962a28f1f6a234709b0d90512a40fe5749affe4328dbea14d1af5c06ecace3abad5e0b2747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
217f1be44e0f749a6a437b183355a9ec

SHA1
d483b666554b20c64fbe1b8666354bd1d2df85ee

SHA256
4c470b0df8579af2b56b91a92f35fba752c419f936b10621647055356713d80a

SHA512
90498066b38edb144c63c79dcd31a3e8d9ee8ad9f9e70345ff74b4bf566bdfc62fc98ce871a8dfc8d814acf93abc012c2a4f58aae812324c231092e32cd5ca94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2cc52b75454183c09b0a5486f1c19e5

SHA1
9b95f161b86cc1c58da91787771a97cbe0c7143b

SHA256
87d8f36379dbc7d20041d3c62d14ec2c8b1e26447befcc6bb937ca1a85c88b6d

SHA512
092a3b4ef7f564ddc482015d44d68ffbb9dd34956a5e1d449630e7229ba2a05ad0d7a893f166ecf0a1bbf52b352f925a34ad6653375d137d611e893593904254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e81f19b04f7aa3265a8f8a9b8deb731

SHA1
b67e08c6eb31c3d5dc19c9edfa343613e8ac1edf

SHA256
3ad71ee7f04e83893d1ccda3005e877ce9777a2d9a3a916a4a1f7f4117d1458f

SHA512
70cc97a45c3b41e75aaf47812a97e3b1ee15deedd7d814f66481a315d945decfaf8a7a8b7eff96c1bc6377f355ba1bf5422bf086041053fd72fe37255b1992bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ceb4694a7a58c5d0b3faf18b1bafb7d

SHA1
5a236d3e7b4f281ff72d913131e4edabd87871e0

SHA256
f1afb6c9726c4fdd20e3a245f0454bec9f2182ff2c434c5e6fcff0edf308e48f

SHA512
51a42f5c525b8c51f66471aed6b881477cf105d3da3d56788cfb092b6746d6486b7c64cfae47bc89e78cc889827d5d54a567bf4b5e1062071a3a1b8792cba5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ee485200290f98e10d7ce4942af024

SHA1
816a9cb4e86b3498b66948e1611cdc61648e4a76

SHA256
28891eadeef30e4948ab70a32426997e6dd694bc7c30a5365307367522817301

SHA512
d16f0d658a4f3bc49fb1bba0760c7b165b5a879a9dd49c2ffebfbbcb2809d75ebe2d9ccfc2f55d2fb2ab76222e0186f5af3d4470938382aa736f825be8689f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9330a6705d6d9cd1cad3b737d81edb

SHA1
2808798e3bec5d31494eff3df6dab89aa9081e50

SHA256
1633a21995777fc6c33d5755dde18abf7a1f069d47948d3aff4c32d26a6dbe1e

SHA512
b50d91159132ede2a972f0aa922c03afb401f2479cf08312e5dd2e96a1ab7e30be29b642f24cb7be6a9db58ed7c992f99bf46e2ba10c2e55dee1b935ec0a691e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7322abf9098958cb6739055b8894e366

SHA1
257cc952ebd77f1610b396991c3a0e1cc83801e8

SHA256
daf2a1f7e30ce6a4468c2dcb8ab77968f51d99f75249057e2743b9012084b5a9

SHA512
d881b8a3cdaa5c2bdf5d4a8503b32cb5cbf7fdec608c528ab35521ba5cc5d8facbf90b0f669820260e6f53fee5c4e97c59c9bb6ca74461052cda3260a1d50be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba6380c98bc431696ca9b8dfa8e91c8

SHA1
7840df728dbe921302c015225f0dc110fff89657

SHA256
544499f4506f827339455b29f33d2cde0cf23b8d1eb3fd6901a894590555a8fb

SHA512
c499e3980c4f82581f88194d858e8db1e027df7c65a4297c7fcb1535c623c1d16683b7d92033f603ed2cd25ce08d9226ea514cc4db872874bb010cbcc53bfe7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40236b65b2e09757b8dd1255de2a0452

SHA1
82c9b1529ec62a953c9d66d2477cc2ca6b98af4e

SHA256
b9043a93fd281d9f46b2fb940ea7f27b0c08a41d6ba57c5983cd8b19ffc1ce55

SHA512
283d3bfab4a6d7e7c36b43c591eb977342e1d7e92a331c364cddd2967cd2950c4b6d955f429153d8932fdf93d8f50953d9c138fb0aade32d279e1bf0f19ac561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
33fe157ac4803f314aeb1d90838616e3

SHA1
d187c97b1cf806ea183d45ab3346f5d3198c0300

SHA256
27d8e4a1723c18fbf786f45accf9ed4f35eb47b407c5309c52c7dbee5d842136

SHA512
3d71c445558adf8cfa40ec8bee8d12541fb225dbfd865eb2e2932cf975e4c658ee86d13703bc2784d09462ac10c0e2e6fbd8e88f5baa97241a995fc16bf54793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jaepeb1\imagestore.dat

Filesize
5KB

MD5
628b9f9a42991b3dadc269453b87eb79

SHA1
729d2c53fdc35cfa15b2da7813e7b21c4cdd8ddf

SHA256
ccd49f4489bd4d34139b10d87775a9c0eb16d6f0f4fa67d4bb8316f7a55b0b69

SHA512
8bce205d64b1a7dc877384eda9856928f9012afc426656a3ca8b4eede9e6e90e12f3a24635e8cda53468e289a804d1406d974f1b524cb62a3df8e69a3c858454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TORT3465\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB1.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB4.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1548-1001-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1548-1500-0x00000000736B0000-0x0000000073D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1548-1501-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1548-1010-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1548-1005-0x00000000736B0000-0x0000000073D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1820-39-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-53-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-33-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-926-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1820-927-0x0000000000A20000-0x0000000000A62000-memory.dmp

Filesize
264KB

Download
memory/1820-928-0x0000000000A60000-0x0000000000AAC000-memory.dmp

Filesize
304KB

Download
memory/1820-929-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6.9MB

Download
memory/1820-930-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/1820-1-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6.9MB

Download
memory/1820-2-0x0000000002100000-0x00000000021A8000-memory.dmp

Filesize
672KB

Download
memory/1820-3-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/1820-4-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-997-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6.9MB

Download
memory/1820-41-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-57-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-59-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-61-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-63-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-67-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-65-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-55-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-45-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-47-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-37-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-49-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-51-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-43-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-0-0x0000000000C10000-0x0000000000CF2000-memory.dmp

Filesize
904KB

Download
memory/1820-35-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-15-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-31-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-19-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-29-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-27-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-25-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-23-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-21-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-17-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-13-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-11-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-7-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-9-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/1820-5-0x0000000002100000-0x00000000021A3000-memory.dmp

Filesize
652KB

Download
memory/2944-937-0x000000006F190000-0x000000006F73B000-memory.dmp

Filesize
5.7MB

Download
memory/2944-936-0x00000000023A0000-0x00000000023E0000-memory.dmp

Filesize
256KB

Download
memory/2944-935-0x000000006F190000-0x000000006F73B000-memory.dmp

Filesize
5.7MB

Download
memory/2944-934-0x000000006F190000-0x000000006F73B000-memory.dmp

Filesize
5.7MB

Download