wannacry | aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c

Analysis

max time kernel
151s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-08-2022 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
Size

4.3MB
MD5

4da1f312a214c07143abeeafb695d904
SHA1

b629f072c9241fd2451f1cbca2290197e72a8f5e
SHA256

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c
SHA512

0b3281132890039638bed1bd815261b6f6d6bc8bf63467d6a1cdd41f4de89e1d10b241a273378e5f5a1401ea10c0b2974f44a585c92ba15639d80c0501b258c9
SSDEEP

98304:zcI8HbSxeeqe5hXlpIyS+PiwTNl/iZ102q7O3cOtgP5HYPNtNO8/I04miT4RTMpK:zD28tqeDNPLTmZR4Ou5H8NbOR04g5MpK

Score

10^/10

wannacry persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send 0.3 BTC to this bitcoin address: 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) https://www.dropbox.com/s/c1gn29iy8erh1ks/m.rar?dl=1 rar password: wcry123 Run and follow the instructions! �

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 5 IoCs

Processes:

!WannaDecryptor!.exetaskhosts.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid process

3948 !WannaDecryptor!.exe
4524 taskhosts.exe
2772 !WannaDecryptor!.exe
4680 !WannaDecryptor!.exe
4940 !WannaDecryptor!.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\ReceiveSubmit.raw.WCRYT	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File renamed	C:\Users\Admin\Pictures\ReceiveSubmit.raw.WCRYT => C:\Users\Admin\Pictures\ReceiveSubmit.raw.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File opened for modification	C:\Users\Admin\Pictures\ReceiveSubmit.raw.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File created	C:\Users\Admin\Pictures\StepCheckpoint.png.WCRYT	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File opened for modification	C:\Users\Admin\Pictures\StepCheckpoint.png.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File created	C:\Users\Admin\Pictures\ImportRevoke.tiff.WCRYT	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File opened for modification	C:\Users\Admin\Pictures\ImportRevoke.tiff.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File renamed	C:\Users\Admin\Pictures\StepCheckpoint.png.WCRYT => C:\Users\Admin\Pictures\StepCheckpoint.png.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File renamed	C:\Users\Admin\Pictures\ImportRevoke.tiff.WCRYT => C:\Users\Admin\Pictures\ImportRevoke.tiff.WCRY	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe

Drops startup file 3 IoCs

Processes:

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exetaskmgr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCBC8.tmp	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\~sdcb34.tmp	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCB34.tmp	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe

Loads dropped DLL 6 IoCs

Processes:

taskhosts.exe

pid process

4524 taskhosts.exe
4524 taskhosts.exe
4524 taskhosts.exe
4524 taskhosts.exe
4524 taskhosts.exe
4524 taskhosts.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4524	taskhosts.exe
4524	taskhosts.exe
4524	taskhosts.exe
4524	taskhosts.exe
4524	taskhosts.exe
4524	taskhosts.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe\" /r"	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2872 taskkill.exe
4244 taskkill.exe
4356 taskkill.exe
4412 taskkill.exe

pid	process
2872	taskkill.exe
4244	taskkill.exe
4356	taskkill.exe
4412	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exetaskhosts.exe

pid	process
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4524	taskhosts.exe
4524	taskhosts.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4524	taskhosts.exe
4524	taskhosts.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4524	taskhosts.exe
4524	taskhosts.exe
4592	taskmgr.exe
4592	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

4592 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskmgr.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4592	taskmgr.exe
Token: SeSystemProfilePrivilege	4592	taskmgr.exe
Token: SeCreateGlobalPrivilege	4592	taskmgr.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: 33	4592	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4592	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe
4592	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid	process
3948	!WannaDecryptor!.exe
3948	!WannaDecryptor!.exe
2772	!WannaDecryptor!.exe
4680	!WannaDecryptor!.exe
2772	!WannaDecryptor!.exe
4680	!WannaDecryptor!.exe
4940	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.execmd.exe!WannaDecryptor!.execmd.exe

description	pid	process	target process
PID 3768 wrote to memory of 4312	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 3768 wrote to memory of 4312	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 3768 wrote to memory of 4312	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 4312 wrote to memory of 2012	4312	cmd.exe	cscript.exe
PID 4312 wrote to memory of 2012	4312	cmd.exe	cscript.exe
PID 4312 wrote to memory of 2012	4312	cmd.exe	cscript.exe
PID 3768 wrote to memory of 3948	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 3948	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 3948	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 4244	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4244	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4244	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4356	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4356	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4356	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4412	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4412	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 4412	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 2872	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 2872	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3768 wrote to memory of 2872	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	taskkill.exe
PID 3948 wrote to memory of 4524	3948	!WannaDecryptor!.exe	taskhosts.exe
PID 3948 wrote to memory of 4524	3948	!WannaDecryptor!.exe	taskhosts.exe
PID 3948 wrote to memory of 4524	3948	!WannaDecryptor!.exe	taskhosts.exe
PID 3768 wrote to memory of 2772	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 2772	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 2772	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 4972	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 3768 wrote to memory of 4972	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 3768 wrote to memory of 4972	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	cmd.exe
PID 3768 wrote to memory of 4680	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 4680	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 3768 wrote to memory of 4680	3768	aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe	!WannaDecryptor!.exe
PID 4972 wrote to memory of 4940	4972	cmd.exe	!WannaDecryptor!.exe
PID 4972 wrote to memory of 4940	4972	cmd.exe	!WannaDecryptor!.exe
PID 4972 wrote to memory of 4940	4972	cmd.exe	!WannaDecryptor!.exe

C:\Users\Admin\AppData\Local\Temp\aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe
"C:\Users\Admin\AppData\Local\Temp\aee20f9188a5c3954623583c6b0e6623ec90d5cd3fdec4e1001646e27664002c.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 16831661394269.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\taskhosts.exe
TaskHost\Tor\taskhosts.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
Filesize
236KB

MD5
b27f095f305cf940ba4e85f3cb848819

SHA1
565e67fec07cfc67adc31f66747675343e82ebef

SHA256
57c12d8573d2f3883a8a0ba14e3eec02ac1c61dee6b675b6c0d16e221c3777f4

SHA512
2bdf796b200dcf92527d85548cc8c12dbb7f1a0a64d7bd72f0918afb31745b304fdaddfbbf2058a26675ab0c60bf2a0192a292ee8b5fa11c38cbeef5c72478f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
Filesize
236KB

MD5
b27f095f305cf940ba4e85f3cb848819

SHA1
565e67fec07cfc67adc31f66747675343e82ebef

SHA256
57c12d8573d2f3883a8a0ba14e3eec02ac1c61dee6b675b6c0d16e221c3777f4

SHA512
2bdf796b200dcf92527d85548cc8c12dbb7f1a0a64d7bd72f0918afb31745b304fdaddfbbf2058a26675ab0c60bf2a0192a292ee8b5fa11c38cbeef5c72478f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
Filesize
236KB

MD5
b27f095f305cf940ba4e85f3cb848819

SHA1
565e67fec07cfc67adc31f66747675343e82ebef

SHA256
57c12d8573d2f3883a8a0ba14e3eec02ac1c61dee6b675b6c0d16e221c3777f4

SHA512
2bdf796b200dcf92527d85548cc8c12dbb7f1a0a64d7bd72f0918afb31745b304fdaddfbbf2058a26675ab0c60bf2a0192a292ee8b5fa11c38cbeef5c72478f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
Filesize
236KB

MD5
b27f095f305cf940ba4e85f3cb848819

SHA1
565e67fec07cfc67adc31f66747675343e82ebef

SHA256
57c12d8573d2f3883a8a0ba14e3eec02ac1c61dee6b675b6c0d16e221c3777f4

SHA512
2bdf796b200dcf92527d85548cc8c12dbb7f1a0a64d7bd72f0918afb31745b304fdaddfbbf2058a26675ab0c60bf2a0192a292ee8b5fa11c38cbeef5c72478f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
Filesize
236KB

MD5
b27f095f305cf940ba4e85f3cb848819

SHA1
565e67fec07cfc67adc31f66747675343e82ebef

SHA256
57c12d8573d2f3883a8a0ba14e3eec02ac1c61dee6b675b6c0d16e221c3777f4

SHA512
2bdf796b200dcf92527d85548cc8c12dbb7f1a0a64d7bd72f0918afb31745b304fdaddfbbf2058a26675ab0c60bf2a0192a292ee8b5fa11c38cbeef5c72478f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk
Filesize
1KB

MD5
f73d46d54b0b79c32372ea5ef5590b99

SHA1
5feea44219ca0665b9b8f4d343b024d270f07ce6

SHA256
d0af8a8906a10d2a01cfe2d7ea3ce8bddc6a981d907e3f1641e39802aba3021a

SHA512
f131836e5532d12895b7f2456d5726deb6c2e429638ba4dbfdfa8eae0136b6e80d7a1c3e98e8c15952593db40a322dfc9fe88ffeb799c48321426f45216ea164

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res
Filesize
136B

MD5
f0c6981cc73acc8a49003e11f5b3a3e3

SHA1
e22a4023e55595cd31e8b41fa0ced5d078384061

SHA256
719a56fb418d117bbffdb1a2097f9573b754c883652d40908d58f2b96643a301

SHA512
8cd7372e47b360e46775091ee9b5b1603134b3178f9fa1c561114e7e41375eaa766b7972eabaa847e151489ed5fdd72f706c274be3736051a3f5faeb38a089bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res
Filesize
136B

MD5
fe8a440858f5bf5b8d00014ba47ed01a

SHA1
3a412a80a2ccb7015529432fcd5e7a7fba75f16c

SHA256
f1b4781a6707acdab67e215eef4e9ffe0b127ecd9c9c40166c8feedc96b83b85

SHA512
c1609c205929875d08d6b78a860ee53ffb2d486b2d8deaef7ec61065628b7010e0c251a1fc9a79a4f7650a4428ac599197eb2e116d66d052a12c0e87c916a351

Download Submit
C:\Users\Admin\AppData\Local\Temp\16831661394269.bat
Filesize
336B

MD5
3540e056349c6972905dc9706cd49418

SHA1
492c20442d34d45a6d6790c720349b11ec591cde

SHA256
73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

SHA512
c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\LIBEAY32.dll
Filesize
3.0MB

MD5
6ed47014c3bb259874d673fb3eaedc85

SHA1
c9b29ba7e8a97729c46143cc59332d7a7e9c1ad8

SHA256
58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19

SHA512
3bc462d21bc762f6eec3d23bb57e2baf532807ab8b46fab1fe38a841e5fde81ed446e5305a78ad0d513d85419e6ec8c4b54985da1d6b198acb793230aeecd93e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\SSLEAY32.dll
Filesize
694KB

MD5
a12c2040f6fddd34e7acb42f18dd6bdc

SHA1
d7db49f1a9870a4f52e1f31812938fdea89e9444

SHA256
bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1

SHA512
fbe0970bcdfaa23af624daad9917a030d8f0b10d38d3e9c7808a9fbc02912ee9daed293dbdea87aa90dc74470bc9b89cb6f2fe002393ecda7b565307ffb7ec00

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libevent-2-0-5.dll
Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libgcc_s_sjlj-1.dll
Filesize
510KB

MD5
73d4823075762ee2837950726baa2af9

SHA1
ebce3532ed94ad1df43696632ab8cf8da8b9e221

SHA256
9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b

SHA512
8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libssp-0.dll
Filesize
90KB

MD5
78581e243e2b41b17452da8d0b5b2a48

SHA1
eaefb59c31cf07e60a98af48c5348759586a61bb

SHA256
f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f

SHA512
332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\taskhosts.exe
Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskHost\Tor\zlib1.dll
Filesize
105KB

MD5
fb072e9f69afdb57179f59b512f828a4

SHA1
fe71b70173e46ee4e3796db9139f77dc32d2f846

SHA256
66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383

SHA512
9d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\b.wry
Filesize
1.4MB

MD5
99ae8326b4bc406daf54ddc7c5e43abe

SHA1
6ce5002f3cb55a8de0e8e8da77f0d0d0d7679183

SHA256
5054c415757f8a62abe0d61087d31e95065439d9ea1b364a6f207cdceaa24b7c

SHA512
756d7e44eb139501f5b3cf1ed0f76d1e8730c4dfd15f30bc23cda25102b240ad69784d414f995099c57610cf2f9bc9083b20fb4d303f1ca89f75e6819b8cf1d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.vbs
Filesize
219B

MD5
5f6d40ca3c34b470113ed04d06a88ff4

SHA1
50629e7211ae43e32060686d6be17ebd492fd7aa

SHA256
0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

SHA512
4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wry
Filesize
628B

MD5
04bec12ff676fbaf6c90682d1db7d896

SHA1
71a791afad79e987ed4d6fe61493051e5476bf0a

SHA256
a968fb9ea7f85b58260bb395ddfb060e466a65905befd1624c22efa6de3cb0e4

SHA512
c90383a3b1ee5d63d3da4e2859cd56342767c2a248e2a721f43dcaa739bbb545599a83812021a603e74706a086a9aa755af836d65846ec7778f32b3744dc5914

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wry
Filesize
628B

MD5
04bec12ff676fbaf6c90682d1db7d896

SHA1
71a791afad79e987ed4d6fe61493051e5476bf0a

SHA256
a968fb9ea7f85b58260bb395ddfb060e466a65905befd1624c22efa6de3cb0e4

SHA512
c90383a3b1ee5d63d3da4e2859cd56342767c2a248e2a721f43dcaa739bbb545599a83812021a603e74706a086a9aa755af836d65846ec7778f32b3744dc5914

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.wry
Filesize
43KB

MD5
54c0e4aa798ce82886a96ba4bb449188

SHA1
71886d4d410013425243a00f15c270fc4f2a6a3a

SHA256
e5373e95a201b3b676072752097ff5d851a0a34e1be4194ff0c52c33601e576a

SHA512
4415559fa5da1192360b4d6db368179335661120443b812f5bc256466c79ecb6d36ed5d3c00a4e2590bf70e473565287a7db53f6aa3f8faaad46f21e34e84298

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.wry
Filesize
4.2MB

MD5
7cf776f898d58f8be1c44f254fc00643

SHA1
0356d629b6596d652f43604554edb8850ebb744c

SHA256
053ff873d80f419c5cf1a01a32b67a2584c74afd351b79d358ab0d7ac42858f8

SHA512
afb75891e7400153c828e686e2dc39916c103c198505c851cc5f4094c6547103c37b794437aed1b9ef63e21cebba15423b112613517c11150ca7d15c6295ef96

Download Submit
C:\Users\Admin\Desktop\!WannaCryptor!.bmp
Filesize
1.4MB

MD5
99ae8326b4bc406daf54ddc7c5e43abe

SHA1
6ce5002f3cb55a8de0e8e8da77f0d0d0d7679183

SHA256
5054c415757f8a62abe0d61087d31e95065439d9ea1b364a6f207cdceaa24b7c

SHA512
756d7e44eb139501f5b3cf1ed0f76d1e8730c4dfd15f30bc23cda25102b240ad69784d414f995099c57610cf2f9bc9083b20fb4d303f1ca89f75e6819b8cf1d6

Download Submit
\??\c:\users\admin\appdata\local\temp\taskhost\tor\taskhosts.exe
Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libeay32.dll
Filesize
3.0MB

MD5
6ed47014c3bb259874d673fb3eaedc85

SHA1
c9b29ba7e8a97729c46143cc59332d7a7e9c1ad8

SHA256
58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19

SHA512
3bc462d21bc762f6eec3d23bb57e2baf532807ab8b46fab1fe38a841e5fde81ed446e5305a78ad0d513d85419e6ec8c4b54985da1d6b198acb793230aeecd93e

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libevent-2-0-5.dll
Filesize
702KB

MD5
90f50a285efa5dd9c7fddce786bdef25

SHA1
54213da21542e11d656bb65db724105afe8be688

SHA256
77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f

SHA512
746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libgcc_s_sjlj-1.dll
Filesize
510KB

MD5
73d4823075762ee2837950726baa2af9

SHA1
ebce3532ed94ad1df43696632ab8cf8da8b9e221

SHA256
9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b

SHA512
8f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\libssp-0.dll
Filesize
90KB

MD5
78581e243e2b41b17452da8d0b5b2a48

SHA1
eaefb59c31cf07e60a98af48c5348759586a61bb

SHA256
f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f

SHA512
332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\ssleay32.dll
Filesize
694KB

MD5
a12c2040f6fddd34e7acb42f18dd6bdc

SHA1
d7db49f1a9870a4f52e1f31812938fdea89e9444

SHA256
bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1

SHA512
fbe0970bcdfaa23af624daad9917a030d8f0b10d38d3e9c7808a9fbc02912ee9daed293dbdea87aa90dc74470bc9b89cb6f2fe002393ecda7b565307ffb7ec00

Download Submit
\Users\Admin\AppData\Local\Temp\TaskHost\Tor\zlib1.dll
Filesize
105KB

MD5
fb072e9f69afdb57179f59b512f828a4

SHA1
fe71b70173e46ee4e3796db9139f77dc32d2f846

SHA256
66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383

SHA512
9d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8

Download Submit
memory/2012-176-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-184-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-183-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-182-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-181-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-180-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-179-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-178-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-177-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-175-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/2012-174-0x0000000000000000-mapping.dmp

Download
memory/2772-584-0x0000000000000000-mapping.dmp

Download
memory/2872-308-0x0000000000000000-mapping.dmp

Download
memory/3768-123-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-151-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-124-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-125-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-126-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-122-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-127-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-128-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-149-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-129-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-148-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-121-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-120-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-118-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-119-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-159-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-156-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3768-155-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-154-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-153-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-152-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-133-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-147-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-146-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-134-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-145-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-144-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-143-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-135-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-130-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-131-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-150-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-142-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-132-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-141-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-140-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-139-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-138-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-137-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3768-136-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3948-245-0x0000000000000000-mapping.dmp

Download
memory/4244-301-0x0000000000000000-mapping.dmp

Download
memory/4312-171-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-161-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-169-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-167-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-172-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-170-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-160-0x0000000000000000-mapping.dmp

Download
memory/4312-168-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-162-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-163-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-164-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-165-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4312-166-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4356-302-0x0000000000000000-mapping.dmp

Download
memory/4412-305-0x0000000000000000-mapping.dmp

Download
memory/4524-514-0x0000000073190000-0x0000000073212000-memory.dmp

Filesize
520KB

Download
memory/4524-555-0x00000000002C0000-0x00000000005BE000-memory.dmp

Filesize
3.0MB

Download
memory/4524-554-0x0000000072C60000-0x0000000072E7C000-memory.dmp

Filesize
2.1MB

Download
memory/4524-553-0x0000000073190000-0x0000000073212000-memory.dmp

Filesize
520KB

Download
memory/4524-522-0x00000000002C0000-0x00000000005BE000-memory.dmp

Filesize
3.0MB

Download
memory/4524-520-0x0000000072BA0000-0x0000000072BC2000-memory.dmp

Filesize
136KB

Download
memory/4524-518-0x0000000072BD0000-0x0000000072C52000-memory.dmp

Filesize
520KB

Download
memory/4524-322-0x0000000000000000-mapping.dmp

Download
memory/4524-516-0x0000000072C60000-0x0000000072E7C000-memory.dmp

Filesize
2.1MB

Download
memory/4680-589-0x0000000000000000-mapping.dmp

Download
memory/4940-657-0x0000000000000000-mapping.dmp

Download
memory/4972-586-0x0000000000000000-mapping.dmp

Download