isrstealer | 3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469b

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Size

389KB
MD5

7b8ca19e8b7133aa8de06bc67e686330
SHA1

f347e1868be50a71042d9498955bc9ce48fef47a
SHA256

3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469b
SHA512

b4fd99b080d780d127e9384b52f78e309a4efd38aaa870f8fb52ca896db4c3c12cc581aac11a75ff8de8ddade43dffc76e38b99b8623fbda906bfcb637d6de62
SSDEEP

6144:JtEVpyJD+zjjSKDCmSam8xOPC4sOwMrSWtDYR3x0/9Yz1i:JtEVpyJyzjjJ4aBmCQr50uF

Score

10^/10

isrstealer collection discovery spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1040-8-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1040-10-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1040-13-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1040-39-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/5108-35-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/3484-52-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4612-92-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/3928-106-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5108-35-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/3484-52-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4612-92-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/3928-106-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	udpsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ntfsmgr.exe

Executes dropped EXE 18 IoCs

pid	Process
4636	udpsvc.exe
1520	ntfsmgr.exe
4004	ntfsmgr.exe
3420	ntfsmgr.exe
4676	udpsvc.exe
3660	ntfsmgr.exe
4372	ntfsmgr.exe
3560	ntfsmgr.exe
3928	ntfsmgr.exe
4584	ntfsmgr.exe
244	ntfsmgr.exe
4108	ntfsmgr.exe
4288	ntfsmgr.exe
4524	ntfsmgr.exe
4460	ntfsmgr.exe
4412	ntfsmgr.exe
4704	ntfsmgr.exe
4888	ntfsmgr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ntfsmgr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ntfsmgr.exe
Key opened	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ntfsmgr.exe

Suspicious use of SetThreadContext 27 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 1040 set thread context of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 set thread context of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 2080 set thread context of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 3844 set thread context of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 set thread context of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 2080 set thread context of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 set thread context of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103
PID 2080 set thread context of 4064	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	104
PID 2080 set thread context of 1732	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	105
PID 1732 set thread context of 4408	1732	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	106
PID 1520 set thread context of 4004	1520	ntfsmgr.exe	107
PID 4004 set thread context of 3420	4004	ntfsmgr.exe	108
PID 1732 set thread context of 4612	1732	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	110
PID 4004 set thread context of 3660	4004	ntfsmgr.exe	111
PID 1520 set thread context of 4372	1520	ntfsmgr.exe	114
PID 4372 set thread context of 3560	4372	ntfsmgr.exe	115
PID 4372 set thread context of 3928	4372	ntfsmgr.exe	118
PID 1520 set thread context of 4584	1520	ntfsmgr.exe	119
PID 4584 set thread context of 244	4584	ntfsmgr.exe	120
PID 4584 set thread context of 4108	4584	ntfsmgr.exe	121
PID 1520 set thread context of 4288	1520	ntfsmgr.exe	122
PID 4288 set thread context of 4524	4288	ntfsmgr.exe	123
PID 4288 set thread context of 4460	4288	ntfsmgr.exe	124
PID 1520 set thread context of 4412	1520	ntfsmgr.exe	125
PID 1520 set thread context of 4704	1520	ntfsmgr.exe	126
PID 1520 set thread context of 4888	1520	ntfsmgr.exe	127

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5108-33-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5108-34-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5108-35-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3892-44-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3892-46-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3892-45-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3484-51-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3484-52-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3420-76-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3420-75-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4612-91-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4612-92-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3928-106-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3928-105-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4048	1876	WerFault.exe	90
392	3660	WerFault.exe	111
1644	3560	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	udpsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	udpsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntfsmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe
4636	udpsvc.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4636	udpsvc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
Token: SeDebugPrivilege	4636	udpsvc.exe
Token: SeDebugPrivilege	1520	ntfsmgr.exe
Token: SeDebugPrivilege	4676	udpsvc.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
1732	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
4004	ntfsmgr.exe
4372	ntfsmgr.exe
4584	ntfsmgr.exe
4288	ntfsmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 2080 wrote to memory of 1040	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	89
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 1040 wrote to memory of 1876	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	90
PID 2080 wrote to memory of 4636	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	93
PID 2080 wrote to memory of 4636	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	93
PID 2080 wrote to memory of 4636	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	93
PID 4636 wrote to memory of 1520	4636	udpsvc.exe	95
PID 4636 wrote to memory of 1520	4636	udpsvc.exe	95
PID 4636 wrote to memory of 1520	4636	udpsvc.exe	95
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 1040 wrote to memory of 5108	1040	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	98
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 2080 wrote to memory of 3844	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	99
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3892	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	100
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 3844 wrote to memory of 3484	3844	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	101
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1692	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	102
PID 2080 wrote to memory of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103
PID 2080 wrote to memory of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103
PID 2080 wrote to memory of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103
PID 2080 wrote to memory of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103
PID 2080 wrote to memory of 1572	2080	3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe	103

C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
"C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\JPPyBpH9b2.ini"
    3⤵
    PID:1876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 80
      4⤵
      Program crash
      PID:4048
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tmadILoVIi.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:5108
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\udpsvc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\udpsvc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uCMEFBYOfO.ini"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3420
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\nhxArI6GAi.ini"
        5⤵
        Executes dropped EXE
        
        PID:3660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 80
        6⤵
        Program crash
        
        PID:392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\udpsvc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\udpsvc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\y3b42rJh5E.ini"
        5⤵
        Executes dropped EXE
        
        PID:3560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 80
        6⤵
        Program crash
        
        PID:1644
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\HZRVM4oxfZ.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3928
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4584
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\H14U8TssvZ.ini"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:244
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\kZ8Ous54VT.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4288
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\wtq3oKhH4z.ini"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4524
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\nhy61oWzzH.ini"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4460
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      PID:4412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      PID:4704
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe"
      4⤵
      Executes dropped EXE
      PID:4888
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\3jj7aAcDCo.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\rsIVgBJzr2.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3484
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  PID:1572
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
  "C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Uaoxf3YVxe.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469bN.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\eVQ7qigu7F.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1876 -ip 1876
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3660 -ip 3660
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3560 -ip 3560
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\udpsvc.exe.log

Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3jj7aAcDCo.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ntfsmgr.exe

Filesize
389KB

MD5
7b8ca19e8b7133aa8de06bc67e686330

SHA1
f347e1868be50a71042d9498955bc9ce48fef47a

SHA256
3e38444ba9e9764335fa316410b7261f1f672e51178b3ce87f3cee7fb60e469b

SHA512
b4fd99b080d780d127e9384b52f78e309a4efd38aaa870f8fb52ca896db4c3c12cc581aac11a75ff8de8ddade43dffc76e38b99b8623fbda906bfcb637d6de62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\udpsvc.exe

Filesize
11KB

MD5
fc2e803e85d0c50ab6227dd79340f205

SHA1
122bf356ce10cb75d0a6b86ae921b9abc746487c

SHA256
6c8da53dd540f6ba029cf855d7f4e150e8fce2f43fe95e919e2205a299a1736b

SHA512
8e085f425478af443baa3d56770028ac6cd70c64e09123902f134771d5dea6bf7cb989ae83734eaa9aa43ac991e8b487376a2bcee5ed3dd3d429de10c4a19ea9

Download Submit
memory/1040-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1520-29-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/1520-30-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/1520-31-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/1520-48-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-1-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-4-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-5-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-0-0x00000000750E2000-0x00000000750E3000-memory.dmp

Filesize
4KB

Download
memory/2080-32-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-2-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-66-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/2080-3-0x00000000750E2000-0x00000000750E3000-memory.dmp

Filesize
4KB

Download
memory/3420-76-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3420-75-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3484-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3484-51-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3892-44-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3892-46-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3892-45-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3928-106-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3928-105-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4612-91-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4612-92-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4636-25-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4636-38-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4636-65-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4636-37-0x00000000750E2000-0x00000000750E3000-memory.dmp

Filesize
4KB

Download
memory/4636-36-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4636-26-0x00000000750E0000-0x0000000075691000-memory.dmp

Filesize
5.7MB

Download
memory/4636-24-0x00000000750E2000-0x00000000750E3000-memory.dmp

Filesize
4KB

Download
memory/4704-139-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5108-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5108-34-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5108-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download