23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
Size

460KB
MD5

59e5709610450cd0910d414a37f0c004
SHA1

de8d36bfc5c392f62a6b6019b0607ff3b8408dbf
SHA256

23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c
SHA512

7d689f3edbaccc4087c2f33279a5fa956ae9d9c5b35d17c5f0475decd951097d627276661f8048a12cb0b62304fc79e268102a44768b2506595ddf39e458b2eb
SSDEEP

12288:zlSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:zlSt69HNx6T/5xT

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	iBdqphzke5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yuupi.exe

Executes dropped EXE 7 IoCs

pid	Process
936	iBdqphzke5.exe
1636	yuupi.exe
1000	astat.exe
1596	astat.exe
1912	dstat.exe
1808	fstat.exe
332	csrss.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1596-86-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1596-85-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1596-83-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1596-90-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1596-91-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1596-93-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1956	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
936	iBdqphzke5.exe
936	iBdqphzke5.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /A"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /p"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /N"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /h"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /E"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /k"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /x"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /O"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /Z"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /J"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /y"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /R"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /V"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /e"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /j"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /T"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /M"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /r"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /b"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /U"	yuupi.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /H"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /s"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /d"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /m"	iBdqphzke5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /c"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /Q"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /K"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /q"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /i"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /B"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /C"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /P"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /G"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /f"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /u"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /g"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /n"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /a"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /m"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /S"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /L"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /o"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /F"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /t"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /Y"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /l"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /W"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /I"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /z"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /w"	yuupi.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	iBdqphzke5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /D"	yuupi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuupi = "C:\\Users\\Admin\\yuupi.exe /X"	yuupi.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 1596	1000	astat.exe	34
PID 1808 set thread context of 1176	1808	fstat.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1876	tasklist.exe
856	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
936	iBdqphzke5.exe
936	iBdqphzke5.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1636	yuupi.exe
1596	astat.exe
1636	yuupi.exe
1596	astat.exe
1596	astat.exe
1596	astat.exe
1596	astat.exe
1596	astat.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	tasklist.exe
Token: SeDebugPrivilege	1808	fstat.exe
Token: SeDebugPrivilege	1808	fstat.exe
Token: SeDebugPrivilege	856	tasklist.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
936	iBdqphzke5.exe
1636	yuupi.exe
1000	astat.exe
1912	dstat.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 936	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	27
PID 828 wrote to memory of 936	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	27
PID 828 wrote to memory of 936	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	27
PID 828 wrote to memory of 936	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	27
PID 936 wrote to memory of 1636	936	iBdqphzke5.exe	28
PID 936 wrote to memory of 1636	936	iBdqphzke5.exe	28
PID 936 wrote to memory of 1636	936	iBdqphzke5.exe	28
PID 936 wrote to memory of 1636	936	iBdqphzke5.exe	28
PID 936 wrote to memory of 1444	936	iBdqphzke5.exe	29
PID 936 wrote to memory of 1444	936	iBdqphzke5.exe	29
PID 936 wrote to memory of 1444	936	iBdqphzke5.exe	29
PID 936 wrote to memory of 1444	936	iBdqphzke5.exe	29
PID 1444 wrote to memory of 1876	1444	cmd.exe	31
PID 1444 wrote to memory of 1876	1444	cmd.exe	31
PID 1444 wrote to memory of 1876	1444	cmd.exe	31
PID 1444 wrote to memory of 1876	1444	cmd.exe	31
PID 828 wrote to memory of 1000	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	33
PID 828 wrote to memory of 1000	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	33
PID 828 wrote to memory of 1000	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	33
PID 828 wrote to memory of 1000	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	33
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 1000 wrote to memory of 1596	1000	astat.exe	34
PID 828 wrote to memory of 1912	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	35
PID 828 wrote to memory of 1912	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	35
PID 828 wrote to memory of 1912	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	35
PID 828 wrote to memory of 1912	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	35
PID 828 wrote to memory of 1808	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	36
PID 828 wrote to memory of 1808	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	36
PID 828 wrote to memory of 1808	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	36
PID 828 wrote to memory of 1808	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	36
PID 1808 wrote to memory of 1360	1808	fstat.exe	12
PID 1808 wrote to memory of 332	1808	fstat.exe	6
PID 1808 wrote to memory of 1176	1808	fstat.exe	37
PID 1808 wrote to memory of 1176	1808	fstat.exe	37
PID 1808 wrote to memory of 1176	1808	fstat.exe	37
PID 1808 wrote to memory of 1176	1808	fstat.exe	37
PID 1808 wrote to memory of 1176	1808	fstat.exe	37
PID 828 wrote to memory of 1956	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	39
PID 828 wrote to memory of 1956	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	39
PID 828 wrote to memory of 1956	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	39
PID 828 wrote to memory of 1956	828	23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe	39
PID 1956 wrote to memory of 856	1956	cmd.exe	41
PID 1956 wrote to memory of 856	1956	cmd.exe	41
PID 1956 wrote to memory of 856	1956	cmd.exe	41
PID 1956 wrote to memory of 856	1956	cmd.exe	41
PID 332 wrote to memory of 868	332	csrss.exe	22

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1360
- C:\Users\Admin\AppData\Local\Temp\23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
  "C:\Users\Admin\AppData\Local\Temp\23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Users\Admin\iBdqphzke5.exe
    C:\Users\Admin\iBdqphzke5.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Users\Admin\yuupi.exe
      "C:\Users\Admin\yuupi.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del iBdqphzke5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
- - C:\Users\Admin\astat.exe
    C:\Users\Admin\astat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Users\Admin\astat.exe
      "C:\Users\Admin\astat.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1596
- - C:\Users\Admin\dstat.exe
    C:\Users\Admin\dstat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
- - C:\Users\Admin\fstat.exe
    C:\Users\Admin\fstat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 23fab8e73a76e15208fd9b6085c56f8340c1b2e1879b6676c06314d1781f2b4c.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
C:\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
C:\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
C:\Users\Admin\dstat.exe

Filesize
36KB

MD5
b6da847084e39e0cecf175c32c91b4bb

SHA1
fbfd9494fabed5220cdf01866ff088fe7adc535b

SHA256
065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe

SHA512
59d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2

Download Submit
C:\Users\Admin\fstat.exe

Filesize
271KB

MD5
34353cf7e1d1b10bcbbcae0745110535

SHA1
2fb471681daac6f6d66477b7772025da4f58c508

SHA256
b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959

SHA512
7404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6

Download Submit
C:\Users\Admin\fstat.exe

Filesize
271KB

MD5
34353cf7e1d1b10bcbbcae0745110535

SHA1
2fb471681daac6f6d66477b7772025da4f58c508

SHA256
b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959

SHA512
7404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6

Download Submit
C:\Users\Admin\iBdqphzke5.exe

Filesize
244KB

MD5
a4cdb62cf4866a17e742e7e9cc73d237

SHA1
30d94f8e872455ac569949ac4c768d0a0cdfbba7

SHA256
c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32

SHA512
c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671

Download Submit
C:\Users\Admin\iBdqphzke5.exe

Filesize
244KB

MD5
a4cdb62cf4866a17e742e7e9cc73d237

SHA1
30d94f8e872455ac569949ac4c768d0a0cdfbba7

SHA256
c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32

SHA512
c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671

Download Submit
C:\Users\Admin\yuupi.exe

Filesize
244KB

MD5
0f666763f542cd5e7102f7a73bae45b6

SHA1
6e6effd59964aa59ab82958d2f68a1fec0ab1e03

SHA256
b2f04c36d6045ea3871a6baa64c80f342b81365dcd2bfdf8c1cf192527dc1442

SHA512
d30a29d25807795a5d1918fcfc94205e769f2a9e26a3323c0363a657ad1f512684693387401429fcd9133a5603fc29010c52d9b0faab936b7be43beb2d4c2171

Download Submit
C:\Users\Admin\yuupi.exe

Filesize
244KB

MD5
0f666763f542cd5e7102f7a73bae45b6

SHA1
6e6effd59964aa59ab82958d2f68a1fec0ab1e03

SHA256
b2f04c36d6045ea3871a6baa64c80f342b81365dcd2bfdf8c1cf192527dc1442

SHA512
d30a29d25807795a5d1918fcfc94205e769f2a9e26a3323c0363a657ad1f512684693387401429fcd9133a5603fc29010c52d9b0faab936b7be43beb2d4c2171

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
de52e4110f7ebae0f20acb95640cc2c7

SHA1
b88b8b2b1cdbcdc27b3ea6dc3b681d970d51d031

SHA256
f457fbc1f71d582a9555f6a2f8944e859ef39045aafc60d64b85ff5e2fe9c330

SHA512
02c49ebbb2e5a6e1745809bcc387a9999580b35f2a2f602e516d7ded34d108eac753f8137529e5eb7dc14fc8c47538fb7d9ef9f29842cc15475f5159a9ff36ed

Download Submit
\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
\Users\Admin\dstat.exe

Filesize
36KB

MD5
b6da847084e39e0cecf175c32c91b4bb

SHA1
fbfd9494fabed5220cdf01866ff088fe7adc535b

SHA256
065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe

SHA512
59d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2

Download Submit
\Users\Admin\dstat.exe

Filesize
36KB

MD5
b6da847084e39e0cecf175c32c91b4bb

SHA1
fbfd9494fabed5220cdf01866ff088fe7adc535b

SHA256
065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe

SHA512
59d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2

Download Submit
\Users\Admin\fstat.exe

Filesize
271KB

MD5
34353cf7e1d1b10bcbbcae0745110535

SHA1
2fb471681daac6f6d66477b7772025da4f58c508

SHA256
b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959

SHA512
7404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6

Download Submit
\Users\Admin\fstat.exe

Filesize
271KB

MD5
34353cf7e1d1b10bcbbcae0745110535

SHA1
2fb471681daac6f6d66477b7772025da4f58c508

SHA256
b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959

SHA512
7404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6

Download Submit
\Users\Admin\iBdqphzke5.exe

Filesize
244KB

MD5
a4cdb62cf4866a17e742e7e9cc73d237

SHA1
30d94f8e872455ac569949ac4c768d0a0cdfbba7

SHA256
c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32

SHA512
c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671

Download Submit
\Users\Admin\iBdqphzke5.exe

Filesize
244KB

MD5
a4cdb62cf4866a17e742e7e9cc73d237

SHA1
30d94f8e872455ac569949ac4c768d0a0cdfbba7

SHA256
c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32

SHA512
c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671

Download Submit
\Users\Admin\yuupi.exe

Filesize
244KB

MD5
0f666763f542cd5e7102f7a73bae45b6

SHA1
6e6effd59964aa59ab82958d2f68a1fec0ab1e03

SHA256
b2f04c36d6045ea3871a6baa64c80f342b81365dcd2bfdf8c1cf192527dc1442

SHA512
d30a29d25807795a5d1918fcfc94205e769f2a9e26a3323c0363a657ad1f512684693387401429fcd9133a5603fc29010c52d9b0faab936b7be43beb2d4c2171

Download Submit
\Users\Admin\yuupi.exe

Filesize
244KB

MD5
0f666763f542cd5e7102f7a73bae45b6

SHA1
6e6effd59964aa59ab82958d2f68a1fec0ab1e03

SHA256
b2f04c36d6045ea3871a6baa64c80f342b81365dcd2bfdf8c1cf192527dc1442

SHA512
d30a29d25807795a5d1918fcfc94205e769f2a9e26a3323c0363a657ad1f512684693387401429fcd9133a5603fc29010c52d9b0faab936b7be43beb2d4c2171

Download Submit
\Windows\System32\consrv.dll

Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
memory/332-136-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download
memory/828-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/868-154-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/868-155-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/868-162-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/868-163-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/868-144-0x00000000008B0000-0x00000000008BB000-memory.dmp

Filesize
44KB

Download
memory/868-148-0x00000000008B0000-0x00000000008BB000-memory.dmp

Filesize
44KB

Download
memory/868-152-0x00000000008B0000-0x00000000008BB000-memory.dmp

Filesize
44KB

Download
memory/1360-121-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/1360-125-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/1360-129-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/1596-83-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-90-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-93-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-85-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-86-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-91-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1808-112-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-133-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-130-0x00000000029EE000-0x00000000029F2000-memory.dmp

Filesize
16KB

Download
memory/1808-131-0x00000000029E1000-0x00000000029EE000-memory.dmp

Filesize
52KB

Download
memory/1808-119-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-120-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-117-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-140-0x0000000003110000-0x000000000314D000-memory.dmp

Filesize
244KB

Download
memory/1808-141-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-139-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1808-106-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-116-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-115-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download
memory/1808-114-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/1808-113-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1808-132-0x0000000003110000-0x000000000314D000-memory.dmp

Filesize
244KB

Download
memory/1808-109-0x00000000029E0000-0x0000000002A1D000-memory.dmp

Filesize
244KB

Download