formbook | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Analysis

max time kernel
125s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

formbook guloader phorphiex xmrig zgrat ce10 downloader evasion loader miner persistence rat spyware stealer trojan upx worm

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ce10

Decoy

universalbowls.com

bp5.site

thiagokielingwebdesign.net

grapper.fun

grow-more.us

cqdh888.com

facthunter.app

cstars05.xyz

baumeagency.com

montevallotowing.top

joshtdownes.com

ampvit88.info

timelesscoutureclothing.com

stimuscle.com

uppervillekeyword.top

victoriabaltzer.com

laguindah.art

kiddieboost.com

santafekeyword.top

818experience.com

Extracted

Family

phorphiex

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Detect ZGRat V1 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2804-867-0x00000000021A0000-0x000000000226A000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-869-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-868-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-871-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-873-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-875-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-877-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-879-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1
behavioral1/memory/2804-881-0x00000000021A0000-0x0000000002263000-memory.dmp	family_zgrat_v1

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Formbook payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2768-732-0x0000000000400000-0x0000000001462000-memory.dmp	formbook
behavioral1/memory/1672-768-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook
behavioral1/memory/1672-770-0x0000000000080000-0x00000000000AF000-memory.dmp	formbook

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/340-816-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-817-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-820-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-821-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-822-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-823-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-824-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-826-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/340-827-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 10 IoCs

Processes:

build3.exebuild3.exebin.exeTrumTrum.exemstsca.exemstsca.exeXMRig.exeuwgxswmtctao.exemstsca.exe

pid process

1740 build3.exe
2796 build3.exe
344 bin.exe
1708 TrumTrum.exe
2400 mstsca.exe
2348 mstsca.exe
2956 XMRig.exe
468
2428 uwgxswmtctao.exe
2508 mstsca.exe

pid	process
1740	build3.exe
2796	build3.exe
344	bin.exe
1708	TrumTrum.exe
2400	mstsca.exe
2348	mstsca.exe
2956	XMRig.exe
468
2428	uwgxswmtctao.exe
2508	mstsca.exe

Loads dropped DLL 12 IoCs

Processes:

4363463463464363463463463.exebuild3.exebin.exebin.exe

pid	process
2988	4363463463464363463463463.exe
2988	4363463463464363463463463.exe
1740	build3.exe
2988	4363463463464363463463463.exe
2988	4363463463464363463463463.exe
2988	4363463463464363463463463.exe
344	bin.exe
344	bin.exe
2768	bin.exe
2988	4363463463464363463463463.exe
2988	4363463463464363463463463.exe
468

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe	upx
C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe	upx
C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe	upx
\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe	upx
behavioral1/memory/1708-468-0x0000000000DB0000-0x0000000001C13000-memory.dmp	upx
behavioral1/memory/1708-629-0x0000000000DB0000-0x0000000001C13000-memory.dmp	upx
behavioral1/memory/340-811-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-812-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-813-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-814-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-815-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-816-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-817-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-820-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-821-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-822-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-823-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-824-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-826-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/340-827-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

21 drive.google.com
20 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

bin.exe

pid process

2768 bin.exe
2768 bin.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

bin.exebin.exe

pid process

344 bin.exe
2768 bin.exe

flow	ioc
21	drive.google.com
20	drive.google.com

pid	process
344	bin.exe
2768	bin.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

build3.exebin.exebin.exemstsc.exemstsca.exeuwgxswmtctao.exe

description	pid	process	target process
PID 1740 set thread context of 2796	1740	build3.exe	build3.exe
PID 344 set thread context of 2768	344	bin.exe	bin.exe
PID 2768 set thread context of 1288	2768	bin.exe	Explorer.EXE
PID 1672 set thread context of 1288	1672	mstsc.exe	Explorer.EXE
PID 2400 set thread context of 2348	2400	mstsca.exe	mstsca.exe
PID 2428 set thread context of 340	2428	uwgxswmtctao.exe	explorer.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1652 sc.exe
2104 sc.exe
2580 sc.exe
1576 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2656 612 WerFault.exe 722433123.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2960 schtasks.exe
1500 schtasks.exe

pid	process
1652	sc.exe
2104	sc.exe
2580	sc.exe
1576	sc.exe

pid	pid_target	process	target process
2656	612	WerFault.exe	722433123.exe

pid	process
2960	schtasks.exe
1500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

bin.exemstsc.exeXMRig.exeuwgxswmtctao.exe

pid	process
2768	bin.exe
2768	bin.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe
2956	XMRig.exe
2956	XMRig.exe
2956	XMRig.exe
2956	XMRig.exe
2428	uwgxswmtctao.exe
1672	mstsc.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

bin.exebin.exemstsc.exe

pid process

344 bin.exe
2768 bin.exe
2768 bin.exe
2768 bin.exe
1672 mstsc.exe
1672 mstsc.exe
1672 mstsc.exe

pid	process
468

pid	process
344	bin.exe
2768	bin.exe
2768	bin.exe
2768	bin.exe
1672	mstsc.exe
1672	mstsc.exe
1672	mstsc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

4363463463464363463463463.exebin.exeExplorer.EXEmstsc.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2988	4363463463464363463463463.exe
Token: SeDebugPrivilege	2768	bin.exe
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeDebugPrivilege	1672	mstsc.exe
Token: SeLockMemoryPrivilege	340	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exebuild3.exebuild3.exeTrumTrum.execmd.exebin.exeExplorer.EXEmstsc.exetaskeng.exemstsca.exemstsca.exe

description	pid	process	target process
PID 2988 wrote to memory of 1740	2988	4363463463464363463463463.exe	build3.exe
PID 2988 wrote to memory of 1740	2988	4363463463464363463463463.exe	build3.exe
PID 2988 wrote to memory of 1740	2988	4363463463464363463463463.exe	build3.exe
PID 2988 wrote to memory of 1740	2988	4363463463464363463463463.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 1740 wrote to memory of 2796	1740	build3.exe	build3.exe
PID 2796 wrote to memory of 2960	2796	build3.exe	schtasks.exe
PID 2796 wrote to memory of 2960	2796	build3.exe	schtasks.exe
PID 2796 wrote to memory of 2960	2796	build3.exe	schtasks.exe
PID 2796 wrote to memory of 2960	2796	build3.exe	schtasks.exe
PID 2988 wrote to memory of 344	2988	4363463463464363463463463.exe	bin.exe
PID 2988 wrote to memory of 344	2988	4363463463464363463463463.exe	bin.exe
PID 2988 wrote to memory of 344	2988	4363463463464363463463463.exe	bin.exe
PID 2988 wrote to memory of 344	2988	4363463463464363463463463.exe	bin.exe
PID 2988 wrote to memory of 1708	2988	4363463463464363463463463.exe	TrumTrum.exe
PID 2988 wrote to memory of 1708	2988	4363463463464363463463463.exe	TrumTrum.exe
PID 2988 wrote to memory of 1708	2988	4363463463464363463463463.exe	TrumTrum.exe
PID 2988 wrote to memory of 1708	2988	4363463463464363463463463.exe	TrumTrum.exe
PID 1708 wrote to memory of 840	1708	TrumTrum.exe	cmd.exe
PID 1708 wrote to memory of 840	1708	TrumTrum.exe	cmd.exe
PID 1708 wrote to memory of 840	1708	TrumTrum.exe	cmd.exe
PID 840 wrote to memory of 2088	840	cmd.exe	choice.exe
PID 840 wrote to memory of 2088	840	cmd.exe	choice.exe
PID 840 wrote to memory of 2088	840	cmd.exe	choice.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 344 wrote to memory of 2768	344	bin.exe	bin.exe
PID 1288 wrote to memory of 1672	1288	Explorer.EXE	mstsc.exe
PID 1288 wrote to memory of 1672	1288	Explorer.EXE	mstsc.exe
PID 1288 wrote to memory of 1672	1288	Explorer.EXE	mstsc.exe
PID 1288 wrote to memory of 1672	1288	Explorer.EXE	mstsc.exe
PID 1672 wrote to memory of 320	1672	mstsc.exe	cmd.exe
PID 1672 wrote to memory of 320	1672	mstsc.exe	cmd.exe
PID 1672 wrote to memory of 320	1672	mstsc.exe	cmd.exe
PID 1672 wrote to memory of 320	1672	mstsc.exe	cmd.exe
PID 1536 wrote to memory of 2400	1536	taskeng.exe	mstsca.exe
PID 1536 wrote to memory of 2400	1536	taskeng.exe	mstsca.exe
PID 1536 wrote to memory of 2400	1536	taskeng.exe	mstsca.exe
PID 1536 wrote to memory of 2400	1536	taskeng.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2400 wrote to memory of 2348	2400	mstsca.exe	mstsca.exe
PID 2348 wrote to memory of 1500	2348	mstsca.exe	schtasks.exe
PID 2348 wrote to memory of 1500	2348	mstsca.exe	schtasks.exe
PID 2348 wrote to memory of 1500	2348	mstsca.exe	schtasks.exe
PID 2348 wrote to memory of 1500	2348	mstsca.exe	schtasks.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Local\Temp\Files\build3.exe
"C:\Users\Admin\AppData\Local\Temp\Files\build3.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\Files\build3.exe
"C:\Users\Admin\AppData\Local\Temp\Files\build3.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
5⤵
- Creates scheduled task(s)
PID:2960

C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
"C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
"C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
4⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
"C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\Files\XMRig.exe
"C:\Users\Admin\AppData\Local\Temp\Files\XMRig.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "ACULXOBT"
4⤵
- Launches sc.exe
PID:1652

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"
4⤵
- Launches sc.exe
PID:2104

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "ACULXOBT"
4⤵
- Launches sc.exe
PID:2580

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:1576

C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
3⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
3⤵
PID:2168

C:\Windows\TTTTTTTTTTTTTTTTTTTTR.exe
C:\Windows\TTTTTTTTTTTTTTTTTTTTR.exe
4⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\722433123.exe
C:\Users\Admin\AppData\Local\Temp\722433123.exe
5⤵
PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 80
6⤵
- Program crash
PID:2656

C:\Users\Admin\AppData\Local\Temp\Files\Vbsveuhnjb.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Vbsveuhnjb.exe"
3⤵
PID:2804

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
3⤵
PID:320

C:\Windows\system32\taskeng.exe
taskeng.exe {5C01C286-7324-4EB6-B8A2-6B6A22AC7FDF} S-1-5-21-3308111660-3636268597-2291490419-1000:JUBFGPHD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2400

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:1500

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2508

C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2428

C:\Windows\explorer.exe
explorer.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:340

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
Filesize
2.0MB

MD5
55d16190f3b5e391b8d0c31b6278a78f

SHA1
50597968940aca5425f71e6952866a0868f75d5a

SHA256
0f6e015cb7432ddee0174a95a8fa8b0af14a0693144eab4fb65068354e161aac

SHA512
2e5ae344ad5340fd4c9d0a49d9017de75a7341b13120369ce2cda763b7f576d3d830559cac78a04e60935e1a052552a50025c47080ac91990f53d87522ea5eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ed3b2f3a6f23e49c8c2d41c2d517de66

SHA1
34b4311df959e4b709bdcc5f672f84e8478e3ea0

SHA256
275c0a4ab3f26e92adbaadaf0bc96eb98f43ca988739e555be6ba512f19721b2

SHA512
e75465281d956e43d4b4632d69b9a83f20b28e952aa55914e3c02d871c627b4a065a6febac0bb30d462291df661344f6aee2761f7ff0b5b76a61cec459c9e3f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\fouette.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4848.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
Filesize
576KB

MD5
b4b47f0b2dd1d5c57bfffebb041458d9

SHA1
56f0a08fbf122062a7f5b4fe7a8887796b167e1c

SHA256
66d6ff95494d5946d69875f15c47f676aed327aaa279b113f351d9fdeaf2ad58

SHA512
6a7f09bbd8f8329f34f89a9b32c30f7b8aafc4d306bde71b1f02f9de75bb83ee583190241e3aa5f888db3f7c46e7055af3f9151982eecf28925e4ad2723036fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
Filesize
960KB

MD5
720d9eb923804d69acf075ac3794c546

SHA1
a2eaadf40f3b21a7a1423476648d4c005b109e3a

SHA256
f33419721287744c434d56b1ee48a78374e307dfcb077ae60261e992d2d7c07c

SHA512
c90cfe18e38a83c78bf3a1bacba11a5717594c123dd70e349fa11351de16e4ab82691845e96e3e739f99eb515a65dcf67ad2de714a3019127b920bcb69a2e024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Vbsveuhnjb.exe
Filesize
45KB

MD5
7d8c627e3e84aa5bfd1afa91d88e618b

SHA1
789908d860e45cdc313857cabede97ee9e84efc7

SHA256
1d1ba402f44abdc317988b43ba1604e57619a4547301e6ba2102d0cce2879888

SHA512
582407dfdb8d511cb53a81ea3705436f7362ee771a3d166687199d505c11cb86696197c27143cc0bf22d1623e27805367ae81137327180ae91b198c80649d458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Vbsveuhnjb.exe
Filesize
33KB

MD5
e865e213ffa50f213511e6f528835f28

SHA1
5ec923086fbbe0297cdc5c12bc7df6966c155415

SHA256
91a7f8a235b9cc0119939e9294cc9a773e5083fd3108901d57ff9e1d6f644f2e

SHA512
826b42a92edc4370812f1f39eb9e6042a997936ba1babdc719f68451391b22ecb648dfe299034fbee47db74f3d3a9c2fed9d0af943467956b899ea80aee8d071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XMRig.exe
Filesize
2.1MB

MD5
bd7258eb9e8ecb50c32f75ad064ed864

SHA1
46d360cab4d53908edb51a840cf43299f69f48e9

SHA256
6f832cc45bb448abf58f04d142046f507e1cc295c3e2d52a959861efceaa543b

SHA512
65940732294db14e875ca1d56ef576ad419d23e4f4e85d4b8f472b9012b834fc2c78ea5140372f29e0dbd61baf9065c339bc73c186a51008b4423ddf3f696757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
Filesize
832KB

MD5
cd53d08dead23c59784a243fa311e1fc

SHA1
fd4800640483fcb36cdf97ab08dd14b84ee00eff

SHA256
5e9e019b33c6135997fb3ccf2699aa34048caf1a7d8d8c1f70256d636a24a834

SHA512
b9724856f4ebf2223c2bbe1ef2686239160c62018287169e7fb28d47c475e2b2fe8685f399d2176053ffa3dc68e4c9abc1a6b1bc50c413ddce654191aed2487c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
Filesize
908KB

MD5
475bb978907ca6c2d55b49c77b7a2d82

SHA1
975b206240408f4f92d479893f94eecfaf069924

SHA256
59244fdbb79d4651002c96d82bb35d1e9318c9416a2c28f7357f240c97154ef7

SHA512
5118bf43de30a83d5a9291260b566e287bfd07d486408d69cebaf2d87fe1fbb3fe6a5cc59c68d778649cd8889558737fdda672b5bc8ca146683cd984e5fcdcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
Filesize
79KB

MD5
ecf084929c139c5e9cf89ea043606b68

SHA1
6574b99176feab0472a6145fb7c02e9f6d5296e9

SHA256
04fa28250145812f204989c9bc162aea07d598c92e9b28bd0f312321e420ffff

SHA512
68cbdaaf0a0d2abbc0cb704d1f81e4cae92f9d8db7bbd73943df4ed03134126cf9ea1618d3cc15def172a4f862ac9cc6a7e9dfa71a25343de7f2eab12a49392a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar488A.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
Filesize
2.1MB

MD5
e78943164b402ad3cadba632173377ee

SHA1
3d04e49608085f3cd9c469169a42e4db627a77d4

SHA256
c0f9de6aecf02e4c5a476de750c1dd9b8db736022e1f6d2e84ce37941ab8a014

SHA512
d42c5a516ad33da44ca22898317b7df3eaa9189ab8139ab1dc8ddf254be7eee07e7e9f253d0dd7c73c19592ba52142357ce1b5c71a280abd00e3130df810004a

Download Submit
\Users\Admin\AppData\Local\Temp\722433123.exe
Filesize
9KB

MD5
ea0ab15b400765ce7d29277a59d90ee1

SHA1
d27bc2fabfee8142306835bc1a4db458e7b34faf

SHA256
d53d26108b5d350fe8a30791aaaa772fec8105c27a6f1d267dd2c117d80e649a

SHA512
301e6e1c808694a783d0533d4e4a1d437a3d4c11dce37a576ce605f3516d2ae02a42caa3a75c00178637f494189080f61a1d14bba34c406e4782f6064369d597

Download Submit
\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
Filesize
896KB

MD5
4c5cceebed1a5dc5cf42dd2a9fb1bbcf

SHA1
c82a100329ba9ca498218cd04dec3c3594c8ae58

SHA256
d066034f97927235d1029016d9ef3637ae8368babf49854f044a57fbbeebf217

SHA512
f203af35c52106c1ce7bab28e983f73ffbecb25c3a747f46165e2c374c3482f3bbcc23d9e6d2af18b64fa806fdceaf0cec8862770ebc24c2c405891b37db2cee

Download Submit
\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
Filesize
1.2MB

MD5
779ab7f49a5681a8d8af9cbca77ebd29

SHA1
8f3cd7c9672ab37be74b066122fafabfc8dc3cee

SHA256
a6a89724ad1c195a63547b122546dd06b483d8e931eff6a04265b6b29e63641a

SHA512
5b25bcb4c316b9e8ee9dc41d52b2cbc06f2696e0b645903c609c4889f7199502a7476fc916b0dbccfdce65efa12317925c08b6a09b260da16244af4f8e92d746

Download Submit
\Users\Admin\AppData\Local\Temp\Files\Vbsveuhnjb.exe
Filesize
256KB

MD5
c745fc850dc056e8f1b972a62f115c06

SHA1
5d131951666c34df6b06276b2cbff80851a5b7d8

SHA256
a6bd8b32b57c4b6921d5d8fd08e169975081647a9802919937823e686928e223

SHA512
8dad1791800f953951381b834972249295977561d622c9c2828894087e9027de939886e2c33fde992b263a9dc5a0a01376d6a4e2c2e2dacddcd5efeab0e930d0

Download Submit
\Users\Admin\AppData\Local\Temp\Files\XMRig.exe
Filesize
2.5MB

MD5
5dec9f02f7067194f9928e37ed05c8f6

SHA1
06f13ca068514d08f0595ded4ef140078888235a

SHA256
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806

SHA512
98f980ab103c54c4b1b344b738bcaccd10a35923749a730dd3386355897156d382f01715d07a056ff7451e876898a76268328f92d1e8203b254bb7a082f18e7c

Download Submit
\Users\Admin\AppData\Local\Temp\Files\bin.exe
Filesize
915KB

MD5
c51050da2c94bbb62c6d2c51862b15dd

SHA1
84489f41759b69be75fa13430ba2f78143a857a1

SHA256
f62de2f1a6d9798f4278ab073890c06f8a1027c216d3c02dbc4c84ff84c4ee72

SHA512
9b22c562b3c84c0dce7a9888a227b67d991d4175d82ed2399d1629a216c0df9afc08285af94f06a09238ac896df2e0484d354bac4fab977bb2d3337a5b1521ef

Download Submit
\Users\Admin\AppData\Local\Temp\Files\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
\Users\Admin\AppData\Local\Temp\Files\cp.exe
Filesize
944KB

MD5
da51993a583dbe1c1d0052fe248d84bb

SHA1
cfde61b448e79018389cdefd55cbb36a2950a77f

SHA256
4e87c71c4710d256b9ff418a245f881f43585b155210a203ccbe7f2874994c8f

SHA512
4ff626ef8af5fa0a505333c005b075d7854d1962d81972f88026bfb7e93753bdd13e10a532e947c76a774cddcb5ffcaa4c54471364e866b35ac8d3fe26bdd3d1

Download Submit
\Users\Admin\AppData\Local\Temp\nso74E4.tmp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/340-828-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/340-817-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-851-0x0000000012800000-0x0000000012963000-memory.dmp

Filesize
1.4MB

Download
memory/340-811-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-812-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-827-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-813-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-826-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-824-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-829-0x00000000017A0000-0x00000000017C0000-memory.dmp

Filesize
128KB

Download
memory/340-823-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-822-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-821-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-820-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-818-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/340-814-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-816-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/340-815-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/344-698-0x00000000771A0000-0x0000000077276000-memory.dmp

Filesize
856KB

Download
memory/344-697-0x0000000076FB0000-0x0000000077159000-memory.dmp

Filesize
1.7MB

Download
memory/344-700-0x0000000070430000-0x0000000070437000-memory.dmp

Filesize
28KB

Download
memory/1288-747-0x00000000066A0000-0x0000000006833000-memory.dmp

Filesize
1.6MB

Download
memory/1288-791-0x0000000004EA0000-0x0000000004F3E000-memory.dmp

Filesize
632KB

Download
memory/1288-786-0x0000000004EA0000-0x0000000004F3E000-memory.dmp

Filesize
632KB

Download
memory/1288-784-0x0000000004EA0000-0x0000000004F3E000-memory.dmp

Filesize
632KB

Download
memory/1672-756-0x0000000000B40000-0x0000000000C44000-memory.dmp

Filesize
1.0MB

Download
memory/1672-768-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1672-769-0x00000000021E0000-0x00000000024E3000-memory.dmp

Filesize
3.0MB

Download
memory/1672-770-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1672-752-0x0000000000B40000-0x0000000000C44000-memory.dmp

Filesize
1.0MB

Download
memory/1672-774-0x0000000002050000-0x00000000020E3000-memory.dmp

Filesize
588KB

Download
memory/1708-629-0x0000000000DB0000-0x0000000001C13000-memory.dmp

Filesize
14.4MB

Download
memory/1708-468-0x0000000000DB0000-0x0000000001C13000-memory.dmp

Filesize
14.4MB

Download
memory/1740-70-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/1740-71-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2400-776-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2768-704-0x0000000076FB0000-0x0000000077159000-memory.dmp

Filesize
1.7MB

Download
memory/2768-732-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-760-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-761-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-762-0x00000000771A0000-0x0000000077276000-memory.dmp

Filesize
856KB

Download
memory/2768-763-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-764-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-765-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-766-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-767-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-757-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-755-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-754-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-753-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-750-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-783-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-749-0x0000000036AB0000-0x0000000036DB3000-memory.dmp

Filesize
3.0MB

Download
memory/2768-748-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-745-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-746-0x00000000369D0000-0x00000000369E4000-memory.dmp

Filesize
80KB

Download
memory/2768-744-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-743-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-742-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-741-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-740-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-739-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-738-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-737-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-736-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-735-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-728-0x0000000001470000-0x00000000064ED000-memory.dmp

Filesize
80.5MB

Download
memory/2768-751-0x0000000001470000-0x00000000064ED000-memory.dmp

Filesize
80.5MB

Download
memory/2768-731-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-730-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-729-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-705-0x00000000771D6000-0x00000000771D7000-memory.dmp

Filesize
4KB

Download
memory/2768-702-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2768-703-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2784-838-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2784-848-0x00000000009C0000-0x0000000000FE6000-memory.dmp

Filesize
6.1MB

Download
memory/2796-78-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2796-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-73-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2796-76-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2804-857-0x0000000000900000-0x0000000000A32000-memory.dmp

Filesize
1.2MB

Download
memory/2804-869-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-881-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-879-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-877-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-858-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2804-875-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-873-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-867-0x00000000021A0000-0x000000000226A000-memory.dmp

Filesize
808KB

Download
memory/2804-871-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2804-868-0x00000000021A0000-0x0000000002263000-memory.dmp

Filesize
780KB

Download
memory/2988-466-0x0000000005F40000-0x0000000006DA3000-memory.dmp

Filesize
14.4MB

Download
memory/2988-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2988-0-0x00000000013D0000-0x00000000013D8000-memory.dmp

Filesize
32KB

Download
memory/2988-696-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2988-695-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-467-0x0000000005F40000-0x0000000006DA3000-memory.dmp

Filesize
14.4MB

Download
memory/2988-1-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download