gh0strat | 846c2dc85b063324012261b17b93820dc12632c635fb57aa93581750c69f9000

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
Size 4.9MB
Sample240614-bl2dkstajk
SHA256 cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7
MD5 40b338eac24f2202caba66cdca062409
SHA1 800a68f90767a5817198e593cd2d63ef1027804a
SHA512 e91306155a77d0769272ca4590f554e9115e9b4984b6d4e61358d0e06de83e1beb3371fe4074b7d7e1314354cdfc9932806b0288b2fbd5389994732fc96879f2
SSDEEP 98304:dvWCp59KLkKKQDhd9X8zfq+qM3p+Ok+28MhCyGrtbHzdl3OktT:hWCpQLH7OzC+xp+vG7ykbHhl+ktT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat upx

Malware Config

Signatures

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/memory/64-165-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1868-187-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1900-181-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1900-177-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1868-173-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4496-164-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/64-144-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4496-143-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4496-132-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4496-131-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	winos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Executes dropped EXE 32 IoCs

pid	Process
852	ttttt.exe
3624	winos.exe
3792	EP.exe
2900	EP.exe
3400	EP.exe
3580	EP.exe
3084	EP.exe
4496	EP.exe
1260	EP.exe
64	EP.exe
1868	EP.exe
1900	EP.exe
4556	EP.exe
4708	EP.exe
4480	EP.exe
4700	EP.exe
1948	EP.exe
4500	EP.exe
2880	EP.exe
2344	EP.exe
4392	EP.exe
4204	EP.exe
2076	EP.exe
312	EP.exe
3812	EP.exe
4272	EP.exe
4588	EP.exe
664	EP.exe
4484	EP.exe
4276	EP.exe
1216	EP.exe
3032	EP.exe

Loads dropped DLL 64 IoCs

pid	Process
852	ttttt.exe
852	ttttt.exe
3624	winos.exe
3792	EP.exe
3792	EP.exe
2900	EP.exe
2900	EP.exe
3792	EP.exe
3792	EP.exe
3792	EP.exe
3792	EP.exe
2900	EP.exe
2900	EP.exe
3792	EP.exe
2900	EP.exe
2900	EP.exe
3792	EP.exe
3792	EP.exe
3400	EP.exe
3400	EP.exe
3400	EP.exe
3400	EP.exe
3580	EP.exe
3580	EP.exe
3580	EP.exe
3580	EP.exe
3084	EP.exe
3084	EP.exe
3084	EP.exe
3084	EP.exe
1260	EP.exe
1260	EP.exe
1260	EP.exe
1260	EP.exe
4556	EP.exe
4556	EP.exe
4556	EP.exe
4556	EP.exe
4700	EP.exe
4700	EP.exe
4700	EP.exe
4700	EP.exe
1948	EP.exe
1948	EP.exe
1948	EP.exe
1948	EP.exe
2880	EP.exe
2880	EP.exe
2880	EP.exe
2880	EP.exe
4204	EP.exe
4204	EP.exe
4204	EP.exe
4204	EP.exe
312	EP.exe
312	EP.exe
312	EP.exe
312	EP.exe
3812	EP.exe
3812	EP.exe
3812	EP.exe
3812	EP.exe
4588	EP.exe
4588	EP.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/64-165-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1868-187-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1900-181-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1900-177-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1868-173-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4496-164-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/64-144-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4496-143-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4496-132-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4496-131-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4496-128-0x0000000010000000-0x000000001018F000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	EP.exe
File opened (read-only)	\??\H:	EP.exe
File opened (read-only)	\??\I:	EP.exe
File opened (read-only)	\??\J:	EP.exe
File opened (read-only)	\??\K:	EP.exe
File opened (read-only)	\??\V:	EP.exe
File opened (read-only)	\??\Y:	EP.exe
File opened (read-only)	\??\Z:	EP.exe
File opened (read-only)	\??\L:	EP.exe
File opened (read-only)	\??\Q:	EP.exe
File opened (read-only)	\??\S:	EP.exe
File opened (read-only)	\??\G:	EP.exe
File opened (read-only)	\??\M:	EP.exe
File opened (read-only)	\??\P:	EP.exe
File opened (read-only)	\??\R:	EP.exe
File opened (read-only)	\??\T:	EP.exe
File opened (read-only)	\??\W:	EP.exe
File opened (read-only)	\??\X:	EP.exe
File opened (read-only)	\??\E:	EP.exe
File opened (read-only)	\??\N:	EP.exe
File opened (read-only)	\??\O:	EP.exe
File opened (read-only)	\??\U:	EP.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ying-UnInstall.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Windows\SysWOW64\Ying-UnInstall.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Windows\SysWOW64\YingInstall\409.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 4496	2900	EP.exe	107
PID 3792 set thread context of 64	3792	EP.exe	109
PID 3400 set thread context of 1868	3400	EP.exe	111
PID 3580 set thread context of 1900	3580	EP.exe	110
PID 3084 set thread context of 4708	3084	EP.exe	113
PID 1260 set thread context of 4480	1260	EP.exe	134
PID 4556 set thread context of 4500	4556	EP.exe	117
PID 4700 set thread context of 2344	4700	EP.exe	119
PID 1948 set thread context of 4392	1948	EP.exe	120
PID 2880 set thread context of 2076	2880	EP.exe	122
PID 4204 set thread context of 4272	4204	EP.exe	125
PID 312 set thread context of 4484	312	EP.exe	129
PID 3812 set thread context of 4276	3812	EP.exe	130
PID 4588 set thread context of 1216	4588	EP.exe	131
PID 664 set thread context of 3032	664	EP.exe	132

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\log\UpdateNotice.log	winos.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\name.ini	ttttt.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\EP.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\msvcp71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\1.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\2.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\winos.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\1.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\EP.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\path.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\msvcp71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\winos.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\2.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\path.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\name.ini	ttttt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	852	WerFault.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EP.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe
3624	winos.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	EP.exe
Token: SeDebugPrivilege	64	EP.exe
Token: SeDebugPrivilege	1868	EP.exe
Token: SeDebugPrivilege	1900	EP.exe
Token: SeDebugPrivilege	4480	EP.exe
Token: SeDebugPrivilege	4708	EP.exe
Token: SeDebugPrivilege	4500	EP.exe
Token: SeDebugPrivilege	2344	EP.exe
Token: SeDebugPrivilege	4392	EP.exe
Token: SeDebugPrivilege	2076	EP.exe
Token: SeDebugPrivilege	4272	EP.exe
Token: SeDebugPrivilege	4484	EP.exe
Token: SeDebugPrivilege	4276	EP.exe
Token: SeDebugPrivilege	1216	EP.exe
Token: SeDebugPrivilege	3032	EP.exe
Token: 33	4496	EP.exe
Token: SeIncBasePriorityPrivilege	4496	EP.exe
Token: 33	4496	EP.exe
Token: SeIncBasePriorityPrivilege	4496	EP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 852	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	91
PID 636 wrote to memory of 852	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	91
PID 636 wrote to memory of 852	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	91
PID 636 wrote to memory of 3168	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	99
PID 636 wrote to memory of 3168	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	99
PID 636 wrote to memory of 3168	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	99
PID 636 wrote to memory of 3624	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	100
PID 636 wrote to memory of 3624	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	100
PID 636 wrote to memory of 3624	636	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	100
PID 3624 wrote to memory of 3792	3624	winos.exe	101
PID 3624 wrote to memory of 3792	3624	winos.exe	101
PID 3624 wrote to memory of 3792	3624	winos.exe	101
PID 3624 wrote to memory of 2900	3624	winos.exe	102
PID 3624 wrote to memory of 2900	3624	winos.exe	102
PID 3624 wrote to memory of 2900	3624	winos.exe	102
PID 3624 wrote to memory of 3400	3624	winos.exe	103
PID 3624 wrote to memory of 3400	3624	winos.exe	103
PID 3624 wrote to memory of 3400	3624	winos.exe	103
PID 3624 wrote to memory of 3580	3624	winos.exe	105
PID 3624 wrote to memory of 3580	3624	winos.exe	105
PID 3624 wrote to memory of 3580	3624	winos.exe	105
PID 3624 wrote to memory of 3084	3624	winos.exe	106
PID 3624 wrote to memory of 3084	3624	winos.exe	106
PID 3624 wrote to memory of 3084	3624	winos.exe	106
PID 2900 wrote to memory of 4496	2900	EP.exe	107
PID 2900 wrote to memory of 4496	2900	EP.exe	107
PID 2900 wrote to memory of 4496	2900	EP.exe	107
PID 2900 wrote to memory of 4496	2900	EP.exe	107
PID 2900 wrote to memory of 4496	2900	EP.exe	107
PID 3624 wrote to memory of 1260	3624	winos.exe	108
PID 3624 wrote to memory of 1260	3624	winos.exe	108
PID 3624 wrote to memory of 1260	3624	winos.exe	108
PID 3792 wrote to memory of 64	3792	EP.exe	109
PID 3792 wrote to memory of 64	3792	EP.exe	109
PID 3792 wrote to memory of 64	3792	EP.exe	109
PID 3792 wrote to memory of 64	3792	EP.exe	109
PID 3792 wrote to memory of 64	3792	EP.exe	109
PID 3400 wrote to memory of 1868	3400	EP.exe	111
PID 3400 wrote to memory of 1868	3400	EP.exe	111
PID 3400 wrote to memory of 1868	3400	EP.exe	111
PID 3580 wrote to memory of 1900	3580	EP.exe	110
PID 3580 wrote to memory of 1900	3580	EP.exe	110
PID 3580 wrote to memory of 1900	3580	EP.exe	110
PID 3400 wrote to memory of 1868	3400	EP.exe	111
PID 3400 wrote to memory of 1868	3400	EP.exe	111
PID 3580 wrote to memory of 1900	3580	EP.exe	110
PID 3580 wrote to memory of 1900	3580	EP.exe	110
PID 3624 wrote to memory of 4556	3624	winos.exe	112
PID 3624 wrote to memory of 4556	3624	winos.exe	112
PID 3624 wrote to memory of 4556	3624	winos.exe	112
PID 3084 wrote to memory of 4708	3084	EP.exe	113
PID 3084 wrote to memory of 4708	3084	EP.exe	113
PID 3084 wrote to memory of 4708	3084	EP.exe	113
PID 3084 wrote to memory of 4708	3084	EP.exe	113
PID 3084 wrote to memory of 4708	3084	EP.exe	113
PID 3624 wrote to memory of 4700	3624	winos.exe	115
PID 3624 wrote to memory of 4700	3624	winos.exe	115
PID 3624 wrote to memory of 4700	3624	winos.exe	115
PID 1260 wrote to memory of 4480	1260	EP.exe	134
PID 1260 wrote to memory of 4480	1260	EP.exe	134
PID 1260 wrote to memory of 4480	1260	EP.exe	134
PID 1260 wrote to memory of 4480	1260	EP.exe	134
PID 1260 wrote to memory of 4480	1260	EP.exe	134
PID 3624 wrote to memory of 1948	3624	winos.exe	116

C:\Users\Admin\AppData\Local\Temp\cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
"C:\Users\Admin\AppData\Local\Temp\cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe
  "C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 596
    3⤵
    - Program crash
    PID:2316
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt
  2⤵
  PID:3168
- C:\Program Files\²âÊÔ²âÊÔ206\winos.exe
  "C:\Program Files\²âÊÔ²âÊÔ206\winos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:64
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1868
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4556
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4500
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4700
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2344
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1948
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4392
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:2880
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2076
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4204
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:312
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4484
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:3812
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:4588
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1216
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:664
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 852 -ip 852
1⤵
PID:1556

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv lT+Vx2NB4Eec+1sY1LpKAg.0.2
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.txt

Path C:\Program Files\²âÊÔ²âÊÔ206\1.txt
Size 2.2MB
SHA256 6a11cca02e22b01b077775b9819cb220d3747c0f6d2b0b85b13265d0cd3ab730
MD5 cd55a17685b496570a9ba3374730a9c5
SHA1 3127c701297667727854b508a99c71a77fb1f0ea
SHA512 19cee89ec5256a386c36c6b3b02f91e8acbf19a778427e5ead10614e73d1dc5e9ed64b1b3b5ad5b461828dea77ba69a5d6b6c8a2363b727ad04f0215da55d894
SSDEEP 24576:9yU6Wf0M6vRbFZ3TuU/upIcG3cK7IYwIJ/4sH6riuAFpivfctOADWEgdrKzQKTP/:Ve4ldYWE6rKhTeQyKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

12345678.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe
Size 302KB
SHA256 f8b93502b5d4a2d8180acd6bdf0a855146df0eeec437dfa3b5ee35059d8791a3
MD5 570fb4a8e2736f584ecb71fce7b66a0d
SHA1 1e41a32a754a0dc02e33f79693358f88240d3993
SHA512 678180dc0c63abf26abcd1ea4fbd9babbefb34ed74032ec67a667ce0597186ae11669d7b3961d1dfece881163f8bf6ed7877c31e823b2e422e66538cab9529a3
SSDEEP 6144:yjj3ndpuFbE1idOakOQ6TIeAe+7xxeI89cg7e9mRcnxU7fMZ2TrJK4IKQTcLLmJj:W3n6FbEsd77TIea7Lc997e5U7vTrWwLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DTLUI.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll
Size 2.4MB
SHA256 0989c2b74aab08c0e8ec997e5535c39ef1eab45ec829da7c1421624cd1f0f2dd
MD5 42d8e9a3d01b2150856bd4025a546748
SHA1 96284f7b91db099f954966622273d2a8228de805
SHA512 db6bc1d7cc87ce26bba8c3ca2c4cd976b592bb579a80df52e902389d5c3da693a10c616ee2fd21fdebb7d93d231b36bf1850a19c17134b68c878fa638adc4327
SSDEEP 49152:Xr3qLBWKt1J//gRVRR3nGmDiXv2hB2IUF8tcdqOt:XratWQ1t/IVRRWvXv2hB2d8tcdqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

EP.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
Size 1.1MB
SHA256 37865f209c91b291282c51515a868e6993070d3d7594cf931b42f5a6a8f09a3a
MD5 4ddce14e5c6c09bbe5154167a74d271e
SHA1 3985cd3c8b49fcaa9c9dd244ef53d9e86889a3ad
SHA512 f49cf8709fbc1a507416cc61c0678cf153d8fab38527d8e9eece7619196e4c194be437e57de635bea511cdcde7bc62469380f97005b7202c625ae6ceb70b610b
SSDEEP 12288:rmFzj/Jm4rhXkMuDop9rCisKcrDORyqA8EgNFAGU:qFf/Jm4rlkMusfiKcXOkuAGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPFarmer.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl
Size 1.5MB
SHA256 b8d383284ee56e69af969aeb332a3efc5a1318552925962ec9bbcd85fa6deaec
MD5 56e4471fd4eb35e5eda4537bdf5b9b17
SHA1 8437cbb230195463d7e543d45908927022f95f21
SHA512 77979fc6b9d2ffd225efcf202d7dc61132dd1efc755069ce0121b59d4ac58102e8cf932add16721589f4085ce1408513ed1ff0df4fa508bc98a17621be5cb44d
SSDEEP 12288:6zC29ELzScwv9gU5kcoXq1dhpAntAhXcZP5aNyCqBPN4vRgQ3gqX8aE05mtiB7YA:fFwv9RLs4tDYn7JnNs6kBb7ELq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp71.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\msvcp71.dll
Size 2.4MB
SHA256 9c94d54a5e1518a63e4b96ab69d11a2167ec86b0d8bacc6d43f33758a36a9831
MD5 6e1640ffcc9d52c45189390c91411396
SHA1 3e6e74aa524f9464388e8bd07697ade758b4d2eb
SHA512 d1fbbdd3445e6c61f12e8ddedc004affac5dec5f1a44322b15f287b5c4d4b4a98ec0ef28f6a28586df9f912382b514f0a5de20f36d4d405d194034082fd535ce
SSDEEP 49152:/ozplzacxiV113RDU6vNpvb2rE5uf0zf7/oX8c:/ozrh4VH3RDU6lpvb2rE5uSf7/o
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr71.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll
Size 340KB
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.ini

Path C:\Program Files\²âÊÔ²âÊÔ206\name.ini
Size 29B
SHA256 520fa9b9f1ba425d9bd2f5e72ef69aa8cd411c2a8f9485884e7854fb764fe2a1
MD5 74d7cbdc6f228b6cce308390a8d62202
SHA1 7f2ca6d4f918e3a7c8e26be3630984847a75da74
SHA512 00dabec6a9bfc55865bedf060280164bbbac5e56b1c536963c62e832cb78de2fbc307a87c0446b7938ea424c7996cc5f13beeb93891827de8a899c3d2dcd3bbb
MD5 SHA1 SHA512

Submit Download

path.ini

Path C:\Program Files\²âÊÔ²âÊÔ206\path.ini
Size 50B
SHA256 fe79c97ec4aa72e7f458c69662132ab81a99d36d03e511ec429403fe853a6a94
MD5 5f5903b084bb82c2b983ec909a1562a5
SHA1 937ee201ce7e6d53666440fc8a4f933117b0b0e7
SHA512 84d309a4be0e644304b0857ecee488899e5eaf6b43e5542154e228b6c2c6329d42bd014d0d9c667aa7cdfd4716f23438703e2e0b1928cf1aef71a0824701abb5
MD5 SHA1 SHA512

Submit Download

rtl70.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl
Size 640KB
SHA256 b8c41a8e2824c21b4e3eaa901e1af8c772ab0e68d1bf07580da62969792af5a2
MD5 ea8738b2908a2dd7d15df834d6008d26
SHA1 1ccfdb3f2647bbfa4fb638bc17ae01092b287bf1
SHA512 4091c1f21d08e5d37694ce9b395f38b6f07c9f2dd466a268ee4feae42743ac02c420abd631977f75f41b9d461234e690283979934a66f9e52bccd61dfc3b3981
SSDEEP 6144:QNIkZ4jZJiC9mkKP/q3JjpnWdjU3eDz+XmkmstRU:cIkZ4jZJ+gpF3a+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttttt.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe
Size 262KB
SHA256 a5622e2bf46cc2ec90c4dca70372f051bfb5bf55da3788b5dfca9429529d285b
MD5 9f1d3dfac55080c712c0281fb2eeeb47
SHA1 9109f9457f811d8d0e887469ffc9c2af793e8090
SHA512 7e2df7f2aff2d95ca1dbe0dfb7c8c9388c7e8c023c8b9af9b6997140cefcca63fe5980a438b70da03ab6672c94033fb4e50d407c54530b5ce0b9169c39c50879
SSDEEP 6144:zPH9yqri3YL1Avg3NloWPx9L8FXLOcautvT0euR:zPgqri3YL1Avg3NloWPrwXLOv9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl70.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl
Size 1.3MB
SHA256 a7a26cbf6968063c51d4d70f4599f295e4a88e352f19bdd475f3416e6411c390
MD5 16a1c27ed415d1816f8888ea2cefb3f6
SHA1 80db800b805d548f6df4eb2cb37ba2064dc37c05
SHA512 68a3e563dd9745210eb7295cde692af68cd5fc430a95856f4823dc10e42d067f332ae1d2445e8810e0c15c3c779e195735bd311c45e9690cb05dbedcd7354306
SSDEEP 12288:HYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjj5Oby17fGlC:Hof30jJBpSfZyWIGBsKH5ObC4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

winos.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\winos.exe
Size 216KB
SHA256 a937d9295271cc131a2e019dd41ce4ead3bca2d5115fb7d7482508297971b17e
MD5 5ac2deb3ceb9e32fe681483373c2d4c7
SHA1 ed4e9af7c4f3e462e41f542c1ef7d0c3c0613769
SHA512 43d4ce96a3c5b5f3e234df70e365e05cdf416f57e262ae70ea1b04450eb397f38ed8db45a8d5df630e759c8e4a3642ad26c9d897d312085c5fcf8703e20162b7
SSDEEP 3072:wTXcjTL9E//UGgLIMy6P8Qmt5UYy7o6p48gao6p48gRlSSHjyGf1hM2F2:eXCE//UGgLZycDp7BgaBgLpftY
MD5 SHA1 SHA512 SSDEEP

Submit Download

20240614011457944~YingInstall-TopFramePicture.bmp

Path C:\Users\Admin\AppData\Local\Temp\20240614011457944~YingInstall-TopFramePicture.bmp
Size 563KB
SHA256 d9295a5e215cf9f1c2dd5b9aa5deb1ee46619202b5814296ca73777506846608
MD5 a528a1efb19f5bee2fa74cd8650dab24
SHA1 51b72c994283ec899a32732bc60655d3039138a8
SHA512 bcf8db6c25868a5d48ef887046143ed504690084673ff71c886dc17de8f65482e773b3a5867cab89e310ac03f1a37f3661d1117230fbcb7d85071fcf2b34c15a
SSDEEP 3072:i3GXZRy5KkGe3JFgTvwq8cO8jLR6qQl0p88aaF85hbKCNZTB606u2:i3y3O5mfOR9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-165-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/64-176-0x0000000000450000-0x0000000000519000-memory.dmp

Download

memory/64-144-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/64-178-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/852-61-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/852-70-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1260-153-0x0000000000950000-0x0000000000ACB000-memory.dmp

Download

memory/1868-187-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1868-173-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1900-177-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1900-181-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/2900-130-0x0000000000B30000-0x0000000000CAB000-memory.dmp

Download

memory/2900-96-0x0000000000B30000-0x0000000000CAB000-memory.dmp

Download

memory/2900-126-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/2900-127-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3084-122-0x00000000008A0000-0x0000000000A1B000-memory.dmp

Download

memory/3084-193-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3084-194-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3400-162-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3400-163-0x0000000000990000-0x0000000000B0B000-memory.dmp

Download

memory/3400-161-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3400-110-0x0000000000990000-0x0000000000B0B000-memory.dmp

Download

memory/3580-171-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3580-170-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3580-115-0x00000000008F0000-0x0000000000A6B000-memory.dmp

Download

memory/3580-172-0x00000000008F0000-0x0000000000A6B000-memory.dmp

Download

memory/3792-156-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3792-146-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3792-103-0x0000000000AF0000-0x0000000000C6B000-memory.dmp

Download

memory/3792-157-0x0000000000AF0000-0x0000000000C6B000-memory.dmp

Download

memory/4496-143-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4496-128-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4496-123-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4496-125-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4496-131-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4496-132-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4496-164-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4556-186-0x00000000008D0000-0x0000000000A4B000-memory.dmp

Download