Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 17:48
Static task
static1
Behavioral task
behavioral1
Sample
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
Resource
win10v20201028
General
-
Target
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe
-
Size
265KB
-
MD5
b256c9ca1a41c2df7c8a26e1f142b89b
-
SHA1
ba3ca7e832774387b13b743b1bf7fe478412c55e
-
SHA256
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
-
SHA512
c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
Malware Config
Extracted
C:\Users\Admin\Documents\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.cab/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.nu/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.link/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.tor2web.org/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion/42AB-249C-D250-0000-02E0
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/42AB-249C-D250-0000-02E0(Get
http://bqyjebfh25oellur.onion.cab/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.nu/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.link/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.tor2web.org/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion.to/42AB-249C-D250-0000-02E0);
http://bqyjebfh25oellur.onion.to/42AB-249C-D250-0000-02E0
http://bqyjebfh25oellur.onion/42AB-249C-D250-0000-02E0
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" dnscacheugc.exe -
Executes dropped EXE 2 IoCs
Processes:
dnscacheugc.exednscacheugc.exepid process 1468 dnscacheugc.exe 328 dnscacheugc.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dnscacheugc.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff dnscacheugc.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1200 cmd.exe -
Drops startup file 2 IoCs
Processes:
dnscacheugc.exe60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dnscacheugc.lnk dnscacheugc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dnscacheugc.lnk 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe -
Loads dropped DLL 2 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exepid process 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe 1468 dnscacheugc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\dnscacheugc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dnscacheugc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run dnscacheugc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\dnscacheugc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" dnscacheugc.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce dnscacheugc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dnscacheugc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" dnscacheugc.exe -
Processes:
dnscacheugc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dnscacheugc.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
dnscacheugc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp400C.bmp" dnscacheugc.exe -
Drops file in Program Files directory 15 IoCs
Processes:
dnscacheugc.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE dnscacheugc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini dnscacheugc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml dnscacheugc.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1972 taskkill.exe 2152 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop dnscacheugc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\dnscacheugc.exe\"" dnscacheugc.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{366C3131-2203-11EB-8489-EE45CAFA0C11} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36141E51-2203-11EB-8489-EE45CAFA0C11} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000027f8571fae3be94c937621def8ef1d383aea5d12f8aeb344920147faee59270b000000000e8000000002000020000000c9ca4f48540bf823c45a7c104611ab8d2a2b5efb944e2d394fa983c5e4fe74f6900000008bead411bc5c92baf6e418509a24acb12ecb6aada694ba8a83794854c19550def3294decc6aa490aa127e648992a5e17f5a83183d4789b9a5d5e4cfd68dfa9815c0fa54309d8ea8d7f0694f42ffb0c83d851a7978238b5188c372066a887d5c4947b8eee4c60fb7bc5f15adfb3321c88bcc9005be68bfcbf1dd52a2d329565e702f57d0275464e7c254f12df954c149c400000000da1e4ed643af9a4dce432c66299e5163796a2618eb13ee97a2c3b561ca9527fba48a0a9f21d6eb13928e4f2efafd9d1ef00729481b6a47f8b13127bd2460025 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311633250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02dd9fa0fb6d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000049345346c4f50c731967c7ecb0df70cf4111fbdd68dcb1a52a488a51903b620d000000000e8000000002000020000000d0073f343960ddfc0881469369759dc2a52c3624ea73d2d09f3ef2bdd213911b2000000014c3fa507ddb3274c1b93f5be6bc85a498f592de1bd08a9c45465e0c520679bf40000000c56f0c85566418d333a5af3a17e28a66d46df42bc1b9760df199bd0e779af921a99f9f7effcc21fd7ab27f6264729d6539d5e32fc9e862a294bcdda5cfc403e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 270 IoCs
Processes:
dnscacheugc.exepid process 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe 1468 dnscacheugc.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exetaskkill.exednscacheugc.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe Token: SeDebugPrivilege 1468 dnscacheugc.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 328 dnscacheugc.exe Token: 33 876 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 876 AUDIODG.EXE Token: 33 876 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 876 AUDIODG.EXE Token: SeDebugPrivilege 2152 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1848 iexplore.exe 1652 iexplore.exe 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1848 iexplore.exe 1652 iexplore.exe 1652 iexplore.exe 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE 604 IEXPLORE.EXE 604 IEXPLORE.EXE 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exednscacheugc.exednscacheugc.exepid process 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe 1468 dnscacheugc.exe 328 dnscacheugc.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.execmd.exetaskeng.exednscacheugc.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1848 wrote to memory of 1468 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dnscacheugc.exe PID 1848 wrote to memory of 1468 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dnscacheugc.exe PID 1848 wrote to memory of 1468 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dnscacheugc.exe PID 1848 wrote to memory of 1468 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe dnscacheugc.exe PID 1848 wrote to memory of 1200 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 1848 wrote to memory of 1200 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 1848 wrote to memory of 1200 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 1848 wrote to memory of 1200 1848 60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe cmd.exe PID 1200 wrote to memory of 1972 1200 cmd.exe taskkill.exe PID 1200 wrote to memory of 1972 1200 cmd.exe taskkill.exe PID 1200 wrote to memory of 1972 1200 cmd.exe taskkill.exe PID 1200 wrote to memory of 1972 1200 cmd.exe taskkill.exe PID 1200 wrote to memory of 1436 1200 cmd.exe PING.EXE PID 1200 wrote to memory of 1436 1200 cmd.exe PING.EXE PID 1200 wrote to memory of 1436 1200 cmd.exe PING.EXE PID 1200 wrote to memory of 1436 1200 cmd.exe PING.EXE PID 1088 wrote to memory of 328 1088 taskeng.exe dnscacheugc.exe PID 1088 wrote to memory of 328 1088 taskeng.exe dnscacheugc.exe PID 1088 wrote to memory of 328 1088 taskeng.exe dnscacheugc.exe PID 1088 wrote to memory of 328 1088 taskeng.exe dnscacheugc.exe PID 1468 wrote to memory of 1848 1468 dnscacheugc.exe iexplore.exe PID 1468 wrote to memory of 1848 1468 dnscacheugc.exe iexplore.exe PID 1468 wrote to memory of 1848 1468 dnscacheugc.exe iexplore.exe PID 1468 wrote to memory of 1848 1468 dnscacheugc.exe iexplore.exe PID 1468 wrote to memory of 1900 1468 dnscacheugc.exe NOTEPAD.EXE PID 1468 wrote to memory of 1900 1468 dnscacheugc.exe NOTEPAD.EXE PID 1468 wrote to memory of 1900 1468 dnscacheugc.exe NOTEPAD.EXE PID 1468 wrote to memory of 1900 1468 dnscacheugc.exe NOTEPAD.EXE PID 1848 wrote to memory of 1268 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 1268 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 1268 1848 iexplore.exe IEXPLORE.EXE PID 1848 wrote to memory of 1268 1848 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 604 1652 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 604 1652 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 604 1652 iexplore.exe IEXPLORE.EXE PID 1652 wrote to memory of 604 1652 iexplore.exe IEXPLORE.EXE PID 1468 wrote to memory of 952 1468 dnscacheugc.exe WScript.exe PID 1468 wrote to memory of 952 1468 dnscacheugc.exe WScript.exe PID 1468 wrote to memory of 952 1468 dnscacheugc.exe WScript.exe PID 1468 wrote to memory of 952 1468 dnscacheugc.exe WScript.exe PID 1468 wrote to memory of 2116 1468 dnscacheugc.exe cmd.exe PID 1468 wrote to memory of 2116 1468 dnscacheugc.exe cmd.exe PID 1468 wrote to memory of 2116 1468 dnscacheugc.exe cmd.exe PID 1468 wrote to memory of 2116 1468 dnscacheugc.exe cmd.exe PID 2116 wrote to memory of 2152 2116 cmd.exe taskkill.exe PID 2116 wrote to memory of 2152 2116 cmd.exe taskkill.exe PID 2116 wrote to memory of 2152 2116 cmd.exe taskkill.exe PID 2116 wrote to memory of 2272 2116 cmd.exe PING.EXE PID 2116 wrote to memory of 2272 2116 cmd.exe PING.EXE PID 2116 wrote to memory of 2272 2116 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exe"C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "dnscacheugc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "dnscacheugc.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "60d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {9F0CC04D-BB9D-4A99-B230-179FDD31B2E5} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeC:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
5e77ce496cdf5fdc1db7f7729a844a54
SHA1c0f7ed35c7c9f9c489e550ed6204d44774b998fb
SHA25612a0565645f7789d864f2c51641d10e515b205e18dce39e9b184511ab9aa10fe
SHA5125067a0394cca619b6813d1d70b0f70c5ac991aa0830eda50a2984ccdb6c8ff84f1533125bbc9394be94c933f4fe74c5bdfd3453ae6a6ce6580ef83b3c2707c13
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{36141E51-2203-11EB-8489-EE45CAFA0C11}.datMD5
b5d3f9f2c89ee65aeeb3cb64a1ede2d9
SHA14592fd9721d62c67869a6941ffe30a11d3891c23
SHA256116dbe47547b3151a9dabb34423b2d4b3065611713a2087425327d0c226a4b69
SHA5120c4305e12383a6dc099a4729090771b160e63772e4745aa01108cdf8a7a398ac76ca0786c2db798a2cf0be30e01312040de87afed2ab8c4757ad1ddc6167e826
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\98F328UR.txtMD5
9b23fc41826ee2d3f9d3c1dc56b4f4e0
SHA1b6968528bc34c110c33aea1a4332c442995ff358
SHA2565537abe55ff33a5511312f73043ec82a375990ee928e69ab9afbb24b2365be0a
SHA5123f3ca1915a467bfc3486efaf38f26701e5a15b2077f67cf95a3c7faa6db79ea02a9a6c45fa7ca97fd18a19a165bddf6e895998e94fb8126887ff3e870612ac86
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dnscacheugc.lnkMD5
2769b766e668d77a6d7593e87bc29ea2
SHA175dfa3c76548968bc66c9d9f7a89f8b8a48abdd8
SHA256aad5d1542898bbd2045e4ee03a156831779bd8502bd1c8175a5b98a5fc0ba6c3
SHA512f333e4d0be5e5e9cb8181a0d8966778cb1b3b0b34be7543d7e0577f8c904719a659717ab92fb9a98940223a0ca22f1bec89b90c266fd6d5adf0fa50c80bd1910
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
21c44af46dc2ae6f22f3c942513d7133
SHA128a97488f0c6fc9433834b1ee25e22a6b4bd07df
SHA25655c23fb0b8b663d8be7218480762e37cd8a732b0da963c536401a5427c694e9b
SHA512a1090a5ba8dcb960b4413169782f8f61b9833e2de950a92ceeba17c4d61e5f8138676a1a405f28af7423c2e037e6318a73dcbc6814e16851b407ffcdd5bf4d7a
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
529effd92f242a361b09e88d4b29e9c0
SHA1096433f4334f9b9a7d31a8f8a42afd628ad54f95
SHA25673efa77f346b91724aacd0d3decdcabaafb20b68399fb0e7d6b2b511b444a9ae
SHA5125aa6ccdc2e8b7aacf20999f23206ff7f64b1812b2aac42ce87f6018ec0ab02fe915eeab00299cf4de13ce939c9a88b82f37e04adb1152eb459ccaf4233b16161
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.urlMD5
0c05b2410393a95072817f3e514ee15f
SHA18d67d60d3ca650555949a8cca2882bcff2151d91
SHA25600b12b9b602655814ea14943245a3669bf9cfca96836618ba3858a41a0468abc
SHA512cf4f932a79fcb1b210cfa4ebbff9eb08c391aeafe7ef23817c8d59ac54eb595a54c3c0027217e7da3fce1b0585d823353e4dcf6fd2ea8872ce73382d45bad196
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\dnscacheugc.exeMD5
b256c9ca1a41c2df7c8a26e1f142b89b
SHA1ba3ca7e832774387b13b743b1bf7fe478412c55e
SHA25660d73258ca23674507f4a882a2c49faa648975e9ed810d9a93d49e6de207b060
SHA512c587185bf7b9fdc8c08c5ee066d3d997b2d15d1f24300cbcf77b050409cfa7b1630fc5d491ebd6904ba7949b76ea0b9f435107735bd3cb1bd489f10650bb9b55
-
memory/328-9-0x0000000000000000-mapping.dmp
-
memory/604-16-0x0000000000000000-mapping.dmp
-
memory/952-20-0x0000000000000000-mapping.dmp
-
memory/1200-3-0x0000000000000000-mapping.dmp
-
memory/1268-15-0x0000000000000000-mapping.dmp
-
memory/1436-7-0x0000000000000000-mapping.dmp
-
memory/1468-1-0x0000000000000000-mapping.dmp
-
memory/1784-6-0x000007FEF6680000-0x000007FEF68FA000-memory.dmpFilesize
2.5MB
-
memory/1848-12-0x0000000000000000-mapping.dmp
-
memory/1900-13-0x0000000000000000-mapping.dmp
-
memory/1972-4-0x0000000000000000-mapping.dmp
-
memory/2116-25-0x0000000000000000-mapping.dmp
-
memory/2152-26-0x0000000000000000-mapping.dmp
-
memory/2272-32-0x0000000000000000-mapping.dmp