neshta | 119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a

Analysis

max time kernel
263s
max time network
376s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Size

191KB
MD5

47a51f3d6e697dbb17364ba2de7bb710
SHA1

f730dcc243f31c338fd815e208fd2adbf313e009
SHA256

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
SHA512

8f4b133874499706f8d5e360201a3eae43eafacfea0c9c253fcc8d07d904c47617c07e354db90fcc67ec2c05b80b4f3c51f3eaa121272f70f8e52bfc1fa135b2
SSDEEP

1536:JxqjQ+P04wsmJCxgWY54vNd+4tNfuebnwZJ/roM7ZJfUQWd:sr85CSWOrgNfLbwTEM78N

Score

10^/10

neshta evasion persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 23 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	family_neshta
C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\misc.exe	family_neshta
C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 4 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.commsng.exe

pid process

1872 119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
824 svchost.com
584 svchost.com
1080 msng.exe

Loads dropped DLL 6 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.com

pid	process
716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
584	svchost.com
584	svchost.com
716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
824	svchost.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

msng.exe

description ioc process

File opened (read-only) \??\b: msng.exe
File opened (read-only) \??\e: msng.exe
File opened (read-only) \??\a: msng.exe

description	ioc	process
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe
File opened (read-only)	\??\a:	msng.exe

Drops file in System32 directory 7 IoCs

Processes:

msng.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File created	C:\Windows\SysWOW64\rundII32.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File created	C:\Windows\SysWOW64\rundll32.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

Drops file in Program Files directory 64 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com

Drops file in Windows directory 5 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000199bbc883bd6c8cfcd0fb495908f75f2b7d297e64f09f9d1152576877489a658000000000e8000000002000020000000738b7a32c614e486abbcc72af932f0d5a15e811d1f61083c47d3d5d8d8174edd90000000122e535d3f18e5e5f86c8e9b6faae0d04436ccfaa0bd408bef77f06f2724416fc369b2a6c083abf6004691e52c02ed2b40d99a5ec264ecf315f0762f6b4feeed33336797fed6ffa2657ad26f33266c106165082e052f54bdc6f84de43b0cddb83e483d0051b323e785113deead89a4a258d52b28a27f7c981fcc8decb157e8c6d3a20cd73788583cd53ad9dda0b4d4f24000000037b8eba282ee4d7c2786f8296b12bad5130309fcf3f354bfdfab0a8d17aca6ee9400b7be9eea7f628b13d56f740613dcd91979eb203a15f6f2bfbd9f5988d44b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107a0aabb101d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000004fd41b54b9b7ed168aa8b681d94e22ffb7c5a7b3468df4868395c59d7df83957000000000e80000000020000200000007859f28812a344c363f0704641d4b76e2a811b098c9f626a8bb923f363d230ff20000000c661e802afbece76418a03b70b9302aa53a8b0363c3ddd333a7451f292a5eeb5400000005d7fa7141360b0a11ee50907f7c38f24b73a474fb3d708e30160a58f0477d048fc95397f774b9b31a46e67a719c1c953ce8e7a5c4f30ff11a90ad23c9ff94379	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376243976"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACF46F71-6DA4-11ED-8641-5263E908E3CD} = "0"	iexplore.exe

Modifies registry class 41 IoCs

Processes:

explorer.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000006b55027d122041707044617461003c0008000400efbe6b55027d6b55027d2a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 56003100000000007a5520811020333538322d34393000003e0008000400efbe7a5519817a5520812a0000003523010000000b00000000000000000000000000000033003500380032002d00340039003000000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000006b55027d1100557365727300600008000400efbeee3a851a6b55027d2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = c6003100000000007a55208110203131394638397e310000ae0008000400efbe7a5520817a5520812a000000f33001000000080000000000000000000000000000003100310039006600380039003900320037003800370031003800640030003900340038003200360033006400300034003900610031003200660036003500610036003000370064006400620033006600310032003800350033003500650034003200350038003400650033006100300032003400640037003200660036006100000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000006b55a883100041646d696e00380008000400efbe6b55027d6b55a8832a00000031000000000003000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000006b55d77e10204c6f63616c00380008000400efbe6b55027d6b55d77e2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000007a551981102054656d700000360008000400efbe6b55027d7a5519812a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

msng.exe

pid	process
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe
1080	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1088 iexplore.exe

pid	process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exemsng.exeiexplore.exeIEXPLORE.EXE

pid	process
1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
1080	msng.exe
1088	iexplore.exe
1088	iexplore.exe
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE
428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exesvchost.comsvchost.commsng.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 716 wrote to memory of 1872	716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 716 wrote to memory of 1872	716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 716 wrote to memory of 1872	716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 716 wrote to memory of 1872	716	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
PID 1872 wrote to memory of 824	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 824	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 824	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 824	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 584	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 584	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 584	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 1872 wrote to memory of 584	1872	119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe	svchost.com
PID 584 wrote to memory of 1080	584	svchost.com	msng.exe
PID 584 wrote to memory of 1080	584	svchost.com	msng.exe
PID 584 wrote to memory of 1080	584	svchost.com	msng.exe
PID 584 wrote to memory of 1080	584	svchost.com	msng.exe
PID 824 wrote to memory of 804	824	svchost.com	explorer.exe
PID 824 wrote to memory of 804	824	svchost.com	explorer.exe
PID 824 wrote to memory of 804	824	svchost.com	explorer.exe
PID 824 wrote to memory of 804	824	svchost.com	explorer.exe
PID 1080 wrote to memory of 316	1080	msng.exe	explorer.exe
PID 1080 wrote to memory of 316	1080	msng.exe	explorer.exe
PID 1080 wrote to memory of 316	1080	msng.exe	explorer.exe
PID 1080 wrote to memory of 316	1080	msng.exe	explorer.exe
PID 828 wrote to memory of 1088	828	explorer.exe	iexplore.exe
PID 828 wrote to memory of 1088	828	explorer.exe	iexplore.exe
PID 828 wrote to memory of 1088	828	explorer.exe	iexplore.exe
PID 1088 wrote to memory of 428	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 428	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 428	1088	iexplore.exe	IEXPLORE.EXE
PID 1088 wrote to memory of 428	1088	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
"C:\Users\Admin\AppData\Local\Temp\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:716

C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe"
2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\System32\explorer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a
4⤵
PID:804

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\system32\msng.exe" fuckystart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\msng.exe
C:\Windows\system32\msng.exe fuckystart
4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\explorer.exe
explorer.exe http://www.OpenClose.ir
5⤵
PID:316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
Filesize
381KB

MD5
3ec4922dbca2d07815cf28144193ded9

SHA1
75cda36469743fbc292da2684e76a26473f04a6d

SHA256
0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

SHA512
956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe
Filesize
137KB

MD5
e1833678885f02b5e3cf1b3953456557

SHA1
c197e763500002bc76a8d503933f1f6082a8507a

SHA256
bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14

SHA512
fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe
Filesize
414KB

MD5
e44497b628f663fd0ae07c9b4390452d

SHA1
d850535c67bed4d6bb158b9a3eb595be912f9c62

SHA256
5ab884509927dedddbd6e65e539436638be2d2267d7593de60ec1b4686df3e80

SHA512
5028f949b3e75534481c059f115efefc87331becc70221408de2408e7148db91b9357fb5b44a43c5cf76d1a389c011082cff28b5f0aea5b0822ae55e98be7105

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE
Filesize
2.5MB

MD5
dde189a8e031cf118e5111518dc2a78c

SHA1
e650182001541315261924407ee31fea0132f235

SHA256
1860888d37e88ce5ad53bcda021e29d12edef9756b58c10d2d385cf366f22d8a

SHA512
8ce50fb1a1da8ca961ab987a3fd055cf77330c8e234742f9ec8e3b56ad3e9d5519f6781b20f7b038cfceb931ac8d76f79ef9ad2de87d7265b5c5ec01506c0ac6

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE
Filesize
229KB

MD5
28f7305b74e1d71409fec722d940d17a

SHA1
4c64e1ceb723f90da09e1a11e677d01fc8118677

SHA256
706db4d832abdf4907a1386b917e553315660a59bfb4c180e38215b4a606d896

SHA512
117de88d0bc437023ca2f1f54b1f2cf03b00c8cb52e4b728cabcb3140659c67cdb6d2c203d3ca13767312831c6308622dfa65d6c5361ec28aaf4ec0870f9ba6e

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe
Filesize
579KB

MD5
693ed385cb9c7d902c9aa4271d345d7e

SHA1
36f512f61342924f3e4ea8d92badfc0e21e7ebe8

SHA256
01e693491511a132443e9aae0b3d8522ff258bb1f47d5d5e9dc0407a24e67eaf

SHA512
f31c5b3b02d698fff2b956850cc0d79bbbf2a083bc82fbd406426eac19a598bb5ebae028aecdaddd7010501237f2422fe4e709be91e18368a78995486cfa5cee

Download Submit
C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE
Filesize
605KB

MD5
8acc19705a625e2d4fa8b65214d7070a

SHA1
ad16e49369c76c6826a18d136bf9618e8e99ec12

SHA256
3fb179a3ae88a3d14db48de29d4b9d43243b80b2118b578b8117ad776ce47f12

SHA512
92e22275194b5a73d825e1e7ad5a5cb5649d3679f545f88328aa72e39c161c4d797b7b3462e590edf546ddbd53c1508a49056f50fa63b113134e1bdc7d977dec

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE
Filesize
694KB

MD5
7a4edc8fb7114d0ea3fdce1ea05b0d81

SHA1
02ecc30dbfab67b623530ec04220f87b312b9f6b

SHA256
ff16fdc703e55ddfe5ee867f343f3b20b496e7199c6c4b646335a01026f74550

SHA512
39519685b1dd872008abfa967f79fd3b7a5e6f6ee1b9c3de891aae64490b2d0feb56bcd3f5dab4527d2c6d07646db5966028df153f38a1c09ee88a1ba9a1ef44

Download Submit
C:\PROGRA~2\MICROS~1\Office14\misc.exe
Filesize
638KB

MD5
de6d3d57b216ba3136f432aee8a84918

SHA1
56bb3473f05cd961b0fa317279d273235b503537

SHA256
b41057f4e4bd8c48e3b1fe52c0a63627fd2e736a50b36bc28180512a8083be98

SHA512
69c905e1f2a6d157e88df3b00f21f84c46c1f7d26296007bf411e806bec4d9068cb4a39a14ec35a7f17394d7ebaa0fd67c525cd7a15a8e02438838a766d8691f

Download Submit
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
Filesize
715KB

MD5
f34835c1f458f93cd9041bfa7d01ee7d

SHA1
283ac4059492a22e10f7fcef219e52e0400a8926

SHA256
afc5cc567db1a3318c89dd0efad2ca60a353290bc25d98bbbba8e6f1492e23b1

SHA512
d5cc2244f1b6492dd9e66c6e917c2dfaa11376d4a8d1dea2c241cd35ce947ad919e47d1a78dea0c1f6cd6fa1e74426f806ddcf9ed3e8f25a9ae7c370b09e6857

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
Filesize
526KB

MD5
cc5020b193486a88f373bedca78e24c8

SHA1
61744a1675ce10ddd196129b49331d517d7da884

SHA256
e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a

SHA512
bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
Filesize
714KB

MD5
af347c1ed4c9439b511585d607aa7a81

SHA1
5bccf29c6de8d1e005450f84d8e0ea597d290329

SHA256
94626f607c789acc73135c18be6fd93a9e56e839d4739dfebf45ce03d55386b9

SHA512
f314ad43f0af94f1178fb40a503c869c2a51ef04f78ee59b8236ca886c01ab7f50b4eb322cf16cbb7fde7015bc926b08df6ef50828c09178da82f2b5d512a5c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
Filesize
715KB

MD5
f34835c1f458f93cd9041bfa7d01ee7d

SHA1
283ac4059492a22e10f7fcef219e52e0400a8926

SHA256
afc5cc567db1a3318c89dd0efad2ca60a353290bc25d98bbbba8e6f1492e23b1

SHA512
d5cc2244f1b6492dd9e66c6e917c2dfaa11376d4a8d1dea2c241cd35ce947ad919e47d1a78dea0c1f6cd6fa1e74426f806ddcf9ed3e8f25a9ae7c370b09e6857

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
Filesize
536KB

MD5
349c6f2f4e32553e8fea4d29772e40e6

SHA1
e2f7856aa519006f8cbc9943cc3fb34c4461932d

SHA256
7c4fd44a9cda339ac3e7fa93b0b2a24b1e0ac16996dbb19cfdcd6323170b1fd3

SHA512
0b9f9aafb1a682f9e5a5dccae0dc19e3cf21c5d2aa4df3e22311f5744255f668e9a1e11ee21f2656d9f45236c484e0b7b460a57db1c34f2d344bd4cbece42588

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
Filesize
525KB

MD5
261b20dc81bdd7def64bc1bcee858a37

SHA1
75965a4be13e839a39685bc818c79cd98c0edb10

SHA256
63927b22c5fc994790c3365460bd421f587138b7074aabe046e379f428ab4298

SHA512
6e76356b663e131d7eabdfee3b2ce80934f7630593d84cdd1566991e02bf38d60337ce2a1c893f7b9c35bdf8cc44b84ae9855b1e13f94d257ed70206a125f330

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
Filesize
536KB

MD5
3e8de969e12cd5e6292489a12a9834b6

SHA1
285b89585a09ead4affa32ecaaa842bc51d53ad5

SHA256
7a25fc3b1ce0f1d06a84dd344c8f5a6c4604732f7d13a8aaad504c4376b305cf

SHA512
b14a5936181a1d8c0f966d969a049254238bf1eacdb1da952c2dc084d5d6dcd5d611d2d058d4c00d6384c20046deef5e74ea865c0062bb0761a391a1eaf1640e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y2HJP2B1.txt
Filesize
608B

MD5
4e1e14f8eef1059bd2f3d2ca381fd6a9

SHA1
2165374e5d87c7a9b97094131d5971bdbb85d636

SHA256
4c5418db2f9d35bae0ed22237952171dc2bc5af886fd8b1a52c1ba1ec308b0f6

SHA512
9f6d99895803f79c5fa15f424c2069fb744f2a32eefc1d03419885940c74ce5b2b979b192d8fc5c92cecf3b6cd3f2f7c4f751d5cf055d308c8450a25b6d6b902

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
C:\Windows\directx.sys
Filesize
30B

MD5
c442d3b8c7403c6dd7d9f93795276c05

SHA1
bc8f41a5d4adc92875f58081f0256a4c7b614db6

SHA256
e04865623a4f68d752dc73b27e8d38e2418832d1e9df3cdc9936737974e023cc

SHA512
7816d49f07b34032d335e4a6758c76ae9a1ccc8cdac4b7d7792e5e1de5d6c0f9357fc31594ba75a70d8f7605972b45b7225a5d0e91a71d65b8d693950acdac2c

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
045910ccff03704d3f4d4024134e53f5

SHA1
ab9491f710e9f205de2c89bfb14354bbfaee214f

SHA256
8fab4e8f332d274e874047c29edca2bdb76a654da518413a2f7760810096550a

SHA512
7468bb3f77b6d910f0ad6e6e511c2543f02e0fe97de32feef677b73be4d09b8f4f3d15b64168758fc42672b496e17ef038f9b44f88840da9f2ae675787e3e7a3

Download Submit
C:\~0002ftd.tmp
Filesize
109B

MD5
eba2bdce5afa4e313a6d44491a2919eb

SHA1
c7ce068d813220c11d655a1dcf6a17f8cbf9811d

SHA256
190c29360753e1726c676a66a1c24f680392255c2d9e9b901cb5f25313408cd0

SHA512
e2af0a37ad788ea447597fbb2ea9bc6813cc238fa1106760c33a8a8e55012a9eac565ecec9dfb51ed724f28fa68b1f9756659757adc081c2e8c5f0f89b75c1fb

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\119f899278718d0948263d049a12f65a607ddb3f128535e42584e3a024d72f6a.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
\Windows\SysWOW64\msng.exe
Filesize
151KB

MD5
47492b8fbb5cf1096ad18e36479ce000

SHA1
a730907ae2f0ed8c8bdc04b4ad9e66aa6f37428f

SHA256
066f4bc94ba6727ab0ca307d7c80b309ebeea596f4dc14f424a0a9b5df10504a

SHA512
3e288a920dda1c7b7ecd9b21a90364e751bf650c12e801f12c38cc18d4a6bee0f005c87c7c13e1631da534cdf6caaeac8ecca2a4038992107700ac0a57bff2d1

Download Submit
memory/316-99-0x0000000000000000-mapping.dmp

Download
memory/316-101-0x0000000074531000-0x0000000074533000-memory.dmp

Filesize
8KB

Download
memory/584-92-0x0000000000420000-0x000000000049E000-memory.dmp

Filesize
504KB

Download
memory/584-93-0x0000000000420000-0x000000000049E000-memory.dmp

Filesize
504KB

Download
memory/584-70-0x0000000000000000-mapping.dmp

Download
memory/716-72-0x0000000002760000-0x00000000027DE000-memory.dmp

Filesize
504KB

Download
memory/716-73-0x0000000002760000-0x00000000027DE000-memory.dmp

Filesize
504KB

Download
memory/716-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/716-59-0x0000000002760000-0x00000000027DE000-memory.dmp

Filesize
504KB

Download
memory/716-60-0x0000000002760000-0x00000000027DE000-memory.dmp

Filesize
504KB

Download
memory/804-87-0x00000000745D1000-0x00000000745D3000-memory.dmp

Filesize
8KB

Download
memory/804-82-0x0000000000000000-mapping.dmp

Download
memory/824-67-0x0000000000000000-mapping.dmp

Download
memory/1080-81-0x0000000000000000-mapping.dmp

Download
memory/1080-114-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1080-94-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1532-96-0x0000000003550000-0x0000000003560000-memory.dmp

Filesize
64KB

Download
memory/1532-95-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1872-74-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-61-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-76-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1872-57-0x0000000000000000-mapping.dmp

Download