57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717

Analysis

max time kernel
106s
max time network
93s
platform
windows7_x64
resource
win7
submitted
29/06/2020, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
Size 1.8MB
Sample200629-e8pm4k4cx2
SHA256 57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717
MD5 2dbbe1a3dae461e1616d37c91a1b0e2f
SHA1 76b407be6ad6a4ec4ae71cdc4440e3d51b28cd9b
SHA512 d4b7fe4b68f9caf93ee98507f1018226b05a5891314ea2000b6116024e1d3847a298b3c0f2fca09dea0ff05a3b89f1cb567d91dd8d11d5c86f827596932b18a8
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 set thread context of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1808 set thread context of 1656	1808	explorer.exe	29
PID 1808 set thread context of 1664	1808	explorer.exe	30

Loads dropped DLL 102 IoCs

pid	Process
1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe

Executes dropped EXE 52 IoCs

pid	Process
1808	explorer.exe
1656	explorer.exe
1168	spoolsv.exe
2020	spoolsv.exe
1180	spoolsv.exe
1636	spoolsv.exe
1640	spoolsv.exe
592	spoolsv.exe
1036	spoolsv.exe
1084	spoolsv.exe
1520	spoolsv.exe
1820	spoolsv.exe
1812	spoolsv.exe
1740	spoolsv.exe
1532	spoolsv.exe
1900	spoolsv.exe
1652	spoolsv.exe
2036	spoolsv.exe
1344	spoolsv.exe
2044	spoolsv.exe
1404	spoolsv.exe
828	spoolsv.exe
1504	spoolsv.exe
1564	spoolsv.exe
1384	spoolsv.exe
1840	spoolsv.exe
396	spoolsv.exe
1916	spoolsv.exe
700	spoolsv.exe
992	spoolsv.exe
2040	spoolsv.exe
816	spoolsv.exe
1380	spoolsv.exe
636	spoolsv.exe
1700	spoolsv.exe
1708	spoolsv.exe
1912	spoolsv.exe
1888	spoolsv.exe
756	spoolsv.exe
1216	spoolsv.exe
812	spoolsv.exe
1472	spoolsv.exe
1784	spoolsv.exe
1184	spoolsv.exe
1172	spoolsv.exe
1796	spoolsv.exe
272	spoolsv.exe
368	spoolsv.exe
1880	spoolsv.exe
1876	spoolsv.exe
584	spoolsv.exe
2068	spoolsv.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Suspicious use of WriteProcessMemory 234 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1044	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	24
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1152 wrote to memory of 1508	1152	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	25
PID 1044 wrote to memory of 1808	1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	26
PID 1044 wrote to memory of 1808	1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	26
PID 1044 wrote to memory of 1808	1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	26
PID 1044 wrote to memory of 1808	1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	26
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1656	1808	explorer.exe	29
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1808 wrote to memory of 1664	1808	explorer.exe	30
PID 1656 wrote to memory of 1168	1656	explorer.exe	31
PID 1656 wrote to memory of 1168	1656	explorer.exe	31
PID 1656 wrote to memory of 1168	1656	explorer.exe	31
PID 1656 wrote to memory of 1168	1656	explorer.exe	31
PID 1656 wrote to memory of 2020	1656	explorer.exe	32
PID 1656 wrote to memory of 2020	1656	explorer.exe	32
PID 1656 wrote to memory of 2020	1656	explorer.exe	32
PID 1656 wrote to memory of 2020	1656	explorer.exe	32
PID 1656 wrote to memory of 1180	1656	explorer.exe	33
PID 1656 wrote to memory of 1180	1656	explorer.exe	33
PID 1656 wrote to memory of 1180	1656	explorer.exe	33
PID 1656 wrote to memory of 1180	1656	explorer.exe	33
PID 1656 wrote to memory of 1636	1656	explorer.exe	34
PID 1656 wrote to memory of 1636	1656	explorer.exe	34
PID 1656 wrote to memory of 1636	1656	explorer.exe	34
PID 1656 wrote to memory of 1636	1656	explorer.exe	34
PID 1656 wrote to memory of 1640	1656	explorer.exe	35
PID 1656 wrote to memory of 1640	1656	explorer.exe	35
PID 1656 wrote to memory of 1640	1656	explorer.exe	35
PID 1656 wrote to memory of 1640	1656	explorer.exe	35
PID 1656 wrote to memory of 592	1656	explorer.exe	36
PID 1656 wrote to memory of 592	1656	explorer.exe	36
PID 1656 wrote to memory of 592	1656	explorer.exe	36
PID 1656 wrote to memory of 592	1656	explorer.exe	36
PID 1656 wrote to memory of 1036	1656	explorer.exe	37
PID 1656 wrote to memory of 1036	1656	explorer.exe	37
PID 1656 wrote to memory of 1036	1656	explorer.exe	37
PID 1656 wrote to memory of 1036	1656	explorer.exe	37
PID 1656 wrote to memory of 1084	1656	explorer.exe	38
PID 1656 wrote to memory of 1084	1656	explorer.exe	38
PID 1656 wrote to memory of 1084	1656	explorer.exe	38
PID 1656 wrote to memory of 1084	1656	explorer.exe	38
PID 1656 wrote to memory of 1520	1656	explorer.exe	39
PID 1656 wrote to memory of 1520	1656	explorer.exe	39
PID 1656 wrote to memory of 1520	1656	explorer.exe	39
PID 1656 wrote to memory of 1520	1656	explorer.exe	39
PID 1656 wrote to memory of 1820	1656	explorer.exe	40
PID 1656 wrote to memory of 1820	1656	explorer.exe	40
PID 1656 wrote to memory of 1820	1656	explorer.exe	40
PID 1656 wrote to memory of 1820	1656	explorer.exe	40
PID 1656 wrote to memory of 1812	1656	explorer.exe	41
PID 1656 wrote to memory of 1812	1656	explorer.exe	41
PID 1656 wrote to memory of 1812	1656	explorer.exe	41
PID 1656 wrote to memory of 1812	1656	explorer.exe	41
PID 1656 wrote to memory of 1740	1656	explorer.exe	42
PID 1656 wrote to memory of 1740	1656	explorer.exe	42
PID 1656 wrote to memory of 1740	1656	explorer.exe	42
PID 1656 wrote to memory of 1740	1656	explorer.exe	42
PID 1656 wrote to memory of 1532	1656	explorer.exe	43
PID 1656 wrote to memory of 1532	1656	explorer.exe	43
PID 1656 wrote to memory of 1532	1656	explorer.exe	43
PID 1656 wrote to memory of 1532	1656	explorer.exe	43
PID 1656 wrote to memory of 1900	1656	explorer.exe	44
PID 1656 wrote to memory of 1900	1656	explorer.exe	44
PID 1656 wrote to memory of 1900	1656	explorer.exe	44
PID 1656 wrote to memory of 1900	1656	explorer.exe	44
PID 1656 wrote to memory of 1652	1656	explorer.exe	45
PID 1656 wrote to memory of 1652	1656	explorer.exe	45
PID 1656 wrote to memory of 1652	1656	explorer.exe	45
PID 1656 wrote to memory of 1652	1656	explorer.exe	45
PID 1656 wrote to memory of 2036	1656	explorer.exe	46
PID 1656 wrote to memory of 2036	1656	explorer.exe	46
PID 1656 wrote to memory of 2036	1656	explorer.exe	46
PID 1656 wrote to memory of 2036	1656	explorer.exe	46
PID 1656 wrote to memory of 1344	1656	explorer.exe	47
PID 1656 wrote to memory of 1344	1656	explorer.exe	47
PID 1656 wrote to memory of 1344	1656	explorer.exe	47
PID 1656 wrote to memory of 1344	1656	explorer.exe	47
PID 1656 wrote to memory of 2044	1656	explorer.exe	48
PID 1656 wrote to memory of 2044	1656	explorer.exe	48
PID 1656 wrote to memory of 2044	1656	explorer.exe	48
PID 1656 wrote to memory of 2044	1656	explorer.exe	48
PID 1656 wrote to memory of 1404	1656	explorer.exe	49
PID 1656 wrote to memory of 1404	1656	explorer.exe	49
PID 1656 wrote to memory of 1404	1656	explorer.exe	49
PID 1656 wrote to memory of 1404	1656	explorer.exe	49
PID 1656 wrote to memory of 828	1656	explorer.exe	50
PID 1656 wrote to memory of 828	1656	explorer.exe	50
PID 1656 wrote to memory of 828	1656	explorer.exe	50
PID 1656 wrote to memory of 828	1656	explorer.exe	50
PID 1656 wrote to memory of 1504	1656	explorer.exe	51
PID 1656 wrote to memory of 1504	1656	explorer.exe	51
PID 1656 wrote to memory of 1504	1656	explorer.exe	51
PID 1656 wrote to memory of 1504	1656	explorer.exe	51
PID 1656 wrote to memory of 1564	1656	explorer.exe	52
PID 1656 wrote to memory of 1564	1656	explorer.exe	52
PID 1656 wrote to memory of 1564	1656	explorer.exe	52
PID 1656 wrote to memory of 1564	1656	explorer.exe	52
PID 1656 wrote to memory of 1384	1656	explorer.exe	53
PID 1656 wrote to memory of 1384	1656	explorer.exe	53
PID 1656 wrote to memory of 1384	1656	explorer.exe	53
PID 1656 wrote to memory of 1384	1656	explorer.exe	53
PID 1656 wrote to memory of 1840	1656	explorer.exe	54
PID 1656 wrote to memory of 1840	1656	explorer.exe	54
PID 1656 wrote to memory of 1840	1656	explorer.exe	54
PID 1656 wrote to memory of 1840	1656	explorer.exe	54
PID 1656 wrote to memory of 396	1656	explorer.exe	55
PID 1656 wrote to memory of 396	1656	explorer.exe	55
PID 1656 wrote to memory of 396	1656	explorer.exe	55
PID 1656 wrote to memory of 396	1656	explorer.exe	55
PID 1656 wrote to memory of 1916	1656	explorer.exe	56
PID 1656 wrote to memory of 1916	1656	explorer.exe	56
PID 1656 wrote to memory of 1916	1656	explorer.exe	56
PID 1656 wrote to memory of 1916	1656	explorer.exe	56
PID 1656 wrote to memory of 700	1656	explorer.exe	57
PID 1656 wrote to memory of 700	1656	explorer.exe	57
PID 1656 wrote to memory of 700	1656	explorer.exe	57
PID 1656 wrote to memory of 700	1656	explorer.exe	57
PID 1656 wrote to memory of 992	1656	explorer.exe	58
PID 1656 wrote to memory of 992	1656	explorer.exe	58
PID 1656 wrote to memory of 992	1656	explorer.exe	58
PID 1656 wrote to memory of 992	1656	explorer.exe	58
PID 1656 wrote to memory of 2040	1656	explorer.exe	59
PID 1656 wrote to memory of 2040	1656	explorer.exe	59
PID 1656 wrote to memory of 2040	1656	explorer.exe	59
PID 1656 wrote to memory of 2040	1656	explorer.exe	59
PID 1656 wrote to memory of 816	1656	explorer.exe	60
PID 1656 wrote to memory of 816	1656	explorer.exe	60
PID 1656 wrote to memory of 816	1656	explorer.exe	60
PID 1656 wrote to memory of 816	1656	explorer.exe	60
PID 1656 wrote to memory of 1380	1656	explorer.exe	61
PID 1656 wrote to memory of 1380	1656	explorer.exe	61
PID 1656 wrote to memory of 1380	1656	explorer.exe	61
PID 1656 wrote to memory of 1380	1656	explorer.exe	61
PID 1656 wrote to memory of 636	1656	explorer.exe	62
PID 1656 wrote to memory of 636	1656	explorer.exe	62
PID 1656 wrote to memory of 636	1656	explorer.exe	62
PID 1656 wrote to memory of 636	1656	explorer.exe	62
PID 1656 wrote to memory of 1700	1656	explorer.exe	63
PID 1656 wrote to memory of 1700	1656	explorer.exe	63
PID 1656 wrote to memory of 1700	1656	explorer.exe	63
PID 1656 wrote to memory of 1700	1656	explorer.exe	63
PID 1656 wrote to memory of 1708	1656	explorer.exe	64
PID 1656 wrote to memory of 1708	1656	explorer.exe	64
PID 1656 wrote to memory of 1708	1656	explorer.exe	64
PID 1656 wrote to memory of 1708	1656	explorer.exe	64
PID 1656 wrote to memory of 1912	1656	explorer.exe	65
PID 1656 wrote to memory of 1912	1656	explorer.exe	65
PID 1656 wrote to memory of 1912	1656	explorer.exe	65
PID 1656 wrote to memory of 1912	1656	explorer.exe	65
PID 1656 wrote to memory of 1888	1656	explorer.exe	66
PID 1656 wrote to memory of 1888	1656	explorer.exe	66
PID 1656 wrote to memory of 1888	1656	explorer.exe	66
PID 1656 wrote to memory of 1888	1656	explorer.exe	66
PID 1656 wrote to memory of 756	1656	explorer.exe	67
PID 1656 wrote to memory of 756	1656	explorer.exe	67
PID 1656 wrote to memory of 756	1656	explorer.exe	67
PID 1656 wrote to memory of 756	1656	explorer.exe	67
PID 1656 wrote to memory of 1216	1656	explorer.exe	68
PID 1656 wrote to memory of 1216	1656	explorer.exe	68
PID 1656 wrote to memory of 1216	1656	explorer.exe	68
PID 1656 wrote to memory of 1216	1656	explorer.exe	68
PID 1656 wrote to memory of 812	1656	explorer.exe	69
PID 1656 wrote to memory of 812	1656	explorer.exe	69
PID 1656 wrote to memory of 812	1656	explorer.exe	69
PID 1656 wrote to memory of 812	1656	explorer.exe	69
PID 1656 wrote to memory of 1472	1656	explorer.exe	70
PID 1656 wrote to memory of 1472	1656	explorer.exe	70
PID 1656 wrote to memory of 1472	1656	explorer.exe	70
PID 1656 wrote to memory of 1472	1656	explorer.exe	70
PID 1656 wrote to memory of 1784	1656	explorer.exe	71
PID 1656 wrote to memory of 1784	1656	explorer.exe	71
PID 1656 wrote to memory of 1784	1656	explorer.exe	71
PID 1656 wrote to memory of 1784	1656	explorer.exe	71
PID 1656 wrote to memory of 1184	1656	explorer.exe	72
PID 1656 wrote to memory of 1184	1656	explorer.exe	72
PID 1656 wrote to memory of 1184	1656	explorer.exe	72
PID 1656 wrote to memory of 1184	1656	explorer.exe	72
PID 1656 wrote to memory of 1172	1656	explorer.exe	73
PID 1656 wrote to memory of 1172	1656	explorer.exe	73
PID 1656 wrote to memory of 1172	1656	explorer.exe	73
PID 1656 wrote to memory of 1172	1656	explorer.exe	73
PID 1656 wrote to memory of 1796	1656	explorer.exe	74
PID 1656 wrote to memory of 1796	1656	explorer.exe	74
PID 1656 wrote to memory of 1796	1656	explorer.exe	74
PID 1656 wrote to memory of 1796	1656	explorer.exe	74
PID 1656 wrote to memory of 272	1656	explorer.exe	75
PID 1656 wrote to memory of 272	1656	explorer.exe	75
PID 1656 wrote to memory of 272	1656	explorer.exe	75
PID 1656 wrote to memory of 272	1656	explorer.exe	75
PID 1656 wrote to memory of 368	1656	explorer.exe	76
PID 1656 wrote to memory of 368	1656	explorer.exe	76
PID 1656 wrote to memory of 368	1656	explorer.exe	76
PID 1656 wrote to memory of 368	1656	explorer.exe	76
PID 1656 wrote to memory of 1880	1656	explorer.exe	77
PID 1656 wrote to memory of 1880	1656	explorer.exe	77
PID 1656 wrote to memory of 1880	1656	explorer.exe	77
PID 1656 wrote to memory of 1880	1656	explorer.exe	77
PID 1656 wrote to memory of 1876	1656	explorer.exe	78
PID 1656 wrote to memory of 1876	1656	explorer.exe	78
PID 1656 wrote to memory of 1876	1656	explorer.exe	78
PID 1656 wrote to memory of 1876	1656	explorer.exe	78
PID 1656 wrote to memory of 584	1656	explorer.exe	79
PID 1656 wrote to memory of 584	1656	explorer.exe	79
PID 1656 wrote to memory of 584	1656	explorer.exe	79
PID 1656 wrote to memory of 584	1656	explorer.exe	79
PID 1656 wrote to memory of 2068	1656	explorer.exe	80
PID 1656 wrote to memory of 2068	1656	explorer.exe	80
PID 1656 wrote to memory of 2068	1656	explorer.exe	80
PID 1656 wrote to memory of 2068	1656	explorer.exe	80

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1044	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe
1656	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
"C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe"
1⤵
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
  "C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Adds Run entry to start application
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Loads dropped DLL
      Executes dropped EXE
      Adds Run entry to start application
      Drops file in Windows directory
      Modifies WinLogon for persistence
      Modifies Installed Components in the registry
      Suspicious use of WriteProcessMemory
      Suspicious use of SetWindowsHookEx
      Suspicious behavior: EnumeratesProcesses
      Modifies the visibility of hidden or system files
      PID:1656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2068
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1664
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-17-0x0000000001DA0000-0x0000000001DA4000-memory.dmp

Download

memory/1044-12-0x0000000002D90000-0x0000000002DA1000-memory.dmp

Download

memory/1044-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1044-18-0x00000000025D0000-0x00000000025D4000-memory.dmp

Download

memory/1044-10-0x00000000031A0000-0x00000000031B1000-memory.dmp

Download

memory/1044-9-0x0000000002D90000-0x0000000002DA1000-memory.dmp

Download

memory/1044-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1508-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1508-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1656-110-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-142-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-270-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-271-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-262-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-255-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-254-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-279-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-278-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-247-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-246-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-239-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-238-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-286-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-287-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-423-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-231-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-422-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-230-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-294-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-295-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-223-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-222-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-36-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-37-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-302-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-303-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-215-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-214-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-38-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-207-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-310-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-311-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-206-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-199-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-39-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-198-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-318-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-319-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-191-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-190-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-183-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-182-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-326-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-327-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-175-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-174-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-415-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-167-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-334-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-335-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-166-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-159-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-158-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-414-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-342-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-343-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-150-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-151-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-143-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-263-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-350-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-351-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-46-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-135-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-134-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-47-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-358-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-359-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-127-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-126-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-407-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-119-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-366-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-367-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-118-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-406-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-111-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-54-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-374-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-375-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-103-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-102-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-55-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-95-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-382-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-383-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-94-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-86-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-87-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-79-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-390-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-391-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-78-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-71-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-70-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-63-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-398-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download

memory/1656-399-0x0000000003050000-0x0000000003061000-memory.dmp

Download

memory/1656-62-0x0000000002C40000-0x0000000002C51000-memory.dmp

Download