ammyyadmin | fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe

Analysis

max time kernel
185s
max time network
191s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Size

825KB
MD5

35c17c148e30f391d8e88918da3bd258
SHA1

962f89351e7e75d1129a797adfcd848a5342e881
SHA256

fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe
SHA512

e9708119d5f72838fe6229c29fb519a0c1c93bb7df8405db712a0b84719a5891cf48af81cf83f4ef3de17fcbe4f928c1b21fce68ae92b00d366f19203e462e00
SSDEEP

24576:ckK+waI8JRQMEJ2rufRtse9rkv8klBiIrgFvqIL:Z4aSlxElBiHA8

Score

10^/10

ammyyadmin flawedammyy rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 5 IoCs

resource	yara_rule
behavioral1/memory/1776-55-0x0000000000400000-0x00000000004A3000-memory.dmp	family_ammyyadmin
behavioral1/memory/1504-61-0x0000000000400000-0x00000000004A3000-memory.dmp	family_ammyyadmin
behavioral1/memory/1776-65-0x0000000000400000-0x00000000004A3000-memory.dmp	family_ammyyadmin
behavioral1/memory/1900-68-0x0000000000400000-0x00000000004A3000-memory.dmp	family_ammyyadmin
behavioral1/memory/1900-69-0x0000000000400000-0x00000000004A3000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	acprotect
behavioral1/files/0x0006000000015c68-58.dat	acprotect
behavioral1/files/0x0006000000015c70-63.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Loads dropped DLL 3 IoCs

pid	Process
1776	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AC354CE209AD58A9212D6B2CC46107BA	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AC354CE209AD58A9212D6B2CC46107BA	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecision = "0"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionTime = 90decb631b02d901	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecision = "0"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionTime = 90decb631b02d901	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionReason = "1"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadNetworkName = "Network 2"	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeBackupPrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
Token: SeRestorePrivilege	1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1776	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
1900	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1900	1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe	28
PID 1504 wrote to memory of 1900	1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe	28
PID 1504 wrote to memory of 1900	1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe	28
PID 1504 wrote to memory of 1900	1504	fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe	28

C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
"C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
"C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe" -service -lunch
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
  "C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\settings.bin

Filesize
76B

MD5
090bba5cbe9cd62189310f633f14d686

SHA1
0ce1d78aace04650b0c592665686a89412c1771c

SHA256
7bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8

SHA512
846781bdb4d8902963f1859077c8db4c763fdd4ca28f0be83b95c20d324b5db030f312fc3d4f959dc05ca4f41ef872a49d123195494b16440e16ebcc5edb31a7

Download Submit
\Users\Admin\AppData\Local\Temp\wpk97DD.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\Temp\kpk9B66.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\Temp\spk9ABA.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1504-62-0x0000000000520000-0x0000000000593000-memory.dmp

Filesize
460KB

Download
memory/1504-61-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1776-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1776-55-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1776-65-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1776-66-0x00000000002F0000-0x0000000000363000-memory.dmp

Filesize
460KB

Download
memory/1900-67-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download
memory/1900-68-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1900-69-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1900-70-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download