1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
Size

492KB
MD5

73665f9e1c34c960ad4be2b97922da39
SHA1

6127286e8c99d0073ac10c93846fe86865690b78
SHA256

1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436
SHA512

3ac2692f5a3bc0be30a841dcc30f8eeabc5f8d36f3cc3cae643b5a52eed5acb52ff45b4adf546382793c95684f13ecbff91ecd1c72fc9ac11ec895ea4319e038
SSDEEP

12288:4bGx+je/ygu566z3w8iiuFDnNMkP8W2aSQkGvdGebCJK83:4b1je/+X3w8Cn+kP8W8/Jx

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\0b1aca41\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ziebou.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Lo7b43s3.exe

Executes dropped EXE 9 IoCs

pid	Process
1744	Lo7b43s3.exe
2020	ziebou.exe
1392	2eaa.exe
1164	2eaa.exe
656	2eaa.exe
1808	2eaa.exe
572	3eaa.exe
332	csrss.exe
2028	X

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1164-83-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1164-85-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1164-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1164-90-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1164-93-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/656-92-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/656-95-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/656-97-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1808-105-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1808-107-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/656-106-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/656-110-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1808-108-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1808-115-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1808-113-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1164-114-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/656-121-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1808-120-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/656-137-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1052	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1744	Lo7b43s3.exe
1744	Lo7b43s3.exe
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
572	3eaa.exe
572	3eaa.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /J"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /e"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /t"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /y"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /v"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /l"	ziebou.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /q"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /a"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /S"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /w"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /g"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /r"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /W"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /i"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /I"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /D"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /Z"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /U"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /Y"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /L"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /V"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /A"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /K"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /x"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /X"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /h"	ziebou.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Lo7b43s3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /M"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /k"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /Q"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /H"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /N"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /B"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /Q"	Lo7b43s3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /j"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /m"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /o"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /F"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /T"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /P"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /p"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /d"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /O"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /C"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /z"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /b"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /E"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /f"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /u"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /G"	ziebou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziebou = "C:\\Users\\Admin\\ziebou.exe /R"	ziebou.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2eaa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2eaa.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1392 set thread context of 1164	1392	2eaa.exe	35
PID 1392 set thread context of 656	1392	2eaa.exe	36
PID 1392 set thread context of 1808	1392	2eaa.exe	37
PID 572 set thread context of 340	572	3eaa.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1052	tasklist.exe
1072	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}	3eaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\u = "188"	3eaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\cid = "5244778150985387535"	3eaa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1744	Lo7b43s3.exe
1744	Lo7b43s3.exe
656	2eaa.exe
572	3eaa.exe
572	3eaa.exe
572	3eaa.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
656	2eaa.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
572	3eaa.exe
2028	X
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe
2020	ziebou.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	572	3eaa.exe
Token: SeDebugPrivilege	572	3eaa.exe
Token: SeDebugPrivilege	1072	tasklist.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
1744	Lo7b43s3.exe
2020	ziebou.exe
1392	2eaa.exe
1164	2eaa.exe
1808	2eaa.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1744	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	28
PID 1776 wrote to memory of 1744	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	28
PID 1776 wrote to memory of 1744	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	28
PID 1776 wrote to memory of 1744	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	28
PID 1744 wrote to memory of 2020	1744	Lo7b43s3.exe	29
PID 1744 wrote to memory of 2020	1744	Lo7b43s3.exe	29
PID 1744 wrote to memory of 2020	1744	Lo7b43s3.exe	29
PID 1744 wrote to memory of 2020	1744	Lo7b43s3.exe	29
PID 1744 wrote to memory of 912	1744	Lo7b43s3.exe	30
PID 1744 wrote to memory of 912	1744	Lo7b43s3.exe	30
PID 1744 wrote to memory of 912	1744	Lo7b43s3.exe	30
PID 1744 wrote to memory of 912	1744	Lo7b43s3.exe	30
PID 912 wrote to memory of 1052	912	cmd.exe	32
PID 912 wrote to memory of 1052	912	cmd.exe	32
PID 912 wrote to memory of 1052	912	cmd.exe	32
PID 912 wrote to memory of 1052	912	cmd.exe	32
PID 1776 wrote to memory of 1392	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	34
PID 1776 wrote to memory of 1392	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	34
PID 1776 wrote to memory of 1392	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	34
PID 1776 wrote to memory of 1392	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	34
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 1164	1392	2eaa.exe	35
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 656	1392	2eaa.exe	36
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1392 wrote to memory of 1808	1392	2eaa.exe	37
PID 1776 wrote to memory of 572	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	38
PID 1776 wrote to memory of 572	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	38
PID 1776 wrote to memory of 572	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	38
PID 1776 wrote to memory of 572	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	38
PID 572 wrote to memory of 1236	572	3eaa.exe	13
PID 572 wrote to memory of 332	572	3eaa.exe	6
PID 572 wrote to memory of 2028	572	3eaa.exe	39
PID 572 wrote to memory of 2028	572	3eaa.exe	39
PID 572 wrote to memory of 2028	572	3eaa.exe	39
PID 572 wrote to memory of 2028	572	3eaa.exe	39
PID 2028 wrote to memory of 1236	2028	X	13
PID 572 wrote to memory of 340	572	3eaa.exe	40
PID 572 wrote to memory of 340	572	3eaa.exe	40
PID 572 wrote to memory of 340	572	3eaa.exe	40
PID 572 wrote to memory of 340	572	3eaa.exe	40
PID 572 wrote to memory of 340	572	3eaa.exe	40
PID 1776 wrote to memory of 1052	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	42
PID 1776 wrote to memory of 1052	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	42
PID 1776 wrote to memory of 1052	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	42
PID 1776 wrote to memory of 1052	1776	1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe	42

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1236
- C:\Users\Admin\AppData\Local\Temp\1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
  "C:\Users\Admin\AppData\Local\Temp\1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\Lo7b43s3.exe
    C:\Users\Admin\Lo7b43s3.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Users\Admin\ziebou.exe
      "C:\Users\Admin\ziebou.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del Lo7b43s3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
- - C:\Users\Admin\2eaa.exe
    C:\Users\Admin\2eaa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1164
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:656
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
- - C:\Users\Admin\3eaa.exe
    C:\Users\Admin\3eaa.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Users\Admin\AppData\Local\0b1aca41\X
      *0*bc*b736ce0f*69.64.52.10:53
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:340
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 1b70b771ef5f0aab38e49c4fc683bb5348913e3e2cba4dfeeb45ae51224d2436.exe
    3⤵
    - Deletes itself
    PID:1052
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
C:\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
C:\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
C:\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
C:\Users\Admin\ziebou.exe

Filesize
232KB

MD5
4bcfc767f0cb9ff74a985de5ced2970e

SHA1
989ef874eba00d4062f7d80905ff04d17cf004a8

SHA256
e3604f7310fed0d3f7b0d3fc8841d6baa5ef733c9aec3d82de4101be12a80467

SHA512
bf8bd2acba59f099e1f16f81260f5db118940b8489d42059db760b63bf8e4c4ed2a00d6b0a807233e6da36b960576a8d2e9adfb0cff80ccca888a4b04a27cab8

Download Submit
C:\Users\Admin\ziebou.exe

Filesize
232KB

MD5
4bcfc767f0cb9ff74a985de5ced2970e

SHA1
989ef874eba00d4062f7d80905ff04d17cf004a8

SHA256
e3604f7310fed0d3f7b0d3fc8841d6baa5ef733c9aec3d82de4101be12a80467

SHA512
bf8bd2acba59f099e1f16f81260f5db118940b8489d42059db760b63bf8e4c4ed2a00d6b0a807233e6da36b960576a8d2e9adfb0cff80ccca888a4b04a27cab8

Download Submit
C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
\Users\Admin\ziebou.exe

Filesize
232KB

MD5
4bcfc767f0cb9ff74a985de5ced2970e

SHA1
989ef874eba00d4062f7d80905ff04d17cf004a8

SHA256
e3604f7310fed0d3f7b0d3fc8841d6baa5ef733c9aec3d82de4101be12a80467

SHA512
bf8bd2acba59f099e1f16f81260f5db118940b8489d42059db760b63bf8e4c4ed2a00d6b0a807233e6da36b960576a8d2e9adfb0cff80ccca888a4b04a27cab8

Download Submit
\Users\Admin\ziebou.exe

Filesize
232KB

MD5
4bcfc767f0cb9ff74a985de5ced2970e

SHA1
989ef874eba00d4062f7d80905ff04d17cf004a8

SHA256
e3604f7310fed0d3f7b0d3fc8841d6baa5ef733c9aec3d82de4101be12a80467

SHA512
bf8bd2acba59f099e1f16f81260f5db118940b8489d42059db760b63bf8e4c4ed2a00d6b0a807233e6da36b960576a8d2e9adfb0cff80ccca888a4b04a27cab8

Download Submit
\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
11e0ec6479d63e5d99b8e99a78764852

SHA1
6fe917180e2dfe2b2116b5c96ad7edfe2decfe2e

SHA256
8638a72eef25a28486fc3aba1dbd0f8aded21e593eadac405f14657d432b6fd2

SHA512
faf64d015f7e7c4b0cb1ef239eef0262eef30b736ab48a20e3b384387eb6cb7797fcd88cf6ece536637dd6178365119d6f59dc6457f09dc8f47db085ad62c718

Download Submit
memory/332-158-0x0000000000A50000-0x0000000000A5B000-memory.dmp

Filesize
44KB

Download
memory/572-138-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/572-130-0x000000000052D000-0x0000000000562000-memory.dmp

Filesize
212KB

Download
memory/572-156-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/572-128-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/572-157-0x000000000052D000-0x0000000000562000-memory.dmp

Filesize
212KB

Download
memory/656-97-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-106-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-110-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-95-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-121-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1164-83-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-82-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-85-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-114-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-93-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-90-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1236-149-0x0000000002A00000-0x0000000002A0B000-memory.dmp

Filesize
44KB

Download
memory/1236-159-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/1236-163-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/1236-160-0x0000000002A60000-0x0000000002A6B000-memory.dmp

Filesize
44KB

Download
memory/1236-136-0x00000000029E0000-0x00000000029E6000-memory.dmp

Filesize
24KB

Download
memory/1236-132-0x00000000029E0000-0x00000000029E6000-memory.dmp

Filesize
24KB

Download
memory/1236-126-0x00000000029E0000-0x00000000029E6000-memory.dmp

Filesize
24KB

Download
memory/1236-153-0x0000000002A00000-0x0000000002A0B000-memory.dmp

Filesize
44KB

Download
memory/1236-145-0x0000000002A00000-0x0000000002A0B000-memory.dmp

Filesize
44KB

Download
memory/1776-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1808-115-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-108-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-120-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-113-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-107-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-105-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1808-103-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download