cobaltstrike | 91c3933c4ab7349061f9a5ec536dc8debf30d4adcab86f13e4c5da8e5c3ec21e

Analysis

max time kernel
115s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65318632a52b62f58d0ad6b6a7ac4cf0N.exe
Size

5.2MB
MD5

65318632a52b62f58d0ad6b6a7ac4cf0
SHA1

0be0e172b4698c797ee0f5774ed652f5c838423f
SHA256

91c3933c4ab7349061f9a5ec536dc8debf30d4adcab86f13e4c5da8e5c3ec21e
SHA512

8c35d261b05d4a133bb7719776fcd9befad55a7f59239972158a28a4de21ff2ccdd6e57f05b802b2d2624d1d4539a8aab81e9fafec338e58bbf6f71ca277ab81
SSDEEP

49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lU+

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233dc-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-19.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-31.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-62.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023437-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344b-110.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344c-118.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-41.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/2036-56-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp	xmrig
behavioral2/memory/864-120-0x00007FF69BD30000-0x00007FF69C081000-memory.dmp	xmrig
behavioral2/memory/2080-124-0x00007FF6CD2A0000-0x00007FF6CD5F1000-memory.dmp	xmrig
behavioral2/memory/4024-127-0x00007FF7AF4B0000-0x00007FF7AF801000-memory.dmp	xmrig
behavioral2/memory/844-126-0x00007FF6F2CB0000-0x00007FF6F3001000-memory.dmp	xmrig
behavioral2/memory/1180-125-0x00007FF718020000-0x00007FF718371000-memory.dmp	xmrig
behavioral2/memory/3916-123-0x00007FF7BD850000-0x00007FF7BDBA1000-memory.dmp	xmrig
behavioral2/memory/3176-122-0x00007FF7EED40000-0x00007FF7EF091000-memory.dmp	xmrig
behavioral2/memory/1692-121-0x00007FF79F190000-0x00007FF79F4E1000-memory.dmp	xmrig
behavioral2/memory/2684-130-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp	xmrig
behavioral2/memory/1964-129-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp	xmrig
behavioral2/memory/4912-128-0x00007FF674E40000-0x00007FF675191000-memory.dmp	xmrig
behavioral2/memory/1240-139-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp	xmrig
behavioral2/memory/2276-144-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp	xmrig
behavioral2/memory/4492-142-0x00007FF646B20000-0x00007FF646E71000-memory.dmp	xmrig
behavioral2/memory/4792-140-0x00007FF633930000-0x00007FF633C81000-memory.dmp	xmrig
behavioral2/memory/4852-136-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp	xmrig
behavioral2/memory/1552-134-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp	xmrig
behavioral2/memory/1044-137-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp	xmrig
behavioral2/memory/2036-135-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp	xmrig
behavioral2/memory/1340-133-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp	xmrig
behavioral2/memory/1696-132-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp	xmrig
behavioral2/memory/3948-131-0x00007FF68E500000-0x00007FF68E851000-memory.dmp	xmrig
behavioral2/memory/4912-150-0x00007FF674E40000-0x00007FF675191000-memory.dmp	xmrig
behavioral2/memory/1964-209-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp	xmrig
behavioral2/memory/2684-211-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp	xmrig
behavioral2/memory/3948-213-0x00007FF68E500000-0x00007FF68E851000-memory.dmp	xmrig
behavioral2/memory/1696-215-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp	xmrig
behavioral2/memory/1340-217-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp	xmrig
behavioral2/memory/1552-219-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp	xmrig
behavioral2/memory/2036-229-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp	xmrig
behavioral2/memory/1044-231-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp	xmrig
behavioral2/memory/1692-235-0x00007FF79F190000-0x00007FF79F4E1000-memory.dmp	xmrig
behavioral2/memory/1240-237-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp	xmrig
behavioral2/memory/4852-233-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp	xmrig
behavioral2/memory/3916-248-0x00007FF7BD850000-0x00007FF7BDBA1000-memory.dmp	xmrig
behavioral2/memory/864-245-0x00007FF69BD30000-0x00007FF69C081000-memory.dmp	xmrig
behavioral2/memory/4492-244-0x00007FF646B20000-0x00007FF646E71000-memory.dmp	xmrig
behavioral2/memory/3176-241-0x00007FF7EED40000-0x00007FF7EF091000-memory.dmp	xmrig
behavioral2/memory/2276-240-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp	xmrig
behavioral2/memory/4024-249-0x00007FF7AF4B0000-0x00007FF7AF801000-memory.dmp	xmrig
behavioral2/memory/844-255-0x00007FF6F2CB0000-0x00007FF6F3001000-memory.dmp	xmrig
behavioral2/memory/2080-253-0x00007FF6CD2A0000-0x00007FF6CD5F1000-memory.dmp	xmrig
behavioral2/memory/1180-257-0x00007FF718020000-0x00007FF718371000-memory.dmp	xmrig
behavioral2/memory/4792-251-0x00007FF633930000-0x00007FF633C81000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1964	JBqzHFC.exe
2684	KHIqykV.exe
3948	WUtOeWH.exe
1696	rhzWRBe.exe
1340	TOxsFXK.exe
1552	cfJCDYR.exe
2036	bBwwHaq.exe
4852	dOXqjAO.exe
1044	CXicDPk.exe
864	lYgPzZD.exe
1240	JtxnJov.exe
1692	YqQQqfr.exe
4492	ADuShQs.exe
4792	CbhYhez.exe
3176	RVIGtCK.exe
2276	unruigS.exe
4024	txmVWEt.exe
3916	ScFENdI.exe
2080	SMVCojd.exe
1180	fNAgdAx.exe
844	tvuIhIz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x00007FF674E40000-0x00007FF675191000-memory.dmp	upx
behavioral2/files/0x00090000000233dc-5.dat	upx
behavioral2/files/0x000700000002343a-11.dat	upx
behavioral2/files/0x000700000002343c-19.dat	upx
behavioral2/memory/3948-20-0x00007FF68E500000-0x00007FF68E851000-memory.dmp	upx
behavioral2/files/0x000700000002343b-22.dat	upx
behavioral2/files/0x000700000002343e-31.dat	upx
behavioral2/files/0x000700000002343f-35.dat	upx
behavioral2/files/0x0007000000023443-62.dat	upx
behavioral2/memory/4792-86-0x00007FF633930000-0x00007FF633C81000-memory.dmp	upx
behavioral2/files/0x0008000000023437-94.dat	upx
behavioral2/files/0x0007000000023448-102.dat	upx
behavioral2/files/0x000700000002344b-110.dat	upx
behavioral2/files/0x000700000002344c-118.dat	upx
behavioral2/files/0x000700000002344a-112.dat	upx
behavioral2/files/0x0007000000023449-107.dat	upx
behavioral2/memory/2276-91-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp	upx
behavioral2/files/0x0007000000023444-89.dat	upx
behavioral2/files/0x0007000000023447-92.dat	upx
behavioral2/memory/4492-85-0x00007FF646B20000-0x00007FF646E71000-memory.dmp	upx
behavioral2/memory/1240-82-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp	upx
behavioral2/files/0x0007000000023446-87.dat	upx
behavioral2/files/0x0007000000023442-80.dat	upx
behavioral2/files/0x0007000000023445-70.dat	upx
behavioral2/memory/4852-68-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp	upx
behavioral2/files/0x0007000000023440-66.dat	upx
behavioral2/files/0x0007000000023441-59.dat	upx
behavioral2/memory/2036-56-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp	upx
behavioral2/memory/1044-47-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp	upx
behavioral2/memory/1552-45-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp	upx
behavioral2/files/0x000700000002343d-41.dat	upx
behavioral2/memory/1340-38-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp	upx
behavioral2/memory/1696-26-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp	upx
behavioral2/memory/2684-14-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp	upx
behavioral2/memory/1964-9-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp	upx
behavioral2/memory/864-120-0x00007FF69BD30000-0x00007FF69C081000-memory.dmp	upx
behavioral2/memory/2080-124-0x00007FF6CD2A0000-0x00007FF6CD5F1000-memory.dmp	upx
behavioral2/memory/4024-127-0x00007FF7AF4B0000-0x00007FF7AF801000-memory.dmp	upx
behavioral2/memory/844-126-0x00007FF6F2CB0000-0x00007FF6F3001000-memory.dmp	upx
behavioral2/memory/1180-125-0x00007FF718020000-0x00007FF718371000-memory.dmp	upx
behavioral2/memory/3916-123-0x00007FF7BD850000-0x00007FF7BDBA1000-memory.dmp	upx
behavioral2/memory/3176-122-0x00007FF7EED40000-0x00007FF7EF091000-memory.dmp	upx
behavioral2/memory/1692-121-0x00007FF79F190000-0x00007FF79F4E1000-memory.dmp	upx
behavioral2/memory/2684-130-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp	upx
behavioral2/memory/1964-129-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp	upx
behavioral2/memory/4912-128-0x00007FF674E40000-0x00007FF675191000-memory.dmp	upx
behavioral2/memory/1240-139-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp	upx
behavioral2/memory/2276-144-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp	upx
behavioral2/memory/4492-142-0x00007FF646B20000-0x00007FF646E71000-memory.dmp	upx
behavioral2/memory/4792-140-0x00007FF633930000-0x00007FF633C81000-memory.dmp	upx
behavioral2/memory/4852-136-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp	upx
behavioral2/memory/1552-134-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp	upx
behavioral2/memory/1044-137-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp	upx
behavioral2/memory/2036-135-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp	upx
behavioral2/memory/1340-133-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp	upx
behavioral2/memory/1696-132-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp	upx
behavioral2/memory/3948-131-0x00007FF68E500000-0x00007FF68E851000-memory.dmp	upx
behavioral2/memory/4912-150-0x00007FF674E40000-0x00007FF675191000-memory.dmp	upx
behavioral2/memory/1964-209-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp	upx
behavioral2/memory/2684-211-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp	upx
behavioral2/memory/3948-213-0x00007FF68E500000-0x00007FF68E851000-memory.dmp	upx
behavioral2/memory/1696-215-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp	upx
behavioral2/memory/1340-217-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp	upx
behavioral2/memory/1552-219-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\dOXqjAO.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\txmVWEt.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\fNAgdAx.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\KHIqykV.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\rhzWRBe.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\TOxsFXK.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\cfJCDYR.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\bBwwHaq.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\WUtOeWH.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\lYgPzZD.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\JtxnJov.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\unruigS.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\ScFENdI.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\SMVCojd.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\tvuIhIz.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\JBqzHFC.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\CbhYhez.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\YqQQqfr.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\ADuShQs.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\RVIGtCK.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
File created	C:\Windows\System\CXicDPk.exe	65318632a52b62f58d0ad6b6a7ac4cf0N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe
Token: SeLockMemoryPrivilege	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1964	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	85
PID 4912 wrote to memory of 1964	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	85
PID 4912 wrote to memory of 2684	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	86
PID 4912 wrote to memory of 2684	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	86
PID 4912 wrote to memory of 3948	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	87
PID 4912 wrote to memory of 3948	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	87
PID 4912 wrote to memory of 1696	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	88
PID 4912 wrote to memory of 1696	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	88
PID 4912 wrote to memory of 1340	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	89
PID 4912 wrote to memory of 1340	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	89
PID 4912 wrote to memory of 1552	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	90
PID 4912 wrote to memory of 1552	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	90
PID 4912 wrote to memory of 2036	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	91
PID 4912 wrote to memory of 2036	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	91
PID 4912 wrote to memory of 4852	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	92
PID 4912 wrote to memory of 4852	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	92
PID 4912 wrote to memory of 1044	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	93
PID 4912 wrote to memory of 1044	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	93
PID 4912 wrote to memory of 864	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	94
PID 4912 wrote to memory of 864	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	94
PID 4912 wrote to memory of 1240	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	95
PID 4912 wrote to memory of 1240	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	95
PID 4912 wrote to memory of 4792	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	96
PID 4912 wrote to memory of 4792	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	96
PID 4912 wrote to memory of 1692	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	97
PID 4912 wrote to memory of 1692	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	97
PID 4912 wrote to memory of 4492	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	98
PID 4912 wrote to memory of 4492	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	98
PID 4912 wrote to memory of 3176	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	99
PID 4912 wrote to memory of 3176	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	99
PID 4912 wrote to memory of 2276	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	100
PID 4912 wrote to memory of 2276	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	100
PID 4912 wrote to memory of 4024	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	101
PID 4912 wrote to memory of 4024	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	101
PID 4912 wrote to memory of 3916	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	102
PID 4912 wrote to memory of 3916	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	102
PID 4912 wrote to memory of 2080	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	103
PID 4912 wrote to memory of 2080	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	103
PID 4912 wrote to memory of 1180	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	104
PID 4912 wrote to memory of 1180	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	104
PID 4912 wrote to memory of 844	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	105
PID 4912 wrote to memory of 844	4912	65318632a52b62f58d0ad6b6a7ac4cf0N.exe	105

C:\Users\Admin\AppData\Local\Temp\65318632a52b62f58d0ad6b6a7ac4cf0N.exe
"C:\Users\Admin\AppData\Local\Temp\65318632a52b62f58d0ad6b6a7ac4cf0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System\JBqzHFC.exe
  C:\Windows\System\JBqzHFC.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\KHIqykV.exe
  C:\Windows\System\KHIqykV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WUtOeWH.exe
  C:\Windows\System\WUtOeWH.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\rhzWRBe.exe
  C:\Windows\System\rhzWRBe.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TOxsFXK.exe
  C:\Windows\System\TOxsFXK.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\cfJCDYR.exe
  C:\Windows\System\cfJCDYR.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\bBwwHaq.exe
  C:\Windows\System\bBwwHaq.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\dOXqjAO.exe
  C:\Windows\System\dOXqjAO.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\CXicDPk.exe
  C:\Windows\System\CXicDPk.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\lYgPzZD.exe
  C:\Windows\System\lYgPzZD.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\JtxnJov.exe
  C:\Windows\System\JtxnJov.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\CbhYhez.exe
  C:\Windows\System\CbhYhez.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\YqQQqfr.exe
  C:\Windows\System\YqQQqfr.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ADuShQs.exe
  C:\Windows\System\ADuShQs.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\RVIGtCK.exe
  C:\Windows\System\RVIGtCK.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\unruigS.exe
  C:\Windows\System\unruigS.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\txmVWEt.exe
  C:\Windows\System\txmVWEt.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ScFENdI.exe
  C:\Windows\System\ScFENdI.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\SMVCojd.exe
  C:\Windows\System\SMVCojd.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\fNAgdAx.exe
  C:\Windows\System\fNAgdAx.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\tvuIhIz.exe
  C:\Windows\System\tvuIhIz.exe
  2⤵
  - Executes dropped EXE
  PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ADuShQs.exe

Filesize
5.2MB

MD5
38ce599887619bbd2c60578edcb4f752

SHA1
bb1de6f7e0e393a5150f453697ccb5a65a45b720

SHA256
6ce1eb38675912926d82ae0a9d53af41cda4eb2415e283b0b7c67c06d737edac

SHA512
f3ea366ef60f4f8c4441726c8c5f166eedd8d3168ff0af60febe3bf4679e823cbaedddd1f0f448e39829390858bc6e13f08a3844f7bd0301a4562f72e5eba366

Download Submit
C:\Windows\System\CXicDPk.exe

Filesize
5.2MB

MD5
d241475534f3f8eaa946573f36e151d4

SHA1
1b5c5c9926081ebb59ca6f0bf185f6f6d621cf78

SHA256
24f7913037c7b71895f68b28876e35fda3543092d2615b5f0637725f83584ee4

SHA512
50fe3d4413b9186e542dc19c9ce80223ed76b30a5ada5bc87048b48c4f8c9c927829410b72b489e01472aa6ea6d465e0de63fc44dc8681a7ca5e36ebff5c43c0

Download Submit
C:\Windows\System\CbhYhez.exe

Filesize
5.2MB

MD5
657aa9932e4ec2985edfa7b78004445c

SHA1
b233af94fcab92532c70444f0ee1373295b44307

SHA256
038dc29592359745fe0032d054d30986a032cffc493d4a133a49a21b43a6f060

SHA512
966517a2577f3fba988fb2b37f74839a2d9f3309361af849777f06328c7471e411e1f755367f33292b39a56d4b610a1f43d43ae1b12088f3d487399e8b497780

Download Submit
C:\Windows\System\JBqzHFC.exe

Filesize
5.2MB

MD5
88e79d7be6f04125bd0231664490dbfd

SHA1
41cfaff7cce04a070979ca97e0331fae324f792b

SHA256
0471f31628fc8012476727659b5cbe4e409f4ba88a129aeaf5d441093f24c08b

SHA512
54badd4911ce4154b9d89635ec2a0e97f0d19054036feb228a442e89bda850f5d1cb56b7d2abe47c792b9c3f35bd72b9bd5457a67bcc561cfb795f94b6227559

Download Submit
C:\Windows\System\JtxnJov.exe

Filesize
5.2MB

MD5
3f600d2efa4e4f568ffdcee475d1d256

SHA1
285c00bdc6b6a47addc876ea12f1ddd2593e0e95

SHA256
e24a3edb7d8a568097cd10715b92542e44db95e4807714f8d81e6db150aaf168

SHA512
608b347c0abafedf27732ac0062f8d34928497f77e15c18557983f0c257e35ffdff7956a1473e8b73bb2c629eab83650650d7028ea764a970b71061f8f22633d

Download Submit
C:\Windows\System\KHIqykV.exe

Filesize
5.2MB

MD5
0fe5fc43e5c377e195a9e9f6a366cddb

SHA1
c531e4cffc3cdfd87bfb0485f10916515d3c4020

SHA256
ba725f500833a50fb9e02ab29452a079434ab962f554e5aec68555b1fd2b06d9

SHA512
22e5780bfb104570343f937cf6331103242cd8aeb585c1befdf3cf940234e914e7ddec909b66a7fc69045c28ca57dc229a6046df6b20df886f30314ca02cab48

Download Submit
C:\Windows\System\RVIGtCK.exe

Filesize
5.2MB

MD5
c5644d771b9fecb4b83a13e0da7236eb

SHA1
b672feef2669de5dae0d206d23fbca00336545c5

SHA256
4f9c21d12546147d208ec53b0633d443b0f33011105f1e47610e663de379bc72

SHA512
f559a673216739a20bb35b8b28d707bbbdda62d80626bda208640a5aff07a4090a051e25fa558afa0570bcd30f5e8d758a5fa0a1e2cca5b0aadf804e02fc7992

Download Submit
C:\Windows\System\SMVCojd.exe

Filesize
5.2MB

MD5
8231fdb5b41bb8de12ef44327e16f5fd

SHA1
6be604dfa35d3b9ce29bead641525d3d7eef9dda

SHA256
9094f0313f6e6dd6a0769c6c00f7d427f9f181e25a8a1d718d63943aa28027f4

SHA512
5fe5b12be4b0c94a6a698f60423691f962639a5a5de4879c7653d68ab89ade2e984895e283f91e3bb577e500c47e296e2a45a7689589af412b0a22f48e133fc6

Download Submit
C:\Windows\System\ScFENdI.exe

Filesize
5.2MB

MD5
79f34e68540d6f312e5a63134d75454d

SHA1
6acd84ec232ce7e2bf960978c0948a19cbb08434

SHA256
138b8d9787b874aa337d89f479f60df650f082a9e48a71edc08bc607afaaa6fd

SHA512
a5a1d058ffd90caba990edc17faed67e0a8b4868b5f72531dbc55e8ba783bda9e0c99b6d7da136c52eca9deca001623cf8ed8f9ffa42a78009e7258958624f32

Download Submit
C:\Windows\System\TOxsFXK.exe

Filesize
5.2MB

MD5
ed8dd055344be18f02f936392c4c82a5

SHA1
19bd357903a72549acea6c8973b9f525bf7a15fc

SHA256
57b4f6ce4eb4f66041d7e60ef6dc1ae7e1595023ea177f7b96858b562ba35181

SHA512
ba94c67c523a817238386b88338bba73340b2a8144c6c7649aca932182a2fef4f03228a26e72aebbf8a2b71b97a98f2991f5a2a671732c6df3ad9cf1b3f79079

Download Submit
C:\Windows\System\WUtOeWH.exe

Filesize
5.2MB

MD5
6c7c03fb9f709bfa5b4564072ceab3c7

SHA1
1913e4d1b3701cca546951f9ceaa55c879f2fbcc

SHA256
46b1e6532523b5e9d6e06b709bdecbc65d61a88a4997c3b6933b1c511c1d7e1e

SHA512
b296b59a41c4afac236b16c710b1e2a459a954ca5124953edcafffb6fff850ea3a206450e7e40468f452fcc1c40b5d80921138f236d40fadceda6b5b83c50f02

Download Submit
C:\Windows\System\YqQQqfr.exe

Filesize
5.2MB

MD5
7e9b3fba4971d2a532f0a39f7dea872e

SHA1
362d7d57216ba46e236cab6f4038fe942d920d21

SHA256
16d372298476ea8d26f445a5e21d63db85749d128df1014ef758646451bdc543

SHA512
5423e4a025ea53c5a6d7eaa7a0375f91b9ad93978a047357464172832004a64e53c6f9d9d687be13e8a31d32bb4bbeb2e452b682dbdf20c750d2a6adc16d6fcf

Download Submit
C:\Windows\System\bBwwHaq.exe

Filesize
5.2MB

MD5
b0c7491725924ac76c3e43bcb3a4c4e9

SHA1
a0bd58fd3589d5742639d2fc9fbd1a7793ce9e86

SHA256
dd29d679a80d42c872ee48958f5fc2eee1d24e7e1f62925d2d363c4c9578baf4

SHA512
efbdaf1225303438b956aa31baeac5f9af67fecf64b43e8c9097ee3440facf477a24e77fcf7694dbaccd7a28837f82ca6dd4abc2ed7e72a850b8316cb32e0ba5

Download Submit
C:\Windows\System\cfJCDYR.exe

Filesize
5.2MB

MD5
b02eb7e3c95b89041df541a0a5b6b76e

SHA1
024939946fa785cd234810a382ffbe20c6937d72

SHA256
39e2aaad5d9e9c1b182f99f1b357021d40a898b22008b528d98ac192c3706461

SHA512
2f350a487d853434ab8abe0496e2c000a78256ca81d373899b2a77cb288a1c78900712cbb1dee22a71a06aae3767a6b11d11b5ffc5734c63a778048cd5f51a6c

Download Submit
C:\Windows\System\dOXqjAO.exe

Filesize
5.2MB

MD5
7409717b99d3662d2779818b1b6b627c

SHA1
73c4ee56b42490dc3ec46f525551219c5eed0f3b

SHA256
15060134fc844b6942d52718b343bf683288fa6bd540ee71277b9673f0aab757

SHA512
15daf89212bd51e7b05929ec23b4c38efb41749dcfcb93b0432d9e003a4d24e0c34cba884c17b82259304d7aa23ebd73ef194378b502f50c4f3ac73cafaa70f0

Download Submit
C:\Windows\System\fNAgdAx.exe

Filesize
5.2MB

MD5
fc50df5e4d2b9c5b40a3a4c955c4ecdf

SHA1
57434f96503cf0d60291a25e8fc1f553575d9951

SHA256
c99ae3623fbfdb59f6ff7c58d76557133be1843ee52b9ef374f69034f6d52e90

SHA512
429727b639f90e2992ac88b7f9d11d715da0bc5d0f1b312f1da67fd427919f1ba48f59d5c1796e66b08ae423daaf496a9c79913c1809a88b0302cfba2f682164

Download Submit
C:\Windows\System\lYgPzZD.exe

Filesize
5.2MB

MD5
4cec1ef9a7c997f94399b4dd6a3d369a

SHA1
76d4bea936b34350e51be0c072c4ba5ec3d612ab

SHA256
1f3eeeabae23b9b0740bd0abcf97b7a7ae0c0f2b32086d2bcbb1e9e116a79d2a

SHA512
61c0da3704fb7a829b01387bf55a68579469800bfbb1d6f4272b1700ea7a5295a5bd71c6e45f8e3ecf75edb9d85f3fd20062f730cb561cce999b42ad28ccda65

Download Submit
C:\Windows\System\rhzWRBe.exe

Filesize
5.2MB

MD5
3ebf44676ae7c5d1b5c842fca0276c80

SHA1
755c25c60df5c26cff59f519986c8771da94653d

SHA256
56dc4986d2931e6d2f3647f444b1895f365da03db3124330b884d87430f6c7b7

SHA512
34214f46bb275c034fbc79a20649ee68cf3b7f6036fa73e831bc6d84ccb304ec7f35ee12120492aff8cc5065f475a535c4b5690b1f76f4a66af6fbb5b02be0fb

Download Submit
C:\Windows\System\tvuIhIz.exe

Filesize
5.2MB

MD5
268456ea72d2b3e41dd93ff8df57606a

SHA1
aaa3dbf9beb5c79d1c92507066d74652f9d22390

SHA256
e8f4077f94413540dde02b44bf67bfe7be9baa580c11b920e9ec596647da6841

SHA512
0b71461182eace7715b20e15dfeeac51ed4411466ecd3d1b56a095210f2085bb0b2ed220dca56d3becfe992747ede1b1dcba32dee65a6bcd8c0ee8318b84d7ad

Download Submit
C:\Windows\System\txmVWEt.exe

Filesize
5.2MB

MD5
817de70dce04a06f90c921d4356c7692

SHA1
f9cd6eeb589c74ff5460663bb425f31521d58a24

SHA256
e1c24bfaca0ffb7f5f81671cc86f79debf91ad71c1cf0edeb05b8379622fd805

SHA512
747637285162f2971911332cc6168743796a4f95caca8352a6987bbf6a75a5e0ed1060bbb83cc8d670ef7eb92331c8ecbfbf455533b2abdace5c0acf15308004

Download Submit
C:\Windows\System\unruigS.exe

Filesize
5.2MB

MD5
557776655720884162a4d16875ffa60b

SHA1
8da9d6857932a95e11df990b03e821b0c853a82b

SHA256
0d7598f1b9b08b0ca93fce52ed5bd2ca8831bca7eec78201c9a1a312973bfe43

SHA512
b176f9f7f37df959d0f9d356e26cb542c0a1d6ea59db3876deaff8122987179efa2da904e3af383e73f193fed030d48fe0a077268fb9823670e545ac6d105782

Download Submit
memory/844-126-0x00007FF6F2CB0000-0x00007FF6F3001000-memory.dmp

Filesize
3.3MB

Download
memory/844-255-0x00007FF6F2CB0000-0x00007FF6F3001000-memory.dmp

Filesize
3.3MB

Download
memory/864-245-0x00007FF69BD30000-0x00007FF69C081000-memory.dmp

Filesize
3.3MB

Download
memory/864-120-0x00007FF69BD30000-0x00007FF69C081000-memory.dmp

Filesize
3.3MB

Download
memory/1044-231-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp

Filesize
3.3MB

Download
memory/1044-137-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp

Filesize
3.3MB

Download
memory/1044-47-0x00007FF64C8F0000-0x00007FF64CC41000-memory.dmp

Filesize
3.3MB

Download
memory/1180-125-0x00007FF718020000-0x00007FF718371000-memory.dmp

Filesize
3.3MB

Download
memory/1180-257-0x00007FF718020000-0x00007FF718371000-memory.dmp

Filesize
3.3MB

Download
memory/1240-82-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp

Filesize
3.3MB

Download
memory/1240-237-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp

Filesize
3.3MB

Download
memory/1240-139-0x00007FF6E6E20000-0x00007FF6E7171000-memory.dmp

Filesize
3.3MB

Download
memory/1340-38-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp

Filesize
3.3MB

Download
memory/1340-217-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp

Filesize
3.3MB

Download
memory/1340-133-0x00007FF74AE00000-0x00007FF74B151000-memory.dmp

Filesize
3.3MB

Download
memory/1552-45-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp

Filesize
3.3MB

Download
memory/1552-219-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp

Filesize
3.3MB

Download
memory/1552-134-0x00007FF6A11A0000-0x00007FF6A14F1000-memory.dmp

Filesize
3.3MB

Download
memory/1692-121-0x00007FF79F190000-0x00007FF79F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/1692-235-0x00007FF79F190000-0x00007FF79F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/1696-26-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp

Filesize
3.3MB

Download
memory/1696-215-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp

Filesize
3.3MB

Download
memory/1696-132-0x00007FF6E86A0000-0x00007FF6E89F1000-memory.dmp

Filesize
3.3MB

Download
memory/1964-209-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp

Filesize
3.3MB

Download
memory/1964-9-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp

Filesize
3.3MB

Download
memory/1964-129-0x00007FF6AF9F0000-0x00007FF6AFD41000-memory.dmp

Filesize
3.3MB

Download
memory/2036-56-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp

Filesize
3.3MB

Download
memory/2036-229-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp

Filesize
3.3MB

Download
memory/2036-135-0x00007FF7BDFE0000-0x00007FF7BE331000-memory.dmp

Filesize
3.3MB

Download
memory/2080-124-0x00007FF6CD2A0000-0x00007FF6CD5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2080-253-0x00007FF6CD2A0000-0x00007FF6CD5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2276-144-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp

Filesize
3.3MB

Download
memory/2276-91-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp

Filesize
3.3MB

Download
memory/2276-240-0x00007FF7CDDB0000-0x00007FF7CE101000-memory.dmp

Filesize
3.3MB

Download
memory/2684-14-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-211-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-130-0x00007FF7FFA70000-0x00007FF7FFDC1000-memory.dmp

Filesize
3.3MB

Download
memory/3176-241-0x00007FF7EED40000-0x00007FF7EF091000-memory.dmp

Filesize
3.3MB

Download
memory/3176-122-0x00007FF7EED40000-0x00007FF7EF091000-memory.dmp

Filesize
3.3MB

Download
memory/3916-248-0x00007FF7BD850000-0x00007FF7BDBA1000-memory.dmp

Filesize
3.3MB

Download
memory/3916-123-0x00007FF7BD850000-0x00007FF7BDBA1000-memory.dmp

Filesize
3.3MB

Download
memory/3948-131-0x00007FF68E500000-0x00007FF68E851000-memory.dmp

Filesize
3.3MB

Download
memory/3948-213-0x00007FF68E500000-0x00007FF68E851000-memory.dmp

Filesize
3.3MB

Download
memory/3948-20-0x00007FF68E500000-0x00007FF68E851000-memory.dmp

Filesize
3.3MB

Download
memory/4024-249-0x00007FF7AF4B0000-0x00007FF7AF801000-memory.dmp

Filesize
3.3MB

Download
memory/4024-127-0x00007FF7AF4B0000-0x00007FF7AF801000-memory.dmp

Filesize
3.3MB

Download
memory/4492-85-0x00007FF646B20000-0x00007FF646E71000-memory.dmp

Filesize
3.3MB

Download
memory/4492-142-0x00007FF646B20000-0x00007FF646E71000-memory.dmp

Filesize
3.3MB

Download
memory/4492-244-0x00007FF646B20000-0x00007FF646E71000-memory.dmp

Filesize
3.3MB

Download
memory/4792-251-0x00007FF633930000-0x00007FF633C81000-memory.dmp

Filesize
3.3MB

Download
memory/4792-140-0x00007FF633930000-0x00007FF633C81000-memory.dmp

Filesize
3.3MB

Download
memory/4792-86-0x00007FF633930000-0x00007FF633C81000-memory.dmp

Filesize
3.3MB

Download
memory/4852-233-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-68-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-136-0x00007FF67D470000-0x00007FF67D7C1000-memory.dmp

Filesize
3.3MB

Download
memory/4912-128-0x00007FF674E40000-0x00007FF675191000-memory.dmp

Filesize
3.3MB

Download
memory/4912-0-0x00007FF674E40000-0x00007FF675191000-memory.dmp

Filesize
3.3MB

Download
memory/4912-1-0x000002163CE90000-0x000002163CEA0000-memory.dmp

Filesize
64KB

Download
memory/4912-150-0x00007FF674E40000-0x00007FF675191000-memory.dmp

Filesize
3.3MB

Download