rms | 15628033cbdd1de5669f28d1e4e0d664d32da400c4294b75297da528487a8139

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/12/2023, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9b71a9a905a76781fed3a08e796953.exe
Size

2.3MB
MD5

ba9b71a9a905a76781fed3a08e796953
SHA1

b83caebc4927a727efc19e0704fdf636c8ec814a
SHA256

15628033cbdd1de5669f28d1e4e0d664d32da400c4294b75297da528487a8139
SHA512

b3e6410031f7b5e2e653a7c1203e3b06206d74f6133cfdb485bbe5d04daecaab2918670067d051e95cd99f0c5c47bcee7b0b85155f72b76ad3278ad101e34922
SSDEEP

49152:QAJYumA56Qy6sq82PQyN8XEPkNVGsbYGDEPwRk33O8RQRhBrTG0yXeF1F/8gfaoK:7JY7A56Qyn4OVeMswRkfqFTG0UI/xfab

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Modifies Windows Firewall 1 TTPs 8 IoCs

evasion

Windows Service

T1543.003

pid	Process
896	netsh.exe
2084	netsh.exe
3028	netsh.exe
1216	netsh.exe
1440	netsh.exe
1980	netsh.exe
1624	netsh.exe
2484	netsh.exe

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2220	attrib.exe
2968	attrib.exe
1904	attrib.exe
320	attrib.exe
1632	attrib.exe
2080	attrib.exe
1436	attrib.exe
2548	attrib.exe
1536	attrib.exe
2044	attrib.exe
1644	attrib.exe
2364	attrib.exe

Deletes itself 1 IoCs

pid	Process
2100	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
3060	svchoct.exe
1616	svchoct.exe
2792	svchoct.exe
2708	svchoct.exe
2588	Explorernt.exe
2740	Explorernt.exe

Loads dropped DLL 10 IoCs

pid	Process
2800	cmd.exe
3060	svchoct.exe
2800	cmd.exe
1616	svchoct.exe
2800	cmd.exe
2792	svchoct.exe
2708	svchoct.exe
2708	svchoct.exe
2588	Explorernt.exe
2740	Explorernt.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcr80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfOggMux.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\msvcp80.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfTheoraEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\RIPCServer.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Microsoft.VC80.CRT.manifest	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3	attrib.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\Explorernt.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\PushSource.ax	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\rversionlib.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\HookDrv.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\catroot3\svchoct.exe	cmd.exe
File created	C:\Windows\SysWOW64\catroot3\set.reg	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2216	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 5 IoCs

evasion

pid	Process
1700	taskkill.exe
2448	taskkill.exe
2768	taskkill.exe
2232	taskkill.exe
672	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2108	reg.exe
1776	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2776	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2708	svchoct.exe
2708	svchoct.exe
2588	Explorernt.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	672	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	3060	svchoct.exe
Token: SeDebugPrivilege	2792	svchoct.exe
Token: SeTakeOwnershipPrivilege	2708	svchoct.exe
Token: SeTcbPrivilege	2708	svchoct.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2772	2060	ba9b71a9a905a76781fed3a08e796953.exe	28
PID 2060 wrote to memory of 2772	2060	ba9b71a9a905a76781fed3a08e796953.exe	28
PID 2060 wrote to memory of 2772	2060	ba9b71a9a905a76781fed3a08e796953.exe	28
PID 2060 wrote to memory of 2772	2060	ba9b71a9a905a76781fed3a08e796953.exe	28
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2772 wrote to memory of 2800	2772	WScript.exe	29
PID 2060 wrote to memory of 2100	2060	ba9b71a9a905a76781fed3a08e796953.exe	31
PID 2060 wrote to memory of 2100	2060	ba9b71a9a905a76781fed3a08e796953.exe	31
PID 2060 wrote to memory of 2100	2060	ba9b71a9a905a76781fed3a08e796953.exe	31
PID 2060 wrote to memory of 2100	2060	ba9b71a9a905a76781fed3a08e796953.exe	31
PID 2800 wrote to memory of 2232	2800	cmd.exe	33
PID 2800 wrote to memory of 2232	2800	cmd.exe	33
PID 2800 wrote to memory of 2232	2800	cmd.exe	33
PID 2800 wrote to memory of 2232	2800	cmd.exe	33
PID 2800 wrote to memory of 672	2800	cmd.exe	35
PID 2800 wrote to memory of 672	2800	cmd.exe	35
PID 2800 wrote to memory of 672	2800	cmd.exe	35
PID 2800 wrote to memory of 672	2800	cmd.exe	35
PID 2800 wrote to memory of 1732	2800	cmd.exe	36
PID 2800 wrote to memory of 1732	2800	cmd.exe	36
PID 2800 wrote to memory of 1732	2800	cmd.exe	36
PID 2800 wrote to memory of 1732	2800	cmd.exe	36
PID 2800 wrote to memory of 2548	2800	cmd.exe	37
PID 2800 wrote to memory of 2548	2800	cmd.exe	37
PID 2800 wrote to memory of 2548	2800	cmd.exe	37
PID 2800 wrote to memory of 2548	2800	cmd.exe	37
PID 2800 wrote to memory of 2968	2800	cmd.exe	39
PID 2800 wrote to memory of 2968	2800	cmd.exe	39
PID 2800 wrote to memory of 2968	2800	cmd.exe	39
PID 2800 wrote to memory of 2968	2800	cmd.exe	39
PID 2800 wrote to memory of 1536	2800	cmd.exe	41
PID 2800 wrote to memory of 1536	2800	cmd.exe	41
PID 2800 wrote to memory of 1536	2800	cmd.exe	41
PID 2800 wrote to memory of 1536	2800	cmd.exe	41
PID 2800 wrote to memory of 1904	2800	cmd.exe	42
PID 2800 wrote to memory of 1904	2800	cmd.exe	42
PID 2800 wrote to memory of 1904	2800	cmd.exe	42
PID 2800 wrote to memory of 1904	2800	cmd.exe	42
PID 2800 wrote to memory of 2044	2800	cmd.exe	43
PID 2800 wrote to memory of 2044	2800	cmd.exe	43
PID 2800 wrote to memory of 2044	2800	cmd.exe	43
PID 2800 wrote to memory of 2044	2800	cmd.exe	43
PID 2800 wrote to memory of 320	2800	cmd.exe	44
PID 2800 wrote to memory of 320	2800	cmd.exe	44
PID 2800 wrote to memory of 320	2800	cmd.exe	44
PID 2800 wrote to memory of 320	2800	cmd.exe	44
PID 2800 wrote to memory of 1632	2800	cmd.exe	45
PID 2800 wrote to memory of 1632	2800	cmd.exe	45
PID 2800 wrote to memory of 1632	2800	cmd.exe	45
PID 2800 wrote to memory of 1632	2800	cmd.exe	45
PID 2800 wrote to memory of 1644	2800	cmd.exe	46
PID 2800 wrote to memory of 1644	2800	cmd.exe	46
PID 2800 wrote to memory of 1644	2800	cmd.exe	46
PID 2800 wrote to memory of 1644	2800	cmd.exe	46
PID 2800 wrote to memory of 2080	2800	cmd.exe	47
PID 2800 wrote to memory of 2080	2800	cmd.exe	47
PID 2800 wrote to memory of 2080	2800	cmd.exe	47
PID 2800 wrote to memory of 2080	2800	cmd.exe	47
PID 2800 wrote to memory of 2220	2800	cmd.exe	48

Views/modifies file attributes 1 TTPs 28 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2220	attrib.exe
2344	attrib.exe
876	attrib.exe
2748	attrib.exe
1644	attrib.exe
3040	attrib.exe
1516	attrib.exe
860	attrib.exe
2060	attrib.exe
1904	attrib.exe
2080	attrib.exe
2364	attrib.exe
2548	attrib.exe
2456	attrib.exe
2100	attrib.exe
1536	attrib.exe
320	attrib.exe
1632	attrib.exe
2376	attrib.exe
2264	attrib.exe
1824	attrib.exe
2968	attrib.exe
1436	attrib.exe
2324	attrib.exe
2440	attrib.exe
2044	attrib.exe
2988	attrib.exe
2164	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ba9b71a9a905a76781fed3a08e796953.exe
"C:\Users\Admin\AppData\Local\Temp\ba9b71a9a905a76781fed3a08e796953.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im RManServer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im svchoct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:672
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h "C:\Windows\System32\catroot3"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:320
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +h +r "C:\Windows\System32\de.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1436
  - - C:\Windows\SysWOW64\net.exe
      net stop rserver3
      4⤵
      PID:852
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rserver3
        5⤵
        
        PID:1248
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rserver3.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im r_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cam_server.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\system32\rserver30"
      4⤵
      Views/modifies file attributes
      PID:2988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Windows\SysWOW64\rserver30"
      4⤵
      Views/modifies file attributes
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\system32\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
      4⤵
      Views/modifies file attributes
      PID:2376
  - - C:\Windows\SysWOW64\net.exe
      net stop Telnet
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Telnet
        5⤵
        
        PID:2072
  - - C:\Windows\SysWOW64\sc.exe
      sc config tlntsvr start= disabled
      4⤵
      Launches sc.exe
      PID:2216
  - - C:\Windows\SysWOW64\net.exe
      net stop "Service Host Controller"
      4⤵
      PID:2388
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Service Host Controller"
        5⤵
        
        PID:2392
  - - C:\Windows\SysWOW64\net.exe
      net user HelpAssistant /delete
      4⤵
      PID:2248
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user HelpAssistant /delete
        5⤵
        
        PID:2296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn security /f
      4⤵
      PID:112
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="RealIP"
      4⤵
      Modifies Windows Firewall
      PID:1216
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
      4⤵
      Modifies Windows Firewall
      PID:1440
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="Service Host Controller"
      4⤵
      Modifies Windows Firewall
      PID:1980
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
      4⤵
      Modifies Windows Firewall
      PID:1624
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
      4⤵
      Modifies Windows Firewall
      PID:2484
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete portopening tcp 57009
      4⤵
      Modifies Windows Firewall
      PID:896
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="cam_server"
      4⤵
      Modifies Windows Firewall
      PID:2084
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete portopening tcp 57011 all
      4⤵
      Modifies Windows Firewall
      PID:3028
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαáµ¿«¡¡á∩ ß¿ßΓÑ¼á Microsoft Windows" /f
      4⤵
      Modifies registry key
      PID:1776
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
      4⤵
      Modifies registry key
      PID:2108
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /silentinstall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3060
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /firewall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1616
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s set.reg
      4⤵
      Runs .reg file with regedit
      PID:2776
  - - C:\Windows\SysWOW64\catroot3\svchoct.exe
      "svchoct.exe" /start
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
      4⤵
      Views/modifies file attributes
      PID:876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
      4⤵
      Views/modifies file attributes
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
      4⤵
      Views/modifies file attributes
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
      4⤵
      Views/modifies file attributes
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
      4⤵
      Views/modifies file attributes
      PID:1516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
      4⤵
      Views/modifies file attributes
      PID:860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
      4⤵
      Views/modifies file attributes
      PID:2164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
      4⤵
      Views/modifies file attributes
      PID:1824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
      4⤵
      Views/modifies file attributes
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
      4⤵
      Views/modifies file attributes
      PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:2100

C:\Windows\SysWOW64\catroot3\svchoct.exe
C:\Windows\SysWOW64\catroot3\svchoct.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2740
- C:\Windows\SysWOW64\catroot3\Explorernt.exe
  C:\Windows\SysWOW64\catroot3\Explorernt.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
236B

MD5
450a76c0b6d549f8d7e66c69850445a8

SHA1
8e7fe52eddabd04395877ebd4177efbb74a0bdc7

SHA256
763cffe76d7b9b8101e3423716946a8c8651805e413785787a87f1665357c30f

SHA512
28c092378c365d47d7ad229d3e67f1ba82e875b21c01b34f83e232e3329d28f73b8484a65e3fca85406cb8d6c9716ee433b681c10f08afb4dd8d619e3b12b23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Explorernt.exe

Filesize
2.8MB

MD5
a0924820769909ca25e9eea948b7d8ad

SHA1
e70e1a1662a4fe966e38218beb777516c3db4e37

SHA256
74fe2a1e6116c5a199dcc6aa738d546bfc55b41edc1b7c5459019e7d18ae5e36

SHA512
e3d5b963b0358b08301eaed387d1d206da408096ca895b6262b2eb79a026314821885477a07fce78b9107b8c8169cc6c4d52e404c4b01b3a8bb33569929b8073

Download Submit
C:\Users\Admin\AppData\Local\Temp\HookDrv.dll

Filesize
144KB

MD5
513066a38057079e232f5f99baef2b94

SHA1
a6da9e87415b8918447ec361ba98703d12b4ee76

SHA256
02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

SHA512
83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest

Filesize
1KB

MD5
d34b3da03c59f38a510eaa8ccc151ec7

SHA1
41b978588a9902f5e14b2b693973cb210ed900b2

SHA256
a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc

SHA512
231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PushSource.ax

Filesize
448KB

MD5
d7eb741be9c97a6d1063102f0e4ca44d

SHA1
bf8bdca7f56ed39fb96141ae9593dec497f4e2c8

SHA256
0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7

SHA512
cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll

Filesize
96KB

MD5
329354f10504d225384e19c8c1c575db

SHA1
9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

SHA256
24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

SHA512
876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll

Filesize
84KB

MD5
65889701199e41ae2abee652a232af6e

SHA1
3f76c39fde130b550013a4f13bfea2862b5628cf

SHA256
ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

SHA512
edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll

Filesize
240KB

MD5
5f2fc8a0d96a1e796a4daae9465f5dd6

SHA1
224f13f3cbaa441c0cb6d6300715fda7136408ea

SHA256
f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

SHA512
da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll

Filesize
1.6MB

MD5
086a9fd9179aad7911561eeff08cf7e2

SHA1
d390c28376e08769a06a4a8b46609b3a668f728b

SHA256
2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

SHA512
a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
5KB

MD5
0bc7d3a303e0c6d7d84f1db5d5efef43

SHA1
93bc6ca6f770ec2c6f99a5bb3d482fd029bc2c63

SHA256
e61b80f090c29a367f6ab31602da917a9d67a1be5ef0d758f258b792e219913c

SHA512
b5e801510b8464fc387521853fb09174ce16d54e70bd0d145d717f965e6df04fcfea4a6687c2ae8ac3f95d59ed6027fb7a337b50d962f0aaeed71d85219b8d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcp80.dll

Filesize
541KB

MD5
8c53ccd787c381cd535d8dcca12584d8

SHA1
bc7ce60270a58450596aa3e3e5d0a99f731333d9

SHA256
384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

SHA512
e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

Download Submit
C:\Users\Admin\AppData\Local\Temp\msvcr80.dll

Filesize
617KB

MD5
1169436ee42f860c7db37a4692b38f0e

SHA1
4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

SHA256
9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

SHA512
e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rversionlib.dll

Filesize
310KB

MD5
3f95a06f40eaf51b86cef2bf036ebd7a

SHA1
64009c5f79661eb2f82c9a76a843c0d3a856695d

SHA256
1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

SHA512
6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.reg

Filesize
12KB

MD5
05fc6abd61e51d085c0d8a4865214849

SHA1
a48f10e8835f4db8d7a276227921f2339b8729cf

SHA256
084ff031d15562bb8e56fea45eb5c52a7e333ccaf21df76bdc7e3c41b1638544

SHA512
97cad9f7197ebc0a173cbd9419c1cd3097718bd94fd6e1c138830944a81e13f9d04ebe491e29310312e977e5b20e0f3782fe37936ceaa7b536bf1fd65154aef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\stop.js

Filesize
215B

MD5
804b35ef108ec9839eb6a9335add8ca1

SHA1
bf91e6645c4a1c8cab2d20388469da9ed0a82d56

SHA256
fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406

SHA512
822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchoct.exe

Filesize
715KB

MD5
06d8b94b30ec406c61a30988154d146a

SHA1
864954c762707d9b41bf825641808670327e7de3

SHA256
9cc8963159be08dcafb570affe11251b6ad6d1975342f93265c80571e047ef2d

SHA512
e53e840e9c7f2a150224962c9ee74295bf5209b49a0bfa6656e0da83c864d320199960920b38914277b9f14ba64f97d9bded2713ab523eba616a3788816ac4e3

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
100KB

MD5
4c12116e363463fbfb28dd72767aa9bd

SHA1
e2cf5ea13ac2935b6960438092acdac67a3c5394

SHA256
4e86bc37864f0224d5da105dc4a1ad42f8c3e5655b531932403fab731269343c

SHA512
648804ffb8515b03fb03cd961ef43ed11ee12007cff8211147e29de0ea58b3ca8bc9e204b9921a31af0a360b30efd6b33dbea7e6aaf5cfb964dc77240506735a

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
489KB

MD5
c8fecfcc99ec70bb64dfa56a97792dbd

SHA1
3d14c69c72b56f46bd7512b6873afd63ab122d8d

SHA256
a57debb73fabeaa2bc2e6110dfde1e6bae304be9c3668a186145934a390c5ddc

SHA512
8fb5a03f156ef07babdd6f938fa384d13af87a53b58fd00b95c7a6535447a397baa7f04cf1e095ea47f6ba3339d4aed9dae6d3ca1b565905994a83455bd7fbf9

Download Submit
C:\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
71KB

MD5
fa0ddfa1d756479d62b5fa90b5e6aee7

SHA1
49240818c600f45f42fa9f8fa9cd3a0701256dba

SHA256
dd8ba22763abd2eecd4b1340591c6cd44ece3dc69a898d4f121d1e06bed64efd

SHA512
35bd59ced1a0ff2fc04de06126001ba3c3d6bacc71b049b1f04e7e9abff731bd09ad5822ea69b59006c556622047eb2a671da652d66a0234ef79234904470fc5

Download Submit
C:\Windows\SysWOW64\catroot3\RIPCServer.dll

Filesize
40KB

MD5
266ab90eff229b987825d17489ac8f76

SHA1
ed8712becfd54c4af15ea0cf4942e63bf90e8159

SHA256
a6b979870fb9413f3e06899263b90a29343cf02515321bf8e280352f4c39cdd1

SHA512
5941d14e332d240dbf506671f67f23a48450119fba36ebab0bdf3ae3bdaddb332b72df8838b3ba0d4c30452c3bcbee3800c80695239d619554ac5569b895832a

Download Submit
C:\Windows\SysWOW64\catroot3\dsfVorbisEncoder.dll

Filesize
415KB

MD5
2f3fa2e030b4159fc1693e66a2a3d306

SHA1
a8a77dd2f82e94c1bdd952903ccc2524eb270322

SHA256
b18c1bba8bbd4edc517238b04872a5fbd95622d81cd510b68d913e1938a791c5

SHA512
1f9962a23d9686c8504d17dcb4614ac93585a3d4c2b85486a76fdf06350c7a56aa216338f2645c4368acc6f49c2141ac8e332f43885b1b614fffd4153ea8ddbe

Download Submit
C:\Windows\SysWOW64\catroot3\msvcp80.dll

Filesize
412KB

MD5
f4d76965fae94f3e4faee7b4459bb6cd

SHA1
fc07517fad1b50c36708fe86a8a74ea33d75ea68

SHA256
f46a89833d12183bb3f98ed3b0ecc5888abfc865ef20c95d693def005de96803

SHA512
dd2b823313af29c92736f1c4655b423d250b161b4c77a0c2d17b2a8ed9a59a57aced2367a246d7c4abcce7ed4b416f3e147b16a98a2a183f92369bc3b9b16f12

Download Submit
C:\Windows\SysWOW64\catroot3\msvcr80.dll

Filesize
434KB

MD5
837ddfba6e0ca2f51809f7add4687140

SHA1
9a4589f13c6a49e1dd69f5ae8900ed73a4681646

SHA256
e86a0f2d3400e572abaebb2502ffd98f700a30550902c3137cb05cb8123f3fc2

SHA512
15c44ad0fa3f6e7fbefa378c6a320d32bcf7871de8a9df9aad0af29db9867a4ad12d09e842b7e4ec529902f5baa880c8b663df4b8f9484fcca25d2861adf4402

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
140KB

MD5
b04770b35949aab2d03e8e59097cb19a

SHA1
ac73b2df2b3c4fe227dff9b18d39a9c3ac218453

SHA256
2bc312890a60ec87a962569002879155e8d284b3847c4e140149f5623492ab95

SHA512
6d89ee3c2a6e1429a2b04b74fe22ac8e3ee3797d383f551497de051880f73dee47da5c36b987626d5cc3d51d1172cb34d50870e61d9f0ade1c112226c5f187c3

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
77KB

MD5
aa0585ac98565ffb2e6e15a88d5c334a

SHA1
f0b25dcbe1f3bac5935dbdd61fd969e32ce2fa7b

SHA256
0fecb29613d2a74e3c604844119f693e311419823f5c01164cba5665ee937d7d

SHA512
55e7e06339b4b3fb492e1392a9e70736fbe2ca002039fbcb78e68e671b9de7e88cfe879f448a3565f58195be01b135efa7b34fbc8c97e661fac05b02f60cd9a8

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
2.1MB

MD5
90e5ee558794ab92d43555741a01993c

SHA1
8bd57b50fc5a9edd75695d2e8cdd9a0987d72e42

SHA256
ca2a92dccfb004caae7e697d1adee65787e60cb18a10dcfe3820e3085d3c005b

SHA512
7fcb426953a4785989282e3c286dc7a546bbf6f2799abf35615382ff78d7756463e7952483f61e6ac1b5c1f14acf56aa668ecdb011bbae74d24295bc64570420

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
1.4MB

MD5
eff033ebaa3f8bf8f5d825c35d5b69a4

SHA1
1dd8f194e025b06e49f0464f7ae226766e7149fa

SHA256
272979dc6253146d912e2cb9c2572e496cee11e5a6d0d7d01d20eb212ad7c244

SHA512
56c5a303f5ff80be26d577d0ddeb92ad0b946216e5748aaa5e5f50fc7f2e8bef3399853c96a87e5af1d98b8b99269190e85c67a818d7585a2f0407e513d79885

Download Submit
C:\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
48KB

MD5
a8a665e40a9bdd3875f145e6f5b08f19

SHA1
21d3a87e7c32ae658e7169a200205a078c436e8e

SHA256
71514829f67a823918c0f4c0b26f3410083f36d0265e43d9586d5fb0741d0fca

SHA512
122cdddb4f1ded7a4be9bd04277ae2f11472530429420b124d889b5ab889633fb0b1784bc94b45032e9c200d713bf831d89c0dc3dd4746613bc240cb20bbe0c6

Download Submit
\Windows\SysWOW64\catroot3\Explorernt.exe

Filesize
82KB

MD5
13a3ac7aef77ab789c8522bbace676d4

SHA1
08bd6833a2bca4eb79943201230b24146efed462

SHA256
7e68dc92aa17df7bf32b0bf877c613ba241db1946e2fc13ef538033f2d6e6cb7

SHA512
51a6a884bf41e92281ffb23d3d1518df59d6c92a970f5cf321dbc2c2b001d77d3003aad9c3375d956bd127c1c0cba84f477bfa6a152fa34a85d5b2222b15b809

Download Submit
\Windows\SysWOW64\catroot3\rversionlib.dll

Filesize
114KB

MD5
498432ddbaa1b61c525322a78aea4122

SHA1
1263d08f93a6bd0829498128d6fffac4debd802a

SHA256
b7c69b456162a18611a2369418d1d15f715f6c894a9bb608fadcd689ae061f70

SHA512
6938f089218cd0cb2de60d16c0f3ac02737ba914ee78a55709e8b509dd3a2e7ca86797ac46fcfaf2b980d30bf1eaff4b86de11fe890c766af5efc095448bd9bd

Download Submit
\Windows\SysWOW64\catroot3\rversionlib.dll

Filesize
91KB

MD5
25e8bae4a997809c99fa27c7efe0bba3

SHA1
90f7ece8a3f43fb078eb33978f7f5294b7c5e842

SHA256
f406d7f2628ff6d0d791d0304e90ad313773a905d48b71084e7af7856c7a2927

SHA512
22c4004fbfe6ae7cbb58d01e65b75b9ee79ce25a61b8275ad1ed46c8e2fd3a951d48d66dcdd1d949f64f1b551534c7090ffc3ebdf40e4f1803e22ec1c7f023e0

Download Submit
\Windows\SysWOW64\catroot3\rversionlib.dll

Filesize
66KB

MD5
e2c5a1e0993911bec3aa40fc6a6969a1

SHA1
2c0ba80c5344ea1f566be9ca1bcc68b43e85d5d1

SHA256
7476eec32548b20ca77f64542fe7de4ba9c7531372e6c5ae00d51d87bc0a8888

SHA512
a0c07fbc8ef4107841a5a116b035d54b3a87b5fa718d64c1e64c3e4ad77b08363296dbfa8858934dc2a23c87601016bb6409f735b476079433b8da08295b1bc2

Download Submit
\Windows\SysWOW64\catroot3\rversionlib.dll

Filesize
17KB

MD5
934b3e9aa56be3eb6fa9df64c48f991f

SHA1
f398d5153de55c1c4a728c273c0adbdeb50081ff

SHA256
e7869d3658c6b6d855af166f6b049ef5edbc0200e01c82a44d06d3c9ded85414

SHA512
6dedbd6d71ff08e560fb874fa62298d9b316eb3eb62de9eb5223bcc1057499f44f7d1b96dd93c8a83feea31ab8155c7c87bb61c64bf29309f094d30706568e7b

Download Submit
\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
87KB

MD5
16b10ab127edfbd29d0026b55a116296

SHA1
a6d13c37e7de606d3101ec98e15207cdee36f71d

SHA256
8505a769c529a745be86058049ce7b09d3b748f99f5b22e11ad1ad88440b7b5f

SHA512
c4321db269c47afb85f01b7d8c4f271df05083fa0f2beb7cf8137126018cd54c6cc4aa01cf1cea3b4cc1fc1d0bb52ceef1065862bcdf3e66db13ef7e412047ac

Download Submit
\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
2.1MB

MD5
109a79be8636c7d877cc307341ae47de

SHA1
4a2a5017062038c9c9a478640a180bcb428a2d4b

SHA256
71bbbb8230c3c5ea9058f58d4572a64fe796a1040a230c236f485e4f1629a976

SHA512
1b67793d5a81b33a98e47c35baf9c425e62bf7d8bd88fb7d5ff7a8da8eb511e3d971b0ed055fb930217ce5d0fe5c7e9aa05f65c71b01fdb856a63117d27f9bc6

Download Submit
\Windows\SysWOW64\catroot3\svchoct.exe

Filesize
186KB

MD5
85383c2d0ea26c82ba60ec29217907db

SHA1
b4ea7f04e5d421217adcb5869982166e3238238f

SHA256
b34088ff341ed5153a206d3c727ae235c191ac2232369fa1dd8e79f3babc1cc3

SHA512
26343b08bbe57eebee8abd92a7f1f59fbe684f4b739bc35c53aa52e94f68c6e4a77c2e05ef52111e39a911f14ef445cec330604a7193664091c4b81d52b6acc7

Download Submit
memory/1616-101-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/1616-100-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1616-102-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2588-135-0x0000000000760000-0x00000000007B8000-memory.dmp

Filesize
352KB

Download
memory/2588-130-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2588-126-0x0000000000760000-0x00000000007B8000-memory.dmp

Filesize
352KB

Download
memory/2588-134-0x0000000000400000-0x0000000000757000-memory.dmp

Filesize
3.3MB

Download
memory/2708-138-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-160-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-156-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-152-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-148-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-143-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/2708-142-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2708-114-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2708-139-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2740-140-0x0000000000400000-0x0000000000757000-memory.dmp

Filesize
3.3MB

Download
memory/2740-131-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2740-147-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2740-141-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2792-110-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2792-133-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/2792-132-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/3060-93-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/3060-88-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/3060-89-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3060-91-0x0000000000230000-0x0000000000288000-memory.dmp

Filesize
352KB

Download
memory/3060-92-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download
memory/3060-90-0x0000000000400000-0x00000000007C6000-memory.dmp

Filesize
3.8MB

Download