asyncrat | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Target

42f972925508a82236e8533567487761(1).exe
Size

3.7MB
MD5

9d2a888ca79e1ff3820882ea1d88d574
SHA1

112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256

8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512

17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Score

10^/10

asyncrat darkcomet njrat warzonerat evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes

aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
anti_detection
true
autorun
true
bdos
false
delay
host
sandyclark255.hopto.org
hwid
install_file
install_folder
%AppData%
mutex
adweqsds56332
pastebin_config
null
port
6606,8808,7707
version
0.5.6A

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\qqPuJ5LHSXjT.exe\",explorer.exe"	InPeX2CdYyUbAcLA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\SuoBwEoa2vvX.exe\",explorer.exe"	svbhost.exe

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2412 created 3544	2412	WerFault.exe	100

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral24/memory/744-64-0x0000000003130000-0x000000000313D000-memory.dmp	asyncrat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral24/memory/644-61-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral24/memory/644-58-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral24/memory/644-55-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svuhost.exe

Executes dropped EXE 19 IoCs

pid	Process
32	ULygfUIfmNSEzQdf.exe
2836	InPeX2CdYyUbAcLA.exe
1376	gyjtWFykEqA0msjs.exe
744	FmaukJ2K1Bmh5KdE.exe
416	ILUGOhzA81LBewi0.exe
3748	lcNj3pHMkbO3HBih.exe
3936	svthost.exe
3192	svthost.exe
284	svbhost.exe
2912	svbhost.exe
3928	svrhost.exe
2652	eridjeht.exe
644	eridjeht.exe
2464	svuhost.exe
2480	svehosts.exe
3544	excelsl.exe
3448	svbhost.exe
1124	svuhost.exe
1520	prndrvest.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	svuhost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2836 set thread context of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 3748 set thread context of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 416 set thread context of 644	416	ILUGOhzA81LBewi0.exe	95
PID 1376 set thread context of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 2912 set thread context of 3448	2912	svbhost.exe	101
PID 3544 set thread context of 1124	3544	excelsl.exe	102

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svehosts.exe	ULygfUIfmNSEzQdf.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2768	2612	WerFault.exe	46
3916	416	WerFault.exe	84
3164	3748	WerFault.exe	83
1324	1376	WerFault.exe	81
2388	3544	WerFault.exe	100
2412	3544	WerFault.exe	100

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3900	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
312	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	svuhost.exe

Suspicious behavior: EnumeratesProcesses 131 IoCs

pid	Process
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2612	42f972925508a82236e8533567487761(1).exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2836	InPeX2CdYyUbAcLA.exe
2836	InPeX2CdYyUbAcLA.exe
3748	lcNj3pHMkbO3HBih.exe
3748	lcNj3pHMkbO3HBih.exe
3748	lcNj3pHMkbO3HBih.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
416	ILUGOhzA81LBewi0.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
3916	WerFault.exe
1376	gyjtWFykEqA0msjs.exe
1376	gyjtWFykEqA0msjs.exe
1376	gyjtWFykEqA0msjs.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
1324	WerFault.exe
2912	svbhost.exe
2912	svbhost.exe
3544	excelsl.exe
3544	excelsl.exe
3544	excelsl.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
744	FmaukJ2K1Bmh5KdE.exe
1520	prndrvest.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3928	svrhost.exe
284	svbhost.exe

Suspicious use of AdjustPrivilegeToken 102 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	42f972925508a82236e8533567487761(1).exe
Token: SeDebugPrivilege	2612	42f972925508a82236e8533567487761(1).exe
Token: SeDebugPrivilege	32	ULygfUIfmNSEzQdf.exe
Token: SeDebugPrivilege	32	ULygfUIfmNSEzQdf.exe
Token: SeRestorePrivilege	2768	WerFault.exe
Token: SeBackupPrivilege	2768	WerFault.exe
Token: SeDebugPrivilege	2768	WerFault.exe
Token: SeDebugPrivilege	2836	InPeX2CdYyUbAcLA.exe
Token: SeDebugPrivilege	2836	InPeX2CdYyUbAcLA.exe
Token: SeDebugPrivilege	3748	lcNj3pHMkbO3HBih.exe
Token: SeDebugPrivilege	416	ILUGOhzA81LBewi0.exe
Token: SeShutdownPrivilege	284	svbhost.exe
Token: SeDebugPrivilege	284	svbhost.exe
Token: SeTcbPrivilege	284	svbhost.exe
Token: SeDebugPrivilege	744	FmaukJ2K1Bmh5KdE.exe
Token: SeDebugPrivilege	1376	gyjtWFykEqA0msjs.exe
Token: SeDebugPrivilege	3164	WerFault.exe
Token: SeDebugPrivilege	3916	WerFault.exe
Token: SeIncreaseQuotaPrivilege	2464	svuhost.exe
Token: SeSecurityPrivilege	2464	svuhost.exe
Token: SeTakeOwnershipPrivilege	2464	svuhost.exe
Token: SeLoadDriverPrivilege	2464	svuhost.exe
Token: SeSystemProfilePrivilege	2464	svuhost.exe
Token: SeSystemtimePrivilege	2464	svuhost.exe
Token: SeProfSingleProcessPrivilege	2464	svuhost.exe
Token: SeIncBasePriorityPrivilege	2464	svuhost.exe
Token: SeCreatePagefilePrivilege	2464	svuhost.exe
Token: SeBackupPrivilege	2464	svuhost.exe
Token: SeRestorePrivilege	2464	svuhost.exe
Token: SeShutdownPrivilege	2464	svuhost.exe
Token: SeDebugPrivilege	2464	svuhost.exe
Token: SeSystemEnvironmentPrivilege	2464	svuhost.exe
Token: SeChangeNotifyPrivilege	2464	svuhost.exe
Token: SeRemoteShutdownPrivilege	2464	svuhost.exe
Token: SeUndockPrivilege	2464	svuhost.exe
Token: SeManageVolumePrivilege	2464	svuhost.exe
Token: SeImpersonatePrivilege	2464	svuhost.exe
Token: SeCreateGlobalPrivilege	2464	svuhost.exe
Token: 33	2464	svuhost.exe
Token: 34	2464	svuhost.exe
Token: 35	2464	svuhost.exe
Token: 36	2464	svuhost.exe
Token: SeDebugPrivilege	1324	WerFault.exe
Token: SeDebugPrivilege	2912	svbhost.exe
Token: SeDebugPrivilege	2912	svbhost.exe
Token: SeDebugPrivilege	2480	svehosts.exe
Token: SeDebugPrivilege	2480	svehosts.exe
Token: SeShutdownPrivilege	3448	svbhost.exe
Token: SeDebugPrivilege	3448	svbhost.exe
Token: SeTcbPrivilege	3448	svbhost.exe
Token: SeDebugPrivilege	3544	excelsl.exe
Token: SeIncreaseQuotaPrivilege	1124	svuhost.exe
Token: SeSecurityPrivilege	1124	svuhost.exe
Token: SeTakeOwnershipPrivilege	1124	svuhost.exe
Token: SeLoadDriverPrivilege	1124	svuhost.exe
Token: SeSystemProfilePrivilege	1124	svuhost.exe
Token: SeSystemtimePrivilege	1124	svuhost.exe
Token: SeProfSingleProcessPrivilege	1124	svuhost.exe
Token: SeIncBasePriorityPrivilege	1124	svuhost.exe
Token: SeCreatePagefilePrivilege	1124	svuhost.exe
Token: SeBackupPrivilege	1124	svuhost.exe
Token: SeRestorePrivilege	1124	svuhost.exe
Token: SeShutdownPrivilege	1124	svuhost.exe
Token: SeDebugPrivilege	1124	svuhost.exe
Token: SeSystemEnvironmentPrivilege	1124	svuhost.exe
Token: SeChangeNotifyPrivilege	1124	svuhost.exe
Token: SeRemoteShutdownPrivilege	1124	svuhost.exe
Token: SeUndockPrivilege	1124	svuhost.exe
Token: SeManageVolumePrivilege	1124	svuhost.exe
Token: SeImpersonatePrivilege	1124	svuhost.exe
Token: SeCreateGlobalPrivilege	1124	svuhost.exe
Token: 33	1124	svuhost.exe
Token: 34	1124	svuhost.exe
Token: 35	1124	svuhost.exe
Token: 36	1124	svuhost.exe
Token: SeDebugPrivilege	2388	WerFault.exe
Token: SeDebugPrivilege	2412	WerFault.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: SeDebugPrivilege	1520	prndrvest.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe
Token: 33	2480	svehosts.exe
Token: SeIncBasePriorityPrivilege	2480	svehosts.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
284	svbhost.exe
1124	svuhost.exe

Suspicious use of WriteProcessMemory 164 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 32	2612	42f972925508a82236e8533567487761(1).exe	79
PID 2612 wrote to memory of 32	2612	42f972925508a82236e8533567487761(1).exe	79
PID 2612 wrote to memory of 32	2612	42f972925508a82236e8533567487761(1).exe	79
PID 2612 wrote to memory of 2836	2612	42f972925508a82236e8533567487761(1).exe	80
PID 2612 wrote to memory of 2836	2612	42f972925508a82236e8533567487761(1).exe	80
PID 2612 wrote to memory of 2836	2612	42f972925508a82236e8533567487761(1).exe	80
PID 2612 wrote to memory of 1376	2612	42f972925508a82236e8533567487761(1).exe	81
PID 2612 wrote to memory of 1376	2612	42f972925508a82236e8533567487761(1).exe	81
PID 2612 wrote to memory of 1376	2612	42f972925508a82236e8533567487761(1).exe	81
PID 2612 wrote to memory of 744	2612	42f972925508a82236e8533567487761(1).exe	82
PID 2612 wrote to memory of 744	2612	42f972925508a82236e8533567487761(1).exe	82
PID 2612 wrote to memory of 744	2612	42f972925508a82236e8533567487761(1).exe	82
PID 2612 wrote to memory of 416	2612	42f972925508a82236e8533567487761(1).exe	84
PID 2612 wrote to memory of 416	2612	42f972925508a82236e8533567487761(1).exe	84
PID 2612 wrote to memory of 416	2612	42f972925508a82236e8533567487761(1).exe	84
PID 2612 wrote to memory of 3748	2612	42f972925508a82236e8533567487761(1).exe	83
PID 2612 wrote to memory of 3748	2612	42f972925508a82236e8533567487761(1).exe	83
PID 2612 wrote to memory of 3748	2612	42f972925508a82236e8533567487761(1).exe	83
PID 2612 wrote to memory of 3936	2612	42f972925508a82236e8533567487761(1).exe	88
PID 2612 wrote to memory of 3936	2612	42f972925508a82236e8533567487761(1).exe	88
PID 2612 wrote to memory of 3936	2612	42f972925508a82236e8533567487761(1).exe	88
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2612 wrote to memory of 3192	2612	42f972925508a82236e8533567487761(1).exe	85
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 2836 wrote to memory of 284	2836	InPeX2CdYyUbAcLA.exe	89
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 3748 wrote to memory of 3928	3748	lcNj3pHMkbO3HBih.exe	90
PID 284 wrote to memory of 2912	284	svbhost.exe	91
PID 284 wrote to memory of 2912	284	svbhost.exe	91
PID 284 wrote to memory of 2912	284	svbhost.exe	91
PID 416 wrote to memory of 2652	416	ILUGOhzA81LBewi0.exe	92
PID 416 wrote to memory of 2652	416	ILUGOhzA81LBewi0.exe	92
PID 416 wrote to memory of 2652	416	ILUGOhzA81LBewi0.exe	92
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 416 wrote to memory of 644	416	ILUGOhzA81LBewi0.exe	95
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 1376 wrote to memory of 2464	1376	gyjtWFykEqA0msjs.exe	96
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 2464 wrote to memory of 748	2464	svuhost.exe	98
PID 32 wrote to memory of 2480	32	ULygfUIfmNSEzQdf.exe	99
PID 32 wrote to memory of 2480	32	ULygfUIfmNSEzQdf.exe	99
PID 32 wrote to memory of 2480	32	ULygfUIfmNSEzQdf.exe	99
PID 2464 wrote to memory of 3544	2464	svuhost.exe	100
PID 2464 wrote to memory of 3544	2464	svuhost.exe	100
PID 2464 wrote to memory of 3544	2464	svuhost.exe	100
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 2912 wrote to memory of 3448	2912	svbhost.exe	101
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 3544 wrote to memory of 1124	3544	excelsl.exe	102
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 1124 wrote to memory of 2556	1124	svuhost.exe	103
PID 2480 wrote to memory of 2004	2480	svehosts.exe	107
PID 2480 wrote to memory of 2004	2480	svehosts.exe	107
PID 2480 wrote to memory of 2004	2480	svehosts.exe	107
PID 744 wrote to memory of 3900	744	FmaukJ2K1Bmh5KdE.exe	109
PID 744 wrote to memory of 3900	744	FmaukJ2K1Bmh5KdE.exe	109
PID 744 wrote to memory of 3900	744	FmaukJ2K1Bmh5KdE.exe	109
PID 744 wrote to memory of 8	744	FmaukJ2K1Bmh5KdE.exe	111
PID 744 wrote to memory of 8	744	FmaukJ2K1Bmh5KdE.exe	111
PID 744 wrote to memory of 8	744	FmaukJ2K1Bmh5KdE.exe	111
PID 8 wrote to memory of 312	8	cmd.exe	113
PID 8 wrote to memory of 312	8	cmd.exe	113
PID 8 wrote to memory of 312	8	cmd.exe	113
PID 8 wrote to memory of 1520	8	cmd.exe	114
PID 8 wrote to memory of 1520	8	cmd.exe	114
PID 8 wrote to memory of 1520	8	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
  "C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:32
- - C:\Windows\svehosts.exe
    "C:\Windows\svehosts.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
      4⤵
      PID:2004
- C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
  "C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
      "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 284
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
- C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
  "C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
    "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:748
  - - C:\Users\Admin\Documents\excelsl.exe
      "C:\Users\Admin\Documents\excelsl.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:2556
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1068
        5⤵
        Program crash
        
        PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1040
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1068
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
  "C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:3900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D58.tmp.bat""
    3⤵
    PID:8
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:312
  - - C:\Users\Admin\AppData\Roaming\prndrvest.exe
      "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
      4⤵
      Executes dropped EXE
      PID:1520
- C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
  "C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
    "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1068
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
  "C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
    "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
    3⤵
    - Executes dropped EXE
    PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1076
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
    "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
    3⤵
    - Executes dropped EXE
    PID:644
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1584
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/32-23-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/284-54-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/284-43-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/416-32-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/644-55-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/644-61-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/744-25-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/744-40-0x0000000005973000-0x0000000005975000-memory.dmp

Filesize
8KB

Download
memory/744-35-0x00000000019B0000-0x00000000019B1000-memory.dmp

Filesize
4KB

Download
memory/744-64-0x0000000003130000-0x000000000313D000-memory.dmp

Filesize
52KB

Download
memory/744-39-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/744-90-0x000000000B290000-0x000000000B291000-memory.dmp

Filesize
4KB

Download
memory/744-34-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/744-31-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/744-41-0x0000000005CE0000-0x0000000005CFD000-memory.dmp

Filesize
116KB

Download
memory/744-106-0x000000000B6E0000-0x000000000B6E1000-memory.dmp

Filesize
4KB

Download
memory/744-16-0x0000000070F60000-0x000000007164E000-memory.dmp

Filesize
6.9MB

Download
memory/748-72-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/1124-94-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1124-95-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1324-74-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/1324-70-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/1376-30-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1520-116-0x0000000070FB0000-0x000000007169E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-122-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/1520-123-0x00000000058E3000-0x00000000058E5000-memory.dmp

Filesize
8KB

Download
memory/2388-100-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/2388-99-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/2412-103-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/2464-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2464-78-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2464-66-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2480-79-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/2556-98-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/2612-2-0x0000000003150000-0x0000000003151000-memory.dmp

Filesize
4KB

Download
memory/2768-36-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/2768-37-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/2836-27-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2912-56-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/3164-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/3192-24-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3448-89-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3544-85-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/3748-33-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3916-63-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/3928-47-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3928-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download