lumma | 84844b745d886eebbe814e0b9b05fd921a252019e27661a447a1103c8937f997

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

326KB
MD5

10d006a7541fa517e818d9d7d9787deb
SHA1

c9d7349fb4d305604c1ccabe0e7dfe28f9d3a858
SHA256

84844b745d886eebbe814e0b9b05fd921a252019e27661a447a1103c8937f997
SHA512

3a0b245830a67a94b25e67e6582be71f59fab54abe26e6fd0f9a584ef7a4dc228bdb790a986750947817bc986c3b81763882b5a7f5bc17de62e34b17bf37dd32
SSDEEP

6144:CkNFUH0fMA9uqoJuDew+xO0I7eJetJUIgUjC/0LY716rYub2SrBL6+6nAEO:Ca3MAvYUZ+xVMpTe8076b2SrklnAEO

Score

10^/10

lumma stealc vidar default ffa0fc7713f6625bf874f947bcf3df53 credential_access discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

lumma

https://reinforcenh.shop/api

https://stogeneratmns.shop/api

https://fragnantbui.shop/api

https://drawzhotdog.shop/api

https://vozmeatillu.shop/api

https://offensivedzvju.shop/api

https://ghostreedmnu.shop/api

https://gutterydhowi.shop/api

Extracted

Family

vidar

Version

Botnet

ffa0fc7713f6625bf874f947bcf3df53

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

https://offensivedzvju.shop/api

Signatures

Detect Vidar Stealer 15 IoCs

stealer

resource	yara_rule
behavioral2/memory/4288-118-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-120-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-122-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-136-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-137-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-158-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-162-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-178-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-201-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-180-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-202-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-209-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/4288-210-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/5076-257-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7
behavioral2/memory/5076-258-0x0000000000400000-0x0000000000B77000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4728	netsh.exe
2212	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 6 IoCs

pid	Process
3968	AdminGCGDHJDAFH.exe
4356	AdminFIDHIEBAAK.exe
4304	AdminBFCGDAAKFH.exe
3664	RDPWInst.exe
2520	KKJDGDHIDB.exe
4476	KEGCFCAKFH.exe

Loads dropped DLL 5 IoCs

pid	Process
3492	RegAsm.exe
3492	RegAsm.exe
1156	svchost.exe
4288	RegAsm.exe
4288	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
94	api.ipify.org

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	RDPWInst.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 3492	4572	file.exe	83
PID 4356 set thread context of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 3968 set thread context of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 2520 set thread context of 4356	2520	KKJDGDHIDB.exe	124
PID 4476 set thread context of 5076	4476	KEGCFCAKFH.exe	133

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1176	3456	WerFault.exe	105
3764	4356	WerFault.exe	124

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KKJDGDHIDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminGCGDHJDAFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminFIDHIEBAAK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminBFCGDAAKFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KEGCFCAKFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2632	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3492	RegAsm.exe
3492	RegAsm.exe
3492	RegAsm.exe
3492	RegAsm.exe
4288	RegAsm.exe
4288	RegAsm.exe
4288	RegAsm.exe
4288	RegAsm.exe
1156	svchost.exe
1156	svchost.exe
1156	svchost.exe
1156	svchost.exe
4288	RegAsm.exe
4288	RegAsm.exe
4288	RegAsm.exe
4288	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	AdminBFCGDAAKFH.exe
Token: SeDebugPrivilege	3664	RDPWInst.exe
Token: SeAuditPrivilege	1156	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 4572 wrote to memory of 3492	4572	file.exe	83
PID 3492 wrote to memory of 3696	3492	RegAsm.exe	86
PID 3492 wrote to memory of 3696	3492	RegAsm.exe	86
PID 3492 wrote to memory of 3696	3492	RegAsm.exe	86
PID 3696 wrote to memory of 3968	3696	cmd.exe	88
PID 3696 wrote to memory of 3968	3696	cmd.exe	88
PID 3696 wrote to memory of 3968	3696	cmd.exe	88
PID 3492 wrote to memory of 2740	3492	RegAsm.exe	90
PID 3492 wrote to memory of 2740	3492	RegAsm.exe	90
PID 3492 wrote to memory of 2740	3492	RegAsm.exe	90
PID 3492 wrote to memory of 1904	3492	RegAsm.exe	92
PID 3492 wrote to memory of 1904	3492	RegAsm.exe	92
PID 3492 wrote to memory of 1904	3492	RegAsm.exe	92
PID 2740 wrote to memory of 4356	2740	cmd.exe	94
PID 2740 wrote to memory of 4356	2740	cmd.exe	94
PID 2740 wrote to memory of 4356	2740	cmd.exe	94
PID 1904 wrote to memory of 4304	1904	cmd.exe	97
PID 1904 wrote to memory of 4304	1904	cmd.exe	97
PID 1904 wrote to memory of 4304	1904	cmd.exe	97
PID 4304 wrote to memory of 4444	4304	AdminBFCGDAAKFH.exe	99
PID 4304 wrote to memory of 4444	4304	AdminBFCGDAAKFH.exe	99
PID 4304 wrote to memory of 4444	4304	AdminBFCGDAAKFH.exe	99
PID 4444 wrote to memory of 644	4444	cmd.exe	101
PID 4444 wrote to memory of 644	4444	cmd.exe	101
PID 4444 wrote to memory of 644	4444	cmd.exe	101
PID 644 wrote to memory of 3256	644	net.exe	102
PID 644 wrote to memory of 3256	644	net.exe	102
PID 644 wrote to memory of 3256	644	net.exe	102
PID 4356 wrote to memory of 3088	4356	AdminFIDHIEBAAK.exe	103
PID 4356 wrote to memory of 3088	4356	AdminFIDHIEBAAK.exe	103
PID 4356 wrote to memory of 3088	4356	AdminFIDHIEBAAK.exe	103
PID 4356 wrote to memory of 2116	4356	AdminFIDHIEBAAK.exe	104
PID 4356 wrote to memory of 2116	4356	AdminFIDHIEBAAK.exe	104
PID 4356 wrote to memory of 2116	4356	AdminFIDHIEBAAK.exe	104
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 4356 wrote to memory of 3456	4356	AdminFIDHIEBAAK.exe	105
PID 3968 wrote to memory of 2996	3968	AdminGCGDHJDAFH.exe	109
PID 3968 wrote to memory of 2996	3968	AdminGCGDHJDAFH.exe	109
PID 3968 wrote to memory of 2996	3968	AdminGCGDHJDAFH.exe	109
PID 3968 wrote to memory of 5036	3968	AdminGCGDHJDAFH.exe	110
PID 3968 wrote to memory of 5036	3968	AdminGCGDHJDAFH.exe	110
PID 3968 wrote to memory of 5036	3968	AdminGCGDHJDAFH.exe	110
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111
PID 3968 wrote to memory of 4288	3968	AdminGCGDHJDAFH.exe	111

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGCGDHJDAFH.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Users\AdminGCGDHJDAFH.exe
      "C:\Users\AdminGCGDHJDAFH.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2996
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:5036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4288
      - C:\ProgramData\KKJDGDHIDB.exe
        
        "C:\ProgramData\KKJDGDHIDB.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1368
        8⤵
        Program crash
        
        PID:3764
      - C:\ProgramData\KEGCFCAKFH.exe
        
        "C:\ProgramData\KEGCFCAKFH.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:3976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1468
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5076
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BKECFIIEHCFH" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFIDHIEBAAK.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Users\AdminFIDHIEBAAK.exe
      "C:\Users\AdminFIDHIEBAAK.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:3088
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2116
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 1344
        6⤵
        Program crash
        
        PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminBFCGDAAKFH.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Users\AdminBFCGDAAKFH.exe
      "C:\Users\AdminBFCGDAAKFH.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net user
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Windows\SysWOW64\net.exe
        
        net user
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
        
        C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe -i
        6⤵
        Server Software Component: Terminal Services DLL
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3664
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4728
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net user RDPUser_08c0b4f5 kWag0ZffVtwU /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Windows\SysWOW64\net.exe
        
        net user RDPUser_08c0b4f5 kWag0ZffVtwU /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user RDPUser_08c0b4f5 kWag0ZffVtwU /add
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net localgroup
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:368
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net localgroup "Administrators" RDPUser_08c0b4f5 /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup "Administrators" RDPUser_08c0b4f5 /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administrators" RDPUser_08c0b4f5 /add
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3456 -ip 3456
1⤵
PID:4740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4356 -ip 4356
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
C:\ProgramData\BKECFIIEHCFH\DAAECA

Filesize
114KB

MD5
e228c51c082ab10d054c3ddc12f0d34c

SHA1
79b5574c9ce43d2195dcbfaf32015f473dfa4d2e

SHA256
02f65483e90802c728726ce1d16f2b405158f666c36e2c63090e27877ae4e309

SHA512
233ca5e06591e1646edfadb84a31bdfc12632fb73c47240a2109020accfbd1e337371bcc3340eae7a1f04140bbdeb0b416ce2de00fa85671671bb5f6c04aa822

Download Submit
C:\ProgramData\BKECFIIEHCFH\JJDBAE

Filesize
11KB

MD5
e82f038889e793b2c0ab5590b8e2431c

SHA1
71f83343fc68b32cc6de7ca127e8619eeb8b5531

SHA256
7e5d835cd78f6e68ec25b3ebd7f94da0db308b054443c30c69eaaf3d64c4c5a8

SHA512
453b13ca526a44c3c68b396dc573d89698c19f197bbf33baead2007d9c641da2ab4f56e1fa38029e208e3b724efa658bece3daeb110f114b1960c32819ce95da

Download Submit
C:\ProgramData\BKECFIIEHCFH\KKEBKJ

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\ProgramData\GCGDHJDAFHJE\CBFBGC

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\GCGDHJDAFHJE\CBFBGC

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\GCGDHJDAFHJE\CGDHDH

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\AdminBFCGDAAKFH.exe

Filesize
75KB

MD5
cee4e023e6afaaa51f600caec3469215

SHA1
bf2ceff1f19f09a70863d1f8c7be0fa9662b3b04

SHA256
da52143dd6a13c1ea3e24e735f64938830e2a3160ae08989629a43e5020d1173

SHA512
186f7a7592e2c21a83afe68bf0d57a3ad598ff5f3a74b626b45d4d555d9af52b66d0cba74445a55f89771f3078b47e18ae30feb6038934a433d99d85250a7ace

Download Submit
C:\Users\AdminFIDHIEBAAK.exe

Filesize
371KB

MD5
687846a623c1fe1da95f0fa2fe4479df

SHA1
6609d10980800b669e723d4c660c421e27695a29

SHA256
bfc7b367d52504b184d127e385219006c1efc7e985d608c000e5eb3a204fc779

SHA512
fe150d4f02532ca3d5aa37c6d14741a0a9c0290854ac6924da282ad6585b47bf98e8443aa4281ea89788b8e906f8d11d49b3e88a11e10d4d67b6e2605004a9c3

Download Submit
C:\Users\AdminGCGDHJDAFH.exe

Filesize
5.4MB

MD5
8d556f35d2768d27b334d0e76d4d3295

SHA1
33f2fbfe5c2b3d3d470bbf28c20e15283e20717c

SHA256
2bdab82a67299ff24cca7e0884c17fab80f45b364ba718142c80bdfbd573b581

SHA512
eadec8014bc15d1f72c44e5a45a2546a450d3c529aecc21d850ea50ebda1b5d47d569b4c6aef4215c402db87efbac7550736d28bc101d920f900ea80f83bc4ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
f66db1544813ac51e48ba0fb2d02f8ef

SHA1
cf7ab666f02fe7f52bc678055e62be13d21a2d27

SHA256
e0ebf4fe06eb84a5d971ef137469f32e880cb432e92eef9425cb5d8101bf87b2

SHA512
2eb4a199201be177e1496431d1883dc5a02b2978c1427b17031bfbc7b1811af5e39db3667c5c06b5b52bde99b7b3504daff3af34e7dd901603127af1530c0394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
6bae9321147a201166949ea91696032f

SHA1
b07906a71a0ae08bc076d1e0bfe499e21e9a9d80

SHA256
0aa77d07eddf4e014b5fd396a04ad4449ae6c3924e109de45e53cbaf3518e4f9

SHA512
6c1406eca75298ab51fdec0ad8fe90d1b2b94e596b812f7186e94d0e0fd32582de5a816b5c4be48b74c6cf83b1ad4e1416e8b8326a7daf96c876e6c0aa3ead08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KEGCFCAKFH.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe

Filesize
1.7MB

MD5
c213162c86bb943bcdf91b3df381d2f6

SHA1
8ec200e2d836354a62f16cdb3eed4bb760165425

SHA256
ac91b2a2db1909a2c166e243391846ad8d9ede2c6fcfd33b60acf599e48f9afc

SHA512
b3ead28bb1f4b87b0c36c129864a8af34fc11e5e9feaa047d4ca0525bec379d07c8efee259ede8832b65b3c03ef4396c9202989249199f7037d56439187f147b

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.ini

Filesize
433KB

MD5
92bc5fedb559357aa69d516a628f45dc

SHA1
6468a9fa0271724e70243eab49d200f457d3d554

SHA256
85cd5cd634fa8bbbf8d71b0a7d49a58870ef760da6d6e7789452cae4cab28127

SHA512
87e210e22631c1a394918859213140a7c54b75aec9bbc4f44509959d15cfa14abcbfeb1adf9cffa11b2e88f84a8708f67e842d859e63394b7f6036ce934c3cc9

Download Submit
memory/3456-111-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3456-115-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3456-113-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3492-3-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/3492-281-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/3492-116-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/3492-6-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/3492-8-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/3492-9-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3664-179-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/3968-96-0x0000000000C70000-0x00000000011DA000-memory.dmp

Filesize
5.4MB

Download
memory/3968-98-0x000000007277E000-0x000000007277F000-memory.dmp

Filesize
4KB

Download
memory/4288-158-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-209-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-120-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-118-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-122-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-162-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-178-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-137-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-136-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-201-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-180-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-202-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4288-210-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/4304-109-0x00000000017C0000-0x00000000017D8000-memory.dmp

Filesize
96KB

Download
memory/4304-108-0x0000000000DF0000-0x0000000000E08000-memory.dmp

Filesize
96KB

Download
memory/4304-282-0x0000000006360000-0x00000000063C6000-memory.dmp

Filesize
408KB

Download
memory/4356-104-0x0000000000B20000-0x0000000000B80000-memory.dmp

Filesize
384KB

Download
memory/4572-97-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4572-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4572-7-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4572-1-0x0000000000B50000-0x0000000000BA6000-memory.dmp

Filesize
344KB

Download
memory/5076-257-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download
memory/5076-258-0x0000000000400000-0x0000000000B77000-memory.dmp

Filesize
7.5MB

Download