glupteba | 96ef0fa612962e229cabe7c23fcd099a34fc49e3dc760aafbddc6c44358db341

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 306KB
Sample240130-enhwssgba2
SHA256 96ef0fa612962e229cabe7c23fcd099a34fc49e3dc760aafbddc6c44358db341
MD5 582200a724af12a4a525bf2ae4d8b75b
SHA1 a7dba48a45fa92a8649e7eb26d9b571ee1080644
SHA512 280e6a29bfb7eb6fc753af60add534d01f97ccbfc82895419f21068c1c8c6b9c3ea12eb9280c27284c1210f7f246fae2409868ea1c4662ce6901c15943a47491
SSDEEP 6144:bt5/EuhHWN6cANbJr0T/gkfGCUKv/mXGGpYj3:p5suhHWN6cobZY/gkf0XG4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba smokeloader pub1 backdoor bootkit discovery dropper loader persistence trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://gxutc2c.com/tmp/index.php
http://proekt8.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

resource	yara_rule
behavioral2/memory/1764-67-0x0000000002D90000-0x000000000367B000-memory.dmp	family_glupteba
behavioral2/memory/1764-71-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1764-154-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1764-208-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1764-216-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1764-237-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
3540	Process not Found

Executes dropped EXE 11 IoCs

pid	Process
4660	4198.exe
4520	4198.exe
1012	48FD.exe
3004	57B3.exe
1064	5B5E.exe
1764	6746.exe
4204	76B8.exe
3060	76B8.tmp
1052	89D3.exe
4620	WMACutterJoiner.exe
1848	WMACutterJoiner.exe

Loads dropped DLL 5 IoCs

pid	Process
5044	regsvr32.exe
4520	4198.exe
3060	76B8.tmp
3060	76B8.tmp
3060	76B8.tmp

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4520-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-24-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-35-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-152-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-215-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4520-251-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	4198.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	48FD.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 4520	4660	4198.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 21 IoCs

pid	pid_target	Process	procid_target
2536	1764	WerFault.exe	100
2652	1064	WerFault.exe	98
3364	3004	WerFault.exe	97
220	1764	WerFault.exe	100
4544	1764	WerFault.exe	100
2908	1764	WerFault.exe	100
2276	1764	WerFault.exe	100
2528	1764	WerFault.exe	100
760	1764	WerFault.exe	100
4452	1764	WerFault.exe	100
4848	1764	WerFault.exe	100
2984	1764	WerFault.exe	100
3108	1764	WerFault.exe	100
3228	1764	WerFault.exe	100
1860	1764	WerFault.exe	100
5052	1764	WerFault.exe	100
2584	1764	WerFault.exe	100
2648	1764	WerFault.exe	100
1948	1764	WerFault.exe	100
2516	1764	WerFault.exe	100
2480	1764	WerFault.exe	100

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	89D3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	89D3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	89D3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4512	file.exe
4512	file.exe
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found
3540	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4512	file.exe
1052	89D3.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeShutdownPrivilege	3540	Process not Found
Token: SeCreatePagefilePrivilege	3540	Process not Found
Token: SeDebugPrivilege	1460	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	76B8.tmp

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4660	3540	Process not Found	91
PID 3540 wrote to memory of 4660	3540	Process not Found	91
PID 3540 wrote to memory of 4660	3540	Process not Found	91
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 4660 wrote to memory of 4520	4660	4198.exe	92
PID 3540 wrote to memory of 2912	3540	Process not Found	93
PID 3540 wrote to memory of 2912	3540	Process not Found	93
PID 2912 wrote to memory of 5044	2912	regsvr32.exe	94
PID 2912 wrote to memory of 5044	2912	regsvr32.exe	94
PID 2912 wrote to memory of 5044	2912	regsvr32.exe	94
PID 3540 wrote to memory of 1012	3540	Process not Found	95
PID 3540 wrote to memory of 1012	3540	Process not Found	95
PID 3540 wrote to memory of 1012	3540	Process not Found	95
PID 3540 wrote to memory of 3004	3540	Process not Found	97
PID 3540 wrote to memory of 3004	3540	Process not Found	97
PID 3540 wrote to memory of 3004	3540	Process not Found	97
PID 3540 wrote to memory of 1064	3540	Process not Found	98
PID 3540 wrote to memory of 1064	3540	Process not Found	98
PID 3540 wrote to memory of 1064	3540	Process not Found	98
PID 3540 wrote to memory of 1764	3540	Process not Found	100
PID 3540 wrote to memory of 1764	3540	Process not Found	100
PID 3540 wrote to memory of 1764	3540	Process not Found	100
PID 3540 wrote to memory of 4204	3540	Process not Found	101
PID 3540 wrote to memory of 4204	3540	Process not Found	101
PID 3540 wrote to memory of 4204	3540	Process not Found	101
PID 4204 wrote to memory of 3060	4204	76B8.exe	103
PID 4204 wrote to memory of 3060	4204	76B8.exe	103
PID 4204 wrote to memory of 3060	4204	76B8.exe	103
PID 3540 wrote to memory of 1052	3540	Process not Found	105
PID 3540 wrote to memory of 1052	3540	Process not Found	105
PID 3540 wrote to memory of 1052	3540	Process not Found	105
PID 3060 wrote to memory of 4620	3060	76B8.tmp	125
PID 3060 wrote to memory of 4620	3060	76B8.tmp	125
PID 3060 wrote to memory of 4620	3060	76B8.tmp	125
PID 3060 wrote to memory of 1848	3060	76B8.tmp	128
PID 3060 wrote to memory of 1848	3060	76B8.tmp	128
PID 3060 wrote to memory of 1848	3060	76B8.tmp	128
PID 1764 wrote to memory of 1460	1764	6746.exe	149
PID 1764 wrote to memory of 1460	1764	6746.exe	149
PID 1764 wrote to memory of 1460	1764	6746.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4512

C:\Users\Admin\AppData\Local\Temp\4198.exe
C:\Users\Admin\AppData\Local\Temp\4198.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\4198.exe
  C:\Users\Admin\AppData\Local\Temp\4198.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:4520

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4727.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4727.dll
  2⤵
  - Loads dropped DLL
  PID:5044

C:\Users\Admin\AppData\Local\Temp\48FD.exe
C:\Users\Admin\AppData\Local\Temp\48FD.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1012

C:\Users\Admin\AppData\Local\Temp\57B3.exe
C:\Users\Admin\AppData\Local\Temp\57B3.exe
1⤵
- Executes dropped EXE
PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 280
  2⤵
  - Program crash
  PID:3364

C:\Users\Admin\AppData\Local\Temp\5B5E.exe
C:\Users\Admin\AppData\Local\Temp\5B5E.exe
1⤵
- Executes dropped EXE
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1148
  2⤵
  - Program crash
  PID:2652

C:\Users\Admin\AppData\Local\Temp\6746.exe
C:\Users\Admin\AppData\Local\Temp\6746.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 372
  2⤵
  - Program crash
  PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 388
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 392
  2⤵
  - Program crash
  PID:4544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 640
  2⤵
  - Program crash
  PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 716
  2⤵
  - Program crash
  PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 716
  2⤵
  - Program crash
  PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 716
  2⤵
  - Program crash
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 780
  2⤵
  - Program crash
  PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 716
  2⤵
  - Program crash
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 716
  2⤵
  - Program crash
  PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 676
  2⤵
  - Program crash
  PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 744
  2⤵
  - Program crash
  PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 844
  2⤵
  - Program crash
  PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 760
  2⤵
  - Program crash
  PID:5052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 824
  2⤵
  - Program crash
  PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 748
  2⤵
  - Program crash
  PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 888
  2⤵
  - Program crash
  PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 884
  2⤵
  - Program crash
  PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 624
  2⤵
  - Program crash
  PID:2480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1460

C:\Users\Admin\AppData\Local\Temp\76B8.exe
C:\Users\Admin\AppData\Local\Temp\76B8.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\is-A1CJV.tmp\76B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A1CJV.tmp\76B8.tmp" /SL5="$501CC,7346659,54272,C:\Users\Admin\AppData\Local\Temp\76B8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\AppData\Local\WMACutterJoiner\WMACutterJoiner.exe
    "C:\Users\Admin\AppData\Local\WMACutterJoiner\WMACutterJoiner.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4620
- - C:\Users\Admin\AppData\Local\WMACutterJoiner\WMACutterJoiner.exe
    "C:\Users\Admin\AppData\Local\WMACutterJoiner\WMACutterJoiner.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1764 -ip 1764
1⤵
PID:1476

C:\Users\Admin\AppData\Local\Temp\89D3.exe
C:\Users\Admin\AppData\Local\Temp\89D3.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1064 -ip 1064
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3004 -ip 3004
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1764 -ip 1764
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1764 -ip 1764
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1764 -ip 1764
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1764 -ip 1764
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1764 -ip 1764
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1764 -ip 1764
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1764 -ip 1764
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1764 -ip 1764
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1764 -ip 1764
1⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1764 -ip 1764
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1764 -ip 1764
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1764 -ip 1764
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1764 -ip 1764
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1764 -ip 1764
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1764 -ip 1764
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1764 -ip 1764
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4198.exe

Path C:\Users\Admin\AppData\Local\Temp\4198.exe
Size 1.9MB
SHA256 3b678cd39f2937ca744a4fd4448f58d57078c23887b92dd368a9c83c4c234c4b
MD5 2afe1b13b5a72e34a467dda972ea844c
SHA1 d5c9255f8ca84545b24fa83f386cb26385c3bc98
SHA512 6b7bef1ed231e318d2d9cbae1b0c7ee1fbcef3193f0bffa082888ce9bff98e25e106b4c8845d8f6e25ef662ed59237fe8d4cc128407005afc0e16309c981bb77
SSDEEP 24576:TVRfBtilbOlGYmusDbQj+b861H9Oo6sVQNge3hzft0qFuALN1JZpxlGfy+MDUk6C:ZtilbOlGB5DvlnJ6HBheF8xl0nMQZ4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

4727.dll

Path C:\Users\Admin\AppData\Local\Temp\4727.dll
Size 2.7MB
SHA256 2554d59517d1c7008acae6ae11f23d30b19d1af7caaae6eeaca3218fa10c2e62
MD5 4cf1182760d0484d606e2f07a42e1612
SHA1 db48e8b10cee4be23f0b6c1b109dc2e30ed9076a
SHA512 b737b328016e0dde3eb92a6f87b6d0e8f94ef1b2a7b138a21958864c0334aad5439d6321c30bfa10a56211d18b18e7d48aa6f34e540433d962df54978d3d504b
SSDEEP 49152:FK7EBJETZ+EIyHkXhB4g8TbB/yejUtCilt/yuyT/wOBN8byNNIo4H1ETX:kooME+hB4vTb5jmTlVy91TNILV
MD5 SHA1 SHA512 SSDEEP

Submit Download

4727.dll

Path C:\Users\Admin\AppData\Local\Temp\4727.dll
Size 2.6MB
SHA256 738756e931b4991e955751507a43e1e8b06b9a0e41e5c36473c58739df7ed6f5
MD5 cec040a4ee57e7e0a8816f071a4d0f8b
SHA1 449fa3a6e4c2101321ebf68d55f0988fa0a14cc6
SHA512 66ee9a203fb59f06851504875853815ae781030c8cd09742d639f1f81c6617d47988d292ec8143061da91e22a52c3da0363605b5753705dfe712b77a10fc0310
SSDEEP 49152:FK7EBJETZ+EIyHkXhB4g8TbB/yejUtCilt/yuyT/wOBN8byNNIo4H1ETXz:kooME+hB4vTb5jmTlVy91TNILV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

4727.dll

Path C:\Users\Admin\AppData\Local\Temp\4727.dll
Size 640KB
SHA256 92c63f37ba62513a9320e364b85ed1bd9c4ac3ac63a8750f1d9803235566c8bb
MD5 43ad9a27fa3e97f1ea195e417c82f54a
SHA1 64db36edd7b4d5c4040c7df6337f9c5277d7e7bf
SHA512 e83e9105fc77ea0887bb6729f5b8c9160aa8d6e8d16555a83b844f7d34c102fda861585c7ac472e6196f9ba13607f6d1e73682745328689442639d8f9926e70b
SSDEEP 12288:oHMqxuPMG4YKQ45nolEPGfzeg7UqoYwvdnmWXlFPhTm3qXC9LGkLkh5A2:odiJ476EPKBJrYpmWVFPhOREIy22
MD5 SHA1 SHA512 SSDEEP

Submit Download

48FD.exe

Path C:\Users\Admin\AppData\Local\Temp\48FD.exe
Size 421KB
SHA256 e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888
MD5 1996a23c7c764a77ccacf5808fec23b0
SHA1 5a7141b167056bf8f01c067ebe12ed4ccc608dc7
SHA512 430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23
SSDEEP 6144:4phcsngKdHpPXECq6Xz4G/rmnHXekVB9YNeeA23YMd7pMFW54AXIEB93KWZMxEHL:4pasngwHpP5qa4G4eIWsyHd0XKBBXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Size 2.7MB
SHA256 f596283a71096a0b7e01cebf5d289ca66dcafed72eb4b456ce644bce2b185439
MD5 f164c17408330fcef2469661be4e4ee1
SHA1 aded51e8279147b709e77e2542d2c47cc23bae1c
SHA512 01c98a96d9e9e3a4fec161deec585a8290399d3d9377d55d06ebfbf32bc7a1bb4c8c038030bba0c1f650ba5db1c8fb97873dfafd4ed25faf3a53d6b1626e1ccc
SSDEEP 12288:bx//DiTWZVkkWq0qWpyHmDoeRkr3TOWClpz2OFRNAjyB+XWGzeLmE:bkTzU0q3uoEWadomcTzKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Size 6.5MB
SHA256 c143469b8e41e0f6e25170eeda756bca03939ec0265842ddfdf8816c6eb158cc
MD5 7fb5ecd05f5bd5226cc59a38b7d95578
SHA1 89955975a4835118dfc09f37bf71a6b33ccdcbae
SHA512 2693e1aeda6403a5837c39db9f2b71e6801dd75383079b213f213d61ef32161732e2adc14825e4014e35e0a3f7e14bf1ab8175c79e527e325dd8ed6730c04275
SSDEEP 24576:8FWlWtC9spf9BEx3NHRzu5DoBMviIoUO3tkGMrxOlFDHjDAxt6iG36hkWwIn4YSj:dICRtZopQNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

57B3.exe

Path C:\Users\Admin\AppData\Local\Temp\57B3.exe
Size 5.6MB
SHA256 4f060209fa2212a75fdd0f6b12fbe23eb29ac1fdecc95ff6ba65db63300d7d4c
MD5 415294ce33ca3e01023134503f26f9ce
SHA1 6bed7130d4771f39532cf716b481d41c25c8701a
SHA512 a794b7cfa4bdca4d19c03d144f03d7fc7e61a70b96e73b7678d7a1173ebca29bf745bba5895de9f24c5c5811686203d65ef55e62e2d3ea167ce0d64f4f763d6b
SSDEEP 98304:gwP/nZf+Yob5s3HsvbbHkaIgpIPR6lk2LSEai5ukefgnC1BZEeRMGXh901s+2IUr:gw3xwls3H8fHkjcIQlk2JB5sYnIBZEe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

57B3.exe

Path C:\Users\Admin\AppData\Local\Temp\57B3.exe
Size 2.6MB
SHA256 44be4e53fafee24c67b67776a7757ca0b4aac35ae77d1a3e4b608adf46aa7e3a
MD5 14eacd6210b1cfea6daaeae38f7cd99f
SHA1 7be2d598c6179749b931c4b6e2e7738be74454ca
SHA512 9a414d027055bf832abe3d5f16266fef72baddc4e9d05972a2aa67cb049249a30a72000e1aa4049ca2d0f4e1b03ae69e4c8fd6f98412e9d9435e858432a12691
SSDEEP 49152:edwP99DpdZf+L0ob5sT15HBuONjSKf6bfqSvcqhIgp3r8PR6ph9/+KrQ2LR/H:gwP/nZf+Yob5s3HsvbbHkaIgpIPR6lkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

5B5E.exe

Path C:\Users\Admin\AppData\Local\Temp\5B5E.exe
Size 658KB
SHA256 fc0c791bc5954ee1749fc8c6fcbae75a47391daa0762d01b6eb5e024ce41d5fd
MD5 810f6a09c80b59a69bac18051cff1e08
SHA1 bcc6c749278784c5d272aef33e47afdfdf77b9ef
SHA512 61f092f3d3d9cf800f047d5312659ddad587b20dcebaebebdd0c8fca40fa8bff7b81741d8ee7e1853d5db2899616b7fab9101ed2ada6185b1ff5f2c56c0e703e
SSDEEP 12288:dBGFS9zLkgAg2ehwdupgmKHee4xe+10eOcIWbMMYf:d9zyegx+e4xe+1OWoMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

6746.exe

Path C:\Users\Admin\AppData\Local\Temp\6746.exe
Size 256KB
SHA256 3c413a3fb5993497deab82dc99c09c666daf0c42b37ea2dc158b065adba03226
MD5 0b684ffb1bfdf3c63773def0f0fbbaea
SHA1 1d89d8c39aed3b4fa7252281e919e3b849898754
SHA512 77c41331ea6062f4e077fbe94dc9b2086197243b49683b958857b662d10d9b5d7de05df255adc4fc111e36a830cbed663a447387f66a380d90b49d2f22675d3b
SSDEEP 6144:SUfjVq/SfOaryg0gRZzzH2m8xrDez5IkqeR5:/f5q/Smarf0Yf2/xfez5b5
MD5 SHA1 SHA512 SSDEEP

Submit Download

6746.exe

Path C:\Users\Admin\AppData\Local\Temp\6746.exe
Size 64KB
SHA256 fb5c90c982226da894290c41ee5c6ec7674f07931463ea1f8fd80a221fb48e90
MD5 7de6db93c4c2051ce7f5f5779f2351f6
SHA1 55e274c44cb13f5d4727fb4addae3e02d7a78c58
SHA512 66204c79393b6e832bacfb7608388560c375695398e21c1696fa0f6efc2d19fe8e569453d3fb60333c29460815904c5a1920a1c7b3bf60a24cdad8b382116857
SSDEEP 1536:yW6UJmIUKHh/la34Gq8/hTc+II25Al3OiSjefN:/6UJpUKH1MZTc+I35Ad1fN
MD5 SHA1 SHA512 SSDEEP

Submit Download

76B8.exe

Path C:\Users\Admin\AppData\Local\Temp\76B8.exe
Size 1.6MB
SHA256 123fe9000b267847394d6c15f604bf189721e47198134fd0fd5a18054a267633
MD5 6794a620e3f095abf80e7192e25c19ac
SHA1 705d252c0ee4aa9636b0a82f39d80d78315dcd98
SHA512 4cedc0317804c734e59ea84d25f85cb7e227e8c70e3c3638cc0c326c9ac4622a1b5c450d201608295b3d3e60cfd565ece7eb289adb945b08c102def9b028d4a0
SSDEEP 49152:1vr6v9UA536CJe3Wg4rCxrJkdA65Jzs5wVHMbfY:NAUARPe3EEAK5cHMbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

76B8.exe

Path C:\Users\Admin\AppData\Local\Temp\76B8.exe
Size 2.5MB
SHA256 3905379c0d9c5dcae5b5cfaa4cdcb03a173b31b3ad09ee58c6eb273e5c770e5e
MD5 cbcdd435f3747c7ad8edd8d81360ab1d
SHA1 696fafd84e2084717d693262e4c1559126916455
SHA512 6e283a80b90eb6c2b7b8ef31df5dd71162827978ffaedbe3754c50d9429cc98ef70753023fdfe9fe1fbc7e0d0242b417461ddbfdf255a6eaf5d98a1312e83fce
SSDEEP 49152:1vr6v9UA536CJe3Wg4rCxrJkdA65Jzs5wVHMbfjrUZZjziAIYj:NAUARPe3EEAK5cHMbYjfZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

89D3.exe

Path C:\Users\Admin\AppData\Local\Temp\89D3.exe
Size 306KB
SHA256 4c098a71108b1e8147ce16d3be6bdf7ae6e850f884c5a08cf6b7e1a0291e4b68
MD5 16bb8fe77c15cb57b99a290c8a1f58a5
SHA1 ebf76ee019cc7c7c0d8fd2993bf06f2ad6436d27
SHA512 9214b17bd937499e067665ffb9fceffa5bf384ef03b7a165dcc46e7243f306b86af0d25364813f9c1d05c4794dd74021ffe5024e3d7104ea2390daf9c9ad1e3b
SSDEEP 6144:Ltx/EuhHBniO0rXrU4QD20T/gMfEFVKv/mXGGpYj3:ZxsuhHVB0rFQiY/gMfuXG4
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_atmr5nia.myt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atmr5nia.myt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

76B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-A1CJV.tmp\76B8.tmp
Size 692KB
SHA256 f6df43ee735edfb581653b2d8463990d16e439c70ea5a0047e4e0f6d64dfa319
MD5 b35517f0a793f47e88116112aecff9b9
SHA1 a9a09db89bc4ab535197b8338f085a905621b809
SHA512 99e7f67b8f3ec1f8f5937b86a9c472c1dc02f8f95da02fd18a91c92698dd28f053619e5bd3837b2cf56d669ffa6e1267a2221b9b79e5716d55abb3f330f70df2
SSDEEP 12288:thu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR0FDExyF:Pu7eEYCP8trP837szHUA60SLtcV3E9xT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F0CU1.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F0CU1.tmp\_isetup\_isdecmp.dll
Size 19KB
SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
MD5 3adaa386b671c2df3bae5b39dc093008
SHA1 067cf95fbdb922d81db58432c46930f86d23dded
SHA512 bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
SSDEEP 384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMACutterJoiner.exe

Path C:\Users\Admin\AppData\Local\WMACutterJoiner\WMACutterJoiner.exe
Size 3.0MB
SHA256 522f7cb843e1fbd7cef69c81bc4546acc8823dbf9241bac9285f66f6ea801af6
MD5 0b0455a71ed70c333f92f750acc85899
SHA1 f0152aae557c1f607d1dba01e9834ac93d0934c7
SHA512 37fb0dbd43b7fe841fb221b3d606fe8f1e0b75019f9097c1138ac9f720a5a947d042aa291a9b2034969b148ccf02c4ccd8254e7750edd19bdd4ae3400c84fda1
SSDEEP 49152:BfHBeOf5JuApeIHF42DjM32hC13/vuhnNJCuyXi6zPQ456NfDPR7Mh1U6QUva+:JHkLnYF7K+hnNJCtS6zYbNiK6C+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-114-0x00000000006C0000-0x00000000007C0000-memory.dmp

Download

memory/1052-122-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1052-119-0x0000000001F60000-0x0000000001F6B000-memory.dmp

Download

memory/1052-180-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1064-206-0x0000000002100000-0x000000000218A000-memory.dmp

Download

memory/1064-68-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1064-195-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1064-50-0x0000000002100000-0x000000000218A000-memory.dmp

Download

memory/1064-59-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1064-60-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1064-62-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1064-65-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1460-235-0x0000000004960000-0x0000000004970000-memory.dmp

Download

memory/1460-238-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/1460-1008-0x0000000007350000-0x000000000736A000-memory.dmp

Download

memory/1460-287-0x0000000007230000-0x00000000072A6000-memory.dmp

Download

memory/1460-223-0x0000000072A10000-0x00000000731C0000-memory.dmp

Download

memory/1460-232-0x0000000004960000-0x0000000004970000-memory.dmp

Download

memory/1460-233-0x0000000004910000-0x0000000004946000-memory.dmp

Download

memory/1460-259-0x0000000006490000-0x00000000064D4000-memory.dmp

Download

memory/1460-253-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/1460-252-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Download

memory/1460-250-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Download

memory/1460-240-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/1460-239-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/1460-802-0x00000000079B0000-0x000000000802A000-memory.dmp

Download

memory/1460-236-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Download

memory/1764-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1764-67-0x0000000002D90000-0x000000000367B000-memory.dmp

Download

memory/1764-154-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1764-71-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1764-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1764-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1764-207-0x0000000002980000-0x0000000002D85000-memory.dmp

Download

memory/1764-69-0x0000000002980000-0x0000000002D85000-memory.dmp

Download

memory/1848-261-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/1848-231-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/1848-266-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/1848-209-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/3004-83-0x0000000003130000-0x0000000003131000-memory.dmp

Download

memory/3004-88-0x0000000003160000-0x0000000003161000-memory.dmp

Download

memory/3004-76-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/3004-79-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/3004-82-0x0000000000CA0000-0x000000000162E000-memory.dmp

Download

memory/3004-81-0x0000000003100000-0x0000000003101000-memory.dmp

Download

memory/3004-77-0x0000000000CA0000-0x000000000162E000-memory.dmp

Download

memory/3004-86-0x0000000003140000-0x0000000003141000-memory.dmp

Download

memory/3004-87-0x0000000003150000-0x0000000003151000-memory.dmp

Download

memory/3004-99-0x0000000003170000-0x00000000031A2000-memory.dmp

Download

memory/3004-101-0x0000000003170000-0x00000000031A2000-memory.dmp

Download

memory/3004-103-0x0000000003170000-0x00000000031A2000-memory.dmp

Download

memory/3004-94-0x0000000003320000-0x0000000003321000-memory.dmp

Download

memory/3004-96-0x0000000003170000-0x00000000031A2000-memory.dmp

Download

memory/3004-171-0x0000000000CA0000-0x000000000162E000-memory.dmp

Download

memory/3004-95-0x0000000003170000-0x00000000031A2000-memory.dmp

Download

memory/3060-133-0x0000000002100000-0x0000000002101000-memory.dmp

Download

memory/3060-234-0x0000000002100000-0x0000000002101000-memory.dmp

Download

memory/3060-188-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3540-170-0x0000000004530000-0x0000000004546000-memory.dmp

Download

memory/3540-4-0x0000000002A90000-0x0000000002AA6000-memory.dmp

Download

memory/4204-85-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4204-78-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4204-178-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4512-3-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4512-2-0x00000000021A0000-0x00000000021AB000-memory.dmp

Download

memory/4512-5-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4512-1-0x00000000006B0000-0x00000000007B0000-memory.dmp

Download

memory/4512-8-0x00000000021A0000-0x00000000021AB000-memory.dmp

Download

memory/4520-22-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-115-0x0000000002EF0000-0x0000000002FFB000-memory.dmp

Download

memory/4520-215-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-38-0x0000000000D70000-0x0000000000D76000-memory.dmp

Download

memory/4520-152-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-35-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-31-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-134-0x0000000002EF0000-0x0000000002FFB000-memory.dmp

Download

memory/4520-24-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-110-0x0000000002EF0000-0x0000000002FFB000-memory.dmp

Download

memory/4520-19-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-97-0x0000000002DC0000-0x0000000002EE8000-memory.dmp

Download

memory/4520-251-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4520-23-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4620-200-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4620-190-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4620-191-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4660-18-0x0000000004B00000-0x0000000004CB7000-memory.dmp

Download

memory/4660-17-0x0000000003190000-0x0000000003354000-memory.dmp

Download

memory/5044-98-0x0000000002B00000-0x0000000002C0B000-memory.dmp

Download

memory/5044-33-0x0000000000BE0000-0x0000000000BE6000-memory.dmp

Download

memory/5044-105-0x0000000002B00000-0x0000000002C0B000-memory.dmp

Download

memory/5044-70-0x00000000029D0000-0x0000000002AF8000-memory.dmp

Download

memory/5044-66-0x0000000010000000-0x00000000102B5000-memory.dmp

Download

memory/5044-34-0x0000000010000000-0x00000000102B5000-memory.dmp

Download

memory/5044-104-0x0000000002B00000-0x0000000002C0B000-memory.dmp

Download