djvu | a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e

Analysis

max time kernel
293s
max time network
167s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
Size

737KB
MD5

4be84d2271fde324d48f5364ff65e12f
SHA1

124e6cb72a9340605227da0b4ea958e2e4f69de9
SHA256

a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e
SHA512

f35b53dc32c0d5399a3c35539934baf0acdac9fcd821c69223d1111fa17523e6455fc01ea2b82cfda50b1f6ca905ef4c67d113b5cb3aa66cd5ad0da6bef3f70b
SSDEEP

12288:P4a3i3PM6FctLclDaaS8Myn/QRGURpqipm9rudVZfejbJhNpojv:gAipcmlDtS85IRGUyicrU3WjbJh36

Score

10^/10

djvu vidar discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://zexeq.com/test1/get.php

Attributes

extension
.cdqw
offline_id
mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1
payload_url
http://brusuax.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-99MNqXMrdS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0840ASdw

rsa_pubkey.plain

Signatures

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral1/memory/1992-108-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/1992-109-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/1656-107-0x0000000000220000-0x000000000024A000-memory.dmp	family_vidar_v6
behavioral1/memory/1992-103-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/1992-157-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/1992-258-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/1992-259-0x0000000000400000-0x000000000063D000-memory.dmp	family_vidar_v6
behavioral1/memory/2780-278-0x0000000000270000-0x0000000000370000-memory.dmp	family_vidar_v6

Detected Djvu ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/2932-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2932-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2932-7-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2864-5-0x00000000008E0000-0x00000000009FB000-memory.dmp	family_djvu
behavioral1/memory/2932-44-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-70-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-69-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-77-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-76-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-74-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-78-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2156-121-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1656	build2.exe
1992	build2.exe
2432	build3.exe
3060	build3.exe
2780	mstsca.exe
1592	mstsca.exe
240	mstsca.exe
1500	mstsca.exe
2128	mstsca.exe
2180	mstsca.exe
2504	mstsca.exe
2480	mstsca.exe

Loads dropped DLL 8 IoCs

pid	Process
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2524	WerFault.exe
2524	WerFault.exe
2524	WerFault.exe
2524	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2452	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\914994ea-195e-4f86-a262-ddd1b07eae11\\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe\" --AutoStart"	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
16	api.2ip.ua

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2520 set thread context of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 1656 set thread context of 1992	1656	build2.exe	37
PID 2432 set thread context of 3060	2432	build3.exe	40
PID 2780 set thread context of 1592	2780	mstsca.exe	47
PID 240 set thread context of 1500	240	mstsca.exe	51
PID 2128 set thread context of 2180	2128	mstsca.exe	53
PID 2504 set thread context of 2480	2504	mstsca.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	1992	WerFault.exe	37

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2388	schtasks.exe
2756	schtasks.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2864 wrote to memory of 2932	2864	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	28
PID 2932 wrote to memory of 2452	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	30
PID 2932 wrote to memory of 2452	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	30
PID 2932 wrote to memory of 2452	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	30
PID 2932 wrote to memory of 2452	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	30
PID 2932 wrote to memory of 2520	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	31
PID 2932 wrote to memory of 2520	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	31
PID 2932 wrote to memory of 2520	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	31
PID 2932 wrote to memory of 2520	2932	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	31
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2520 wrote to memory of 2156	2520	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	32
PID 2156 wrote to memory of 1656	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	36
PID 2156 wrote to memory of 1656	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	36
PID 2156 wrote to memory of 1656	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	36
PID 2156 wrote to memory of 1656	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	36
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 1656 wrote to memory of 1992	1656	build2.exe	37
PID 2156 wrote to memory of 2432	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	39
PID 2156 wrote to memory of 2432	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	39
PID 2156 wrote to memory of 2432	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	39
PID 2156 wrote to memory of 2432	2156	a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe	39
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 2432 wrote to memory of 3060	2432	build3.exe	40
PID 3060 wrote to memory of 2388	3060	build3.exe	42
PID 3060 wrote to memory of 2388	3060	build3.exe	42
PID 3060 wrote to memory of 2388	3060	build3.exe	42
PID 3060 wrote to memory of 2388	3060	build3.exe	42
PID 1992 wrote to memory of 2524	1992	build2.exe	44

C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
"C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
  "C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\914994ea-195e-4f86-a262-ddd1b07eae11" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
    "C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe
      "C:\Users\Admin\AppData\Local\Temp\a9bad8d42443a9072a60a91f8a747c9c6221203a6c035ecdae621bc2f4fddf8e.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe
        
        "C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1656
      - C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe
        
        "C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1412
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build3.exe
        
        "C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build3.exe
        
        "C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2388

C:\Windows\system32\taskeng.exe
taskeng.exe {57603222-CE91-466A-A49B-5A72B6D78780} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
1⤵
PID:2764
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:1592
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:2756
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:1500
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2180
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d32edbf2ab57545826f0da4fc15d3bd5

SHA1
062993c001004317a908207f46a07c6db89ea5b3

SHA256
dc2dd2d90bb2ae77bc76c9f040afb7d0bc94ccaf665dbb77dd38492aa49026ff

SHA512
f64a6a72ff9d73443125e8ed2105974e8839392503fe3ec88eec061d004d8e657e55b40c32f9dea12f4a0297487a8e72823ea3b847c8e3c44428dee19c2758a0

Download Submit
C:\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe

Filesize
92KB

MD5
5486dcef9f46fd244d5815c348778325

SHA1
229e9fab51dacb873d2f2d9032b5e5d4943d2b2e

SHA256
b83ff1a292a3adfed1d4946fd764daba4f9e57644c97b9b8ecbb416b9a889f68

SHA512
b98541add19236c5f2a4673f8dcb8a37f5ea989768df89467efb051e15cbfdb86290a1f6639058e59f6919f2e660ae7a121b7a77a14ef87b78456dc2ceae1c3c

Download Submit
\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build2.exe

Filesize
247KB

MD5
1f7efac73d987dae200e36922267d8c6

SHA1
a1bb90007d2e00025953c13ca742d767ebcce27e

SHA256
5719504e2f4e976c8ce6fbfda399b80273e783ff05f61dfd1f1bd4737f0bde8a

SHA512
75ef83a7e079e553a98e60dd73a9eebbaa793ced7bbd8a712a8f7f363349456d12b3766481d03d00f376cf31c4697afd934eb9b29a2e70727a70a9f463d03bed

Download Submit
\Users\Admin\AppData\Local\7abb0646-c919-4e72-9418-d45d140ca3b5\build3.exe

Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
memory/240-295-0x00000000008F2000-0x0000000000902000-memory.dmp

Filesize
64KB

Download
memory/1656-107-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1656-106-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

Filesize
1024KB

Download
memory/1992-259-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1992-103-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1992-157-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1992-258-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1992-109-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1992-108-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/2128-323-0x00000000009B2000-0x00000000009C2000-memory.dmp

Filesize
64KB

Download
memory/2156-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-76-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-74-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-78-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-77-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-69-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-70-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-52-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2156-121-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-163-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2432-165-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/2504-351-0x0000000000932000-0x0000000000942000-memory.dmp

Filesize
64KB

Download
memory/2520-47-0x0000000000230000-0x00000000002C1000-memory.dmp

Filesize
580KB

Download
memory/2520-46-0x0000000000230000-0x00000000002C1000-memory.dmp

Filesize
580KB

Download
memory/2780-278-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2780-267-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2864-0-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2864-5-0x00000000008E0000-0x00000000009FB000-memory.dmp

Filesize
1.1MB

Download
memory/2864-6-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2932-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2932-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2932-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2932-44-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3060-168-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3060-170-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3060-171-0x0000000000410000-0x0000000000477000-memory.dmp

Filesize
412KB

Download
memory/3060-164-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download