rhadamanthys | 91d2a52f3ccc94057ef09bff7a5591271aef63f04029c48b7a28cd7240e601b6

Analysis

max time kernel
135s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-10-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

364KB
MD5

93fde4e38a84c83af842f73b176ab8dc
SHA1

e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA256

fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
SHA512

48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP

6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Score

10^/10

rhadamanthys discovery execution persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

fyryfbr.exe

description pid process target process

PID 5312 created 2964 5312 fyryfbr.exe sihost.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

436 powershell.exe
1616 powershell.exe

description	pid	process	target process
PID 5312 created 2964	5312	fyryfbr.exe	sihost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\CrowdstrikeEngine = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000990.dll,EntryPoint"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\CrowdstrikeEngine = "rundll32.exe C:\\Users\\Admin\\Documents\\CiscoUpdater000990.dll,EntryPoint"	reg.exe

Downloads MZ/PE file
Suspicious use of SetThreadContext 2 IoCs

Processes:

plugin212plugin212

description pid process target process

PID 3324 set thread context of 2432 3324 plugin212 csc.exe
PID 3268 set thread context of 5376 3268 plugin212 csc.exe
Executes dropped EXE 7 IoCs

Processes:

Launhcer.exeLauncher.exewinrar.exeplugin212plugin212fyryfbr.exefyryfbr.exe

pid process

1248 Launhcer.exe
1396 Launcher.exe
4996 winrar.exe
3324 plugin212
3268 plugin212
5860 fyryfbr.exe
5312 fyryfbr.exe
Loads dropped DLL 2 IoCs

Processes:

plugin212plugin212

pid process

3324 plugin212
3268 plugin212
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5664 5312 WerFault.exe fyryfbr.exe
6056 5312 WerFault.exe fyryfbr.exe

description	pid	process	target process
PID 3324 set thread context of 2432	3324	plugin212	csc.exe
PID 3268 set thread context of 5376	3268	plugin212	csc.exe

pid	process
1248	Launhcer.exe
1396	Launcher.exe
4996	winrar.exe
3324	plugin212
3268	plugin212
5860	fyryfbr.exe
5312	fyryfbr.exe

pid	process
3324	plugin212
3268	plugin212

pid	pid_target	process	target process
5664	5312	WerFault.exe	fyryfbr.exe
6056	5312	WerFault.exe	fyryfbr.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Launcher.exewinrar.execmd.exereg.exefyryfbr.exeopenwith.exeLauncher.exeLaunhcer.exeplugin212csc.exepowershell.exeplugin212cmd.exereg.execmd.exepowershell.execsc.exefyryfbr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyryfbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin212
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin212
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyryfbr.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exefyryfbr.exeopenwith.exe

pid	process
436	powershell.exe
436	powershell.exe
436	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
5312	fyryfbr.exe
5312	fyryfbr.exe
6032	openwith.exe
6032	openwith.exe
6032	openwith.exe
6032	openwith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.execsc.execsc.exe

description	pid	process
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2432	csc.exe
Token: SeDebugPrivilege	5376	csc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

winrar.exe

pid process

4996 winrar.exe
4996 winrar.exe
4996 winrar.exe

pid	process
4996	winrar.exe
4996	winrar.exe
4996	winrar.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exeplugin212cmd.exeplugin212cmd.exefyryfbr.exefyryfbr.exe

description	pid	process	target process
PID 2356 wrote to memory of 1248	2356	Launcher.exe	Launhcer.exe
PID 2356 wrote to memory of 1248	2356	Launcher.exe	Launhcer.exe
PID 2356 wrote to memory of 1248	2356	Launcher.exe	Launhcer.exe
PID 2356 wrote to memory of 1248	2356	Launcher.exe	Launhcer.exe
PID 2356 wrote to memory of 1248	2356	Launcher.exe	Launhcer.exe
PID 1248 wrote to memory of 436	1248	Launhcer.exe	powershell.exe
PID 1248 wrote to memory of 436	1248	Launhcer.exe	powershell.exe
PID 1248 wrote to memory of 436	1248	Launhcer.exe	powershell.exe
PID 436 wrote to memory of 1396	436	powershell.exe	Launcher.exe
PID 436 wrote to memory of 1396	436	powershell.exe	Launcher.exe
PID 436 wrote to memory of 1396	436	powershell.exe	Launcher.exe
PID 436 wrote to memory of 1396	436	powershell.exe	Launcher.exe
PID 436 wrote to memory of 1396	436	powershell.exe	Launcher.exe
PID 1396 wrote to memory of 1616	1396	Launcher.exe	powershell.exe
PID 1396 wrote to memory of 1616	1396	Launcher.exe	powershell.exe
PID 1396 wrote to memory of 1616	1396	Launcher.exe	powershell.exe
PID 1396 wrote to memory of 4996	1396	Launcher.exe	winrar.exe
PID 1396 wrote to memory of 4996	1396	Launcher.exe	winrar.exe
PID 1396 wrote to memory of 4996	1396	Launcher.exe	winrar.exe
PID 1396 wrote to memory of 3324	1396	Launcher.exe	plugin212
PID 1396 wrote to memory of 3324	1396	Launcher.exe	plugin212
PID 1396 wrote to memory of 3324	1396	Launcher.exe	plugin212
PID 1396 wrote to memory of 3268	1396	Launcher.exe	plugin212
PID 1396 wrote to memory of 3268	1396	Launcher.exe	plugin212
PID 1396 wrote to memory of 3268	1396	Launcher.exe	plugin212
PID 3324 wrote to memory of 2432	3324	plugin212	csc.exe
PID 3324 wrote to memory of 2432	3324	plugin212	csc.exe
PID 3324 wrote to memory of 2432	3324	plugin212	csc.exe
PID 3324 wrote to memory of 2432	3324	plugin212	csc.exe
PID 3324 wrote to memory of 2432	3324	plugin212	csc.exe
PID 3324 wrote to memory of 2228	3324	plugin212	cmd.exe
PID 3324 wrote to memory of 2228	3324	plugin212	cmd.exe
PID 3324 wrote to memory of 2228	3324	plugin212	cmd.exe
PID 2228 wrote to memory of 7056	2228	cmd.exe	reg.exe
PID 2228 wrote to memory of 7056	2228	cmd.exe	reg.exe
PID 2228 wrote to memory of 7056	2228	cmd.exe	reg.exe
PID 1396 wrote to memory of 2376	1396	Launcher.exe	cmd.exe
PID 1396 wrote to memory of 2376	1396	Launcher.exe	cmd.exe
PID 1396 wrote to memory of 2376	1396	Launcher.exe	cmd.exe
PID 3268 wrote to memory of 5376	3268	plugin212	csc.exe
PID 3268 wrote to memory of 5376	3268	plugin212	csc.exe
PID 3268 wrote to memory of 5376	3268	plugin212	csc.exe
PID 3268 wrote to memory of 5376	3268	plugin212	csc.exe
PID 3268 wrote to memory of 5376	3268	plugin212	csc.exe
PID 3268 wrote to memory of 5028	3268	plugin212	cmd.exe
PID 3268 wrote to memory of 5028	3268	plugin212	cmd.exe
PID 3268 wrote to memory of 5028	3268	plugin212	cmd.exe
PID 5028 wrote to memory of 6032	5028	cmd.exe	reg.exe
PID 5028 wrote to memory of 6032	5028	cmd.exe	reg.exe
PID 5028 wrote to memory of 6032	5028	cmd.exe	reg.exe
PID 5860 wrote to memory of 5312	5860	fyryfbr.exe	fyryfbr.exe
PID 5860 wrote to memory of 5312	5860	fyryfbr.exe	fyryfbr.exe
PID 5860 wrote to memory of 5312	5860	fyryfbr.exe	fyryfbr.exe
PID 5860 wrote to memory of 5312	5860	fyryfbr.exe	fyryfbr.exe
PID 5860 wrote to memory of 5312	5860	fyryfbr.exe	fyryfbr.exe
PID 5312 wrote to memory of 6032	5312	fyryfbr.exe	openwith.exe
PID 5312 wrote to memory of 6032	5312	fyryfbr.exe	openwith.exe
PID 5312 wrote to memory of 6032	5312	fyryfbr.exe	openwith.exe
PID 5312 wrote to memory of 6032	5312	fyryfbr.exe	openwith.exe
PID 5312 wrote to memory of 6032	5312	fyryfbr.exe	openwith.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2964
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6032

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01 C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4996
    - - C:\Users\Admin\AppData\Roaming\services\plugin212
        
        C:\Users\Admin\AppData\Roaming\services\plugin212
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3324
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7056
    - - C:\Users\Admin\AppData\Roaming\services\plugin212
        
        C:\Users\Admin\AppData\Roaming\services\plugin212
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3268
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5376
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CrowdstrikeEngine" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000990.dll",EntryPoint /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2376

C:\Users\Admin\AppData\Local\Temp\fyryfbr.exe
C:\Users\Admin\AppData\Local\Temp\fyryfbr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Users\Admin\AppData\Local\Temp\fyryfbr.exe
  "C:\Users\Admin\AppData\Local\Temp\fyryfbr.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 508
    3⤵
    - Program crash
    PID:5664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 500
    3⤵
    - Program crash
    PID:6056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xen3blog.oog.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyryfbr.exe

Filesize
2.9MB

MD5
53218d44298f406baefb2fd052eeb0ef

SHA1
afc422b48b829f29ee2cb95eb9d5139b788a1727

SHA256
11892dbe32cebd618deb6dc36477829ef9fb8181d7ec887408f44c08bb5f675b

SHA512
88b81da7e8d3665b0a41cd272c50318b8090dc3240d88020255f079df1373e2cf5fb9f0249320fb7346a52a29d20de42a4385f75e1cf91a12aa40786eae1a12a

Download Submit
C:\Users\Admin\AppData\Roaming\services\01

Filesize
17.3MB

MD5
f701c0f8a76b6495869b27f25483102f

SHA1
11499d073cc91226931eaf50467ab92bd78e2eac

SHA256
f7777723dc4bbf5ca3a5ecc39aca1fd763114a94cd805cddeb1e2a0edf73f738

SHA512
68d4ab1ad7aaf01f6f93f8d69b6bfd3289af63975759424db095447faafb1878ac7008228222d699652e0dcba5668ac5a7713600f8f98683536fb02979899a03

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\MSIMG32.dll

Filesize
4.2MB

MD5
b3b7a5388c55fd645e91a30918df4f3b

SHA1
6fe74711770bdecf45032369fcbb472155dcc020

SHA256
20007eeee7714925edf27094d9109025fdebaac26e1dbf97d51e8917276b6d3a

SHA512
409fcbd6031999d909eba71ba066e54bd6d72dc475a69f4586c3083184d37323916f4178987648a466a3ec0704c88b15bead0a7a2192d1aa2eb6c56b01e82db2

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
4KB

MD5
81c37a299ffaca00d04ba285c11fbef4

SHA1
a48a395894d9c9f64a8c6b7bb614b23554dc2de7

SHA256
55376b4b920acc1ccf1971e51e855d059eb65c7e684d49d0142d01937ae97d8d

SHA512
60ed30599986e6b4e923e765ff2518b3467276897382bdd0699513a36e005c2e9c73f0067153f39a5189f3e0ca39fbd0b41f73d9dc014b464bb7d759957edff3

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin212

Filesize
18.1MB

MD5
4f5749c5873c8fc08145afc910cd0fa8

SHA1
12475f59bc767dba061bb7b0f1d2441b9aa1e334

SHA256
a5ed9d1efd8d56351b20468844562e1004658c40d6b3c1c021752cfa4599e1b2

SHA512
b1b4d8537828a3d5e4c5f64e232d71fdc6dfbd969937587ea9e7686fc293382e24f4118d535ee6eb98d8578f3f68e30210ec9c73f05de0513f504665b6bcd388

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
memory/436-40-0x00000000093C0000-0x00000000093DA000-memory.dmp

Filesize
104KB

Download
memory/436-19-0x0000000007DD0000-0x0000000007E36000-memory.dmp

Filesize
408KB

Download
memory/436-24-0x00000000084E0000-0x0000000008556000-memory.dmp

Filesize
472KB

Download
memory/436-41-0x0000000009410000-0x0000000009432000-memory.dmp

Filesize
136KB

Download
memory/436-42-0x0000000009C20000-0x000000000A11E000-memory.dmp

Filesize
5.0MB

Download
memory/436-23-0x00000000087E0000-0x000000000882B000-memory.dmp

Filesize
300KB

Download
memory/436-22-0x0000000007600000-0x000000000761C000-memory.dmp

Filesize
112KB

Download
memory/436-21-0x0000000007EB0000-0x0000000008200000-memory.dmp

Filesize
3.3MB

Download
memory/436-16-0x0000000004A50000-0x0000000004A86000-memory.dmp

Filesize
216KB

Download
memory/436-17-0x00000000076A0000-0x0000000007CC8000-memory.dmp

Filesize
6.2MB

Download
memory/436-18-0x00000000074D0000-0x00000000074F2000-memory.dmp

Filesize
136KB

Download
memory/436-39-0x0000000009680000-0x0000000009714000-memory.dmp

Filesize
592KB

Download
memory/436-20-0x0000000007E40000-0x0000000007EA6000-memory.dmp

Filesize
408KB

Download
memory/1616-76-0x00000000093A0000-0x0000000009445000-memory.dmp

Filesize
660KB

Download
memory/1616-273-0x0000000009520000-0x000000000953A000-memory.dmp

Filesize
104KB

Download
memory/1616-278-0x0000000009510000-0x0000000009518000-memory.dmp

Filesize
32KB

Download
memory/1616-71-0x0000000009240000-0x000000000925E000-memory.dmp

Filesize
120KB

Download
memory/1616-70-0x000000006F610000-0x000000006F65B000-memory.dmp

Filesize
300KB

Download
memory/1616-69-0x0000000009260000-0x0000000009293000-memory.dmp

Filesize
204KB

Download
memory/2432-346-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-348-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-4267-0x000000000A490000-0x000000000A4E4000-memory.dmp

Filesize
336KB

Download
memory/2432-4261-0x0000000009CE0000-0x0000000009D36000-memory.dmp

Filesize
344KB

Download
memory/2432-4262-0x0000000009D40000-0x0000000009D8C000-memory.dmp

Filesize
304KB

Download
memory/2432-320-0x0000000009A10000-0x0000000009AE4000-memory.dmp

Filesize
848KB

Download
memory/2432-354-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-356-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-374-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-372-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-370-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-368-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-366-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-364-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-362-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-360-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-358-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-352-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-350-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-319-0x0000000005420000-0x00000000054C4000-memory.dmp

Filesize
656KB

Download
memory/2432-342-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-344-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-340-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-338-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-336-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-334-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-332-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-330-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-328-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-326-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-324-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-322-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/2432-321-0x0000000009A10000-0x0000000009ADF000-memory.dmp

Filesize
828KB

Download
memory/3324-310-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/3324-306-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/3324-308-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/3324-316-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/3324-313-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/3324-307-0x0000000010000000-0x000000001045A000-memory.dmp

Filesize
4.4MB

Download
memory/5376-4286-0x0000000004AE0000-0x0000000004B84000-memory.dmp

Filesize
656KB

Download