Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-11-2020 23:03
Static task
static1
Behavioral task
behavioral1
Sample
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
Resource
win10v20201028
General
-
Target
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
-
Size
270KB
-
MD5
1e97fda428488834e73a9d21f45905ca
-
SHA1
349780006801787b966a14ff7b9b7d5d0872feb6
-
SHA256
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
-
SHA512
5e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
Malware Config
Extracted
C:\Users\Admin\Music\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.cab/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.nu/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.link/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.tor2web.org/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion/1128-E828-FA7D-0072-88D5
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/1128-E828-FA7D-0072-88D5(Get
http://bqyjebfh25oellur.onion.cab/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.nu/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.link/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.tor2web.org/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion.to/1128-E828-FA7D-0072-88D5);
http://bqyjebfh25oellur.onion.to/1128-E828-FA7D-0072-88D5
http://bqyjebfh25oellur.onion/1128-E828-FA7D-0072-88D5
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exesetx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" setx.exe -
Executes dropped EXE 2 IoCs
Processes:
setx.exesetx.exepid process 616 setx.exe 932 setx.exe -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
setx.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\DenyLock.tiff setx.exe File opened for modification C:\Users\Admin\Pictures\PushSet.tiff setx.exe File opened for modification C:\Users\Admin\Pictures\RestoreApprove.tiff setx.exe File opened for modification C:\Users\Admin\Pictures\InvokeRename.tiff setx.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1212 cmd.exe -
Drops startup file 2 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exesetx.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\setx.lnk 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\setx.lnk setx.exe -
Loads dropped DLL 2 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exesetx.exepid process 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe 616 setx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
setx.exe28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\setx = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" setx.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce setx.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\setx = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" setx.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\setx = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\setx = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run setx.exe -
Processes:
setx.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setx.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
setx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5763.bmp" setx.exe -
Drops file in Program Files directory 15 IoCs
Processes:
setx.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml setx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs setx.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE setx.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE setx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html setx.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini setx.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url setx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt setx.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url setx.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2184 taskkill.exe 1100 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
setx.exe28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop setx.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" setx.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\\setx.exe\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000a9ba22da7b152a856b55108571862b2ac6ed863ffac45734294a9d41b2a37391000000000e8000000002000020000000addf09a27c921dc1370957ae10f62a00b11babd3f6cf6fe1aaa8e4a95dd119bb20000000172ac5dffcf93ab59eaf8438ed21b436094beb6bc2eeeaacc31f49980eb04d9e40000000db1d4cd9b9669d773e1612bbf05f49dfd42119961aea18f154e3c4084645029228f8a2b28eb67df90936ebba54eff39c05c42945eb7a3cbcf1a23031ed76b896 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E96EDF1-27A0-11EB-B97E-C2515532CB8E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000831282cfe77a9ca9f3528ee37a1cbd390367c6dacf49ee0e12f7320e8344d7b0000000000e8000000002000020000000e842226b4457b3158c56da253aac828e4144097d8131890f09b84f07f8dbd6a9900000001cf8d84e4c1d4d7f9f17a8cd5635f121550869eb9c52b6576fd1378f14c47aa42413ac0c736a931b404ffe16a67bf121a6ed410b2648651e05126db413b44d8af50056222d95fbe8b38da4f985151a8e210c9daa41dca4ae0c1b954f3689dbe3fe38b62c4f77368edcaaa7634402870acaa17f9359d04c4cb5ae1657a356a388692884f3d14dab9bfdec9b6d5ceeb70d40000000cb617221c1757afd62060036fdc8fb9cda78c9517863e37f9aa60cfffc52e87eac27c49eeb8671264ef30ac39787206f15c5ea081c88830d79485b820e22d2ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E4AC1F1-27A0-11EB-B97E-C2515532CB8E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "312250397" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302d47e3acbbd601 iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 240 IoCs
Processes:
setx.exepid process 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe 616 setx.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exetaskkill.exesetx.exesetx.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Token: SeDebugPrivilege 1100 taskkill.exe Token: SeDebugPrivilege 616 setx.exe Token: SeDebugPrivilege 932 setx.exe Token: 33 1848 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1848 AUDIODG.EXE Token: 33 1848 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1848 AUDIODG.EXE Token: SeDebugPrivilege 2184 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1556 iexplore.exe 892 iexplore.exe 892 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 892 iexplore.exe 892 iexplore.exe 1556 iexplore.exe 1556 iexplore.exe 892 iexplore.exe 892 iexplore.exe 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exesetx.exesetx.exepid process 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe 616 setx.exe 932 setx.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.execmd.exetaskeng.exesetx.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1432 wrote to memory of 616 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe setx.exe PID 1432 wrote to memory of 616 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe setx.exe PID 1432 wrote to memory of 616 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe setx.exe PID 1432 wrote to memory of 616 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe setx.exe PID 1432 wrote to memory of 1212 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 1432 wrote to memory of 1212 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 1432 wrote to memory of 1212 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 1432 wrote to memory of 1212 1432 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 1212 wrote to memory of 1100 1212 cmd.exe taskkill.exe PID 1212 wrote to memory of 1100 1212 cmd.exe taskkill.exe PID 1212 wrote to memory of 1100 1212 cmd.exe taskkill.exe PID 1212 wrote to memory of 1100 1212 cmd.exe taskkill.exe PID 1212 wrote to memory of 1252 1212 cmd.exe PING.EXE PID 1212 wrote to memory of 1252 1212 cmd.exe PING.EXE PID 1212 wrote to memory of 1252 1212 cmd.exe PING.EXE PID 1212 wrote to memory of 1252 1212 cmd.exe PING.EXE PID 1168 wrote to memory of 932 1168 taskeng.exe setx.exe PID 1168 wrote to memory of 932 1168 taskeng.exe setx.exe PID 1168 wrote to memory of 932 1168 taskeng.exe setx.exe PID 1168 wrote to memory of 932 1168 taskeng.exe setx.exe PID 616 wrote to memory of 892 616 setx.exe iexplore.exe PID 616 wrote to memory of 892 616 setx.exe iexplore.exe PID 616 wrote to memory of 892 616 setx.exe iexplore.exe PID 616 wrote to memory of 892 616 setx.exe iexplore.exe PID 616 wrote to memory of 1432 616 setx.exe NOTEPAD.EXE PID 616 wrote to memory of 1432 616 setx.exe NOTEPAD.EXE PID 616 wrote to memory of 1432 616 setx.exe NOTEPAD.EXE PID 616 wrote to memory of 1432 616 setx.exe NOTEPAD.EXE PID 892 wrote to memory of 1212 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1212 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1212 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1212 892 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1860 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1860 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1860 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1860 1556 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1084 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1084 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1084 892 iexplore.exe IEXPLORE.EXE PID 892 wrote to memory of 1084 892 iexplore.exe IEXPLORE.EXE PID 616 wrote to memory of 1552 616 setx.exe WScript.exe PID 616 wrote to memory of 1552 616 setx.exe WScript.exe PID 616 wrote to memory of 1552 616 setx.exe WScript.exe PID 616 wrote to memory of 1552 616 setx.exe WScript.exe PID 616 wrote to memory of 2136 616 setx.exe cmd.exe PID 616 wrote to memory of 2136 616 setx.exe cmd.exe PID 616 wrote to memory of 2136 616 setx.exe cmd.exe PID 616 wrote to memory of 2136 616 setx.exe cmd.exe PID 2136 wrote to memory of 2184 2136 cmd.exe taskkill.exe PID 2136 wrote to memory of 2184 2136 cmd.exe taskkill.exe PID 2136 wrote to memory of 2184 2136 cmd.exe taskkill.exe PID 2136 wrote to memory of 2336 2136 cmd.exe PING.EXE PID 2136 wrote to memory of 2336 2136 cmd.exe PING.EXE PID 2136 wrote to memory of 2336 2136 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exe"C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "setx.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "setx.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {DAE8DB98-746F-4134-A995-709CBFB654B1} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeC:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
ae744fd4eac004aad11ca0dce2bb8392
SHA13514f9aba24d47e7108d598b9d310ce771344d9e
SHA2564fb119871704d8c13c37b26b9d80626c7c8c6acbcc1b0a32fea88ba73c6d56b0
SHA51267e437463e0d444b707c0992c645a1a961ccb56866d825bd59af1c4c6479a616300fcabbb63324840e6e8bfb05badd81f9bbfe6032616b03d09ace88336d5791
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1E4AC1F1-27A0-11EB-B97E-C2515532CB8E}.datMD5
d032479753584616c5106221ffdc40d3
SHA17b2408d33921735616089f8d18b6ced42c546455
SHA2566e04a6993f4ba3c7230b735eab2caa6eea909ad09791ea25571cecd044caea3f
SHA512c9805109b725a110ae5b188f0dce0408037d64fd9dac1da4769b4f8556f8fab065d7c9ba16b8e7dec29bd2078e812c2f443b7ae41e5c292f01cd8b82469a7595
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4I1MNQYY.txtMD5
b372cf1dae4eddfde139c3da841fbc7d
SHA1a92be9ac6cde1faa7d1d299f8228ea7e186c89e3
SHA2565d8be29a394119ecb88f45e65a69129a80a9a9524f108a17551d23ff5eb54a3f
SHA5123ab103d94fdb2c75b83aa77c85b2a555b553fc18b6b9d850e7eb8a94b4816d109d1a88c57f224f912cc9a45a3414484adcb9bf6cc97ef37978935f20addad1c5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I90W50W6.txtMD5
845c940e8ef6c924b1211b4d3124d23f
SHA196152cf06232025122fba2a9dd837f5c3df00f9f
SHA2568d228bdb9a5c94beb888fae1789052b6995acbe791f9eb2bc9510e2bed49e0fa
SHA5128de93683adb8d17bec5034aead33cb4823e4bca61a4140d062244b395ffa3553ce144121ececedfb7df25be236151be13f0039c1fc7c38a6e88903808eefb217
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\setx.lnkMD5
9022c261cd1e36d3628d4b44fe87e831
SHA1e782e600c5c11385067339a8f1243235e7e62823
SHA256b31baf38b56edfe4c606e845d1c5e6656fb7c2b47fd31f1638f9517f7b396957
SHA512c22f8151c7bbdb1617dd8f3f408be630b89fea073b8fd4f6416899f7532fae7aa871dd3d0d311326b58c97c53ccbe2bdddfb3023aac6fef79fd8266ec9f81063
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
063b4c2cf5804805b75277dd33fa58d8
SHA1eb0023ecd4ddaede699aa731097cb40589875bcc
SHA2566204c5231e7a7392f2bf5fee0024abb5789b94495d48582ea99efbeac2515931
SHA5125874cc02556f178da051ecd7016ecd92635a259b49947af1032053e33a931dd33b7b96669ea115b3fe8349b4a2034ccc62144699ceecfc9a0f5dfa08695a492f
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
72065898fbfa8a0b97d6abbf4d79cd53
SHA11cfbc6ff0369ba2bdad9e25f3f8086776c699e2b
SHA2564e6d29a9e63a0d5a6e441b407c2ea141fd1828bce0e77380147fe23843c32f1e
SHA512e8cf4d4b238863d9392912ed8da5267f0a6f86f57dd3c7359ec0d07c1bec3475ca73a639eb198a5ee34783cd39be0825527f2a639074ed83e256577224412a1f
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.urlMD5
43449685187ddd99c1c54abf57b9bc50
SHA1f931edace50c494a11a977c86c2638fae1f2d40f
SHA256606daecb0253483368944e6343576a540c248c41f87c807e99cc80c04a83bf13
SHA5128abf3fdc9c52ff4715d1ffb2fee07f25ea82fa937eb300984454e283c48bd6778159fdbb17f77ecec0d0a6c58a66e73c2b262dd97909c8005f25d399d022b337
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
\Users\Admin\AppData\Roaming\{9E67C82F-C7A5-CEBB-D215-2DD654B83DB5}\setx.exeMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
memory/616-1-0x0000000000000000-mapping.dmp
-
memory/892-12-0x0000000000000000-mapping.dmp
-
memory/932-9-0x0000000000000000-mapping.dmp
-
memory/1084-18-0x0000000000000000-mapping.dmp
-
memory/1100-4-0x0000000000000000-mapping.dmp
-
memory/1212-3-0x0000000000000000-mapping.dmp
-
memory/1212-15-0x0000000000000000-mapping.dmp
-
memory/1252-6-0x0000000000000000-mapping.dmp
-
memory/1432-13-0x0000000000000000-mapping.dmp
-
memory/1552-21-0x0000000000000000-mapping.dmp
-
memory/1860-16-0x0000000000000000-mapping.dmp
-
memory/2008-7-0x000007FEF61D0000-0x000007FEF644A000-memory.dmpFilesize
2.5MB
-
memory/2136-26-0x0000000000000000-mapping.dmp
-
memory/2184-27-0x0000000000000000-mapping.dmp
-
memory/2336-33-0x0000000000000000-mapping.dmp