b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
Size

201KB
MD5

b1839f3b0f0e4038d1fd83c983be0d84
SHA1

2bf1f11aa6ea2d3c143b96429af67732422045b7
SHA256

b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01
SHA512

a38615b638277c03228bf2ab4cc62501cae9733c8ef0b26997b1aebc14b460004a0475e98767e95874a1784f8bbfda4da4b620966b6994128862f3ca72d91735
SSDEEP

3072:jvqz89m+363/7AbwLYtcFkTS3WqNbuXJ7RqhqzPdeplhkB7wAKLu0A9JsZKjtU89:r3TSFNiNsqoplhKEu0Wswj2eMs

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
820	acrotray.exe
364	acrotray.exe
1828	acrotray .exe
1556	acrotray .exe

Loads dropped DLL 4 IoCs

pid	Process
1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
820	acrotray.exe
820	acrotray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe"	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
File created	C:\Program Files (x86)\Adobe\acrotray .exe	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
File created	C:\Program Files (x86)\Adobe\acrotray.exe	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f096f0af3f09d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com\Total = "955"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.supernetforme.com\ = "955"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.com\Total = "970"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006614a24204683340bf0cf0f6ac100f430000000002000000000010660000000100002000000037817c178dcf27de99e09468f7beb27c630fe8f33b5a9ce8a411bdb92a46380d000000000e8000000002000020000000d99d712c5f611599ffd55341d50e20d94e0867c0f474ba991d44a936ea33b34590000000b69881c0bc50f7b4cbe144b21e8113c2f3c801dd029a225f635a2e3592b6cfba3486478f258230760c18a2db753b28e4cc5df325503a516f16c1acb31f535379cadf477003e0ca2ae9d6463b384f4bf5a052488cee7aeb14f1cf02ccc033aa59c698e4f62cb1f1fef70d4bad8f607b1af3f60f90bd3413f6ab75ea401a96dc29ff74baf48804f4d695e917334689f24f40000000882ca25c3f8cfe645d36e197710be9d1fd628de9540dd79338908d54dce905b10fadd118d19b0f477cd510c6a55ca900706813bcb391389f90aee8583d028124	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377074645"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\superwebbysearch.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\supernetforme.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006614a24204683340bf0cf0f6ac100f4300000000020000000000106600000001000020000000bea498dbd23b11109a996127ef99406833b70242b42486d311745f8f86e7680a000000000e80000000020000200000005b388c1ffe28753dcda7ae44f8ba6a062828560d4bea16d0ee124b1c7468af3220000000105a1f976996820d56fbeb7a9002f85f2edc07ea2aa3ee0f052ec45d4fe460ce4000000085c499df77d89269e8e5dcd9718e6e671e63d8b86aa02b68ba948e975e9e14e2cb8e429eb450af1c680fb895b58a4e2065745b57655d5a98a6339bda14b63848	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1925"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4DC66B1-7532-11ED-A20B-4279513DF160} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.superwebbysearch.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.superwebbysearch.com\ = "970"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "955"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
820	acrotray.exe
820	acrotray.exe
820	acrotray.exe
1828	acrotray .exe
1828	acrotray .exe
1828	acrotray .exe
1556	acrotray .exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe
320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
1556	acrotray .exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
Token: SeDebugPrivilege	1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
Token: SeDebugPrivilege	320	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
Token: SeDebugPrivilege	820	acrotray.exe
Token: SeDebugPrivilege	1828	acrotray .exe
Token: SeDebugPrivilege	1556	acrotray .exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1056	IEXPLORE.EXE
1976	iexplore.exe
1976	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1976	iexplore.exe
1976	iexplore.exe
676	IEXPLORE.EXE
676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1960	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	27
PID 1696 wrote to memory of 1960	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	27
PID 1696 wrote to memory of 1960	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	27
PID 1696 wrote to memory of 1960	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	27
PID 1960 wrote to memory of 320	1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	28
PID 1960 wrote to memory of 320	1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	28
PID 1960 wrote to memory of 320	1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	28
PID 1960 wrote to memory of 320	1960	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	28
PID 1696 wrote to memory of 820	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	29
PID 1696 wrote to memory of 820	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	29
PID 1696 wrote to memory of 820	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	29
PID 1696 wrote to memory of 820	1696	b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe	29
PID 820 wrote to memory of 364	820	acrotray.exe	30
PID 820 wrote to memory of 364	820	acrotray.exe	30
PID 820 wrote to memory of 364	820	acrotray.exe	30
PID 820 wrote to memory of 364	820	acrotray.exe	30
PID 820 wrote to memory of 1828	820	acrotray.exe	31
PID 820 wrote to memory of 1828	820	acrotray.exe	31
PID 820 wrote to memory of 1828	820	acrotray.exe	31
PID 820 wrote to memory of 1828	820	acrotray.exe	31
PID 1828 wrote to memory of 1556	1828	acrotray .exe	32
PID 1828 wrote to memory of 1556	1828	acrotray .exe	32
PID 1828 wrote to memory of 1556	1828	acrotray .exe	32
PID 1828 wrote to memory of 1556	1828	acrotray .exe	32
PID 1976 wrote to memory of 1056	1976	iexplore.exe	35
PID 1976 wrote to memory of 1056	1976	iexplore.exe	35
PID 1976 wrote to memory of 1056	1976	iexplore.exe	35
PID 1976 wrote to memory of 1056	1976	iexplore.exe	35
PID 1976 wrote to memory of 1612	1976	iexplore.exe	37
PID 1976 wrote to memory of 1612	1976	iexplore.exe	37
PID 1976 wrote to memory of 1612	1976	iexplore.exe	37
PID 1976 wrote to memory of 1612	1976	iexplore.exe	37
PID 1976 wrote to memory of 676	1976	iexplore.exe	38
PID 1976 wrote to memory of 676	1976	iexplore.exe	38
PID 1976 wrote to memory of 676	1976	iexplore.exe	38
PID 1976 wrote to memory of 676	1976	iexplore.exe	38

C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
"C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
  "C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe
    "C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- C:\Program Files (x86)\Adobe\acrotray.exe
  "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Program Files (x86)\Adobe\acrotray.exe
    "C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
    3⤵
    - Executes dropped EXE
    PID:364
- - C:\Program Files (x86)\Adobe\acrotray .exe
    "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Program Files (x86)\Adobe\acrotray .exe
      "C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\b9fe9161b2b5701a16b846dd89dbe839e98cf7adc96f5041bbd3edd404a81b01.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:799761 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:1520649 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
221KB

MD5
d3b86e4ae95ff3bcf2cd451c18275957

SHA1
b6bd88f380df07d48c939dcffd2dc986c59975c4

SHA256
d5452f20991b529e241b7ce1879375d8121b533c0f0c7b8d9049ab3466da67dd

SHA512
3a490cf6b61b638416a6171ce2794c5e991d8c1dd36eafe1d4feba8cfe6af297ea5e7a1e7c8498c770939e9c16b7705e2a7b3caa8582d6785abf6581b71870f5

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
221KB

MD5
d3b86e4ae95ff3bcf2cd451c18275957

SHA1
b6bd88f380df07d48c939dcffd2dc986c59975c4

SHA256
d5452f20991b529e241b7ce1879375d8121b533c0f0c7b8d9049ab3466da67dd

SHA512
3a490cf6b61b638416a6171ce2794c5e991d8c1dd36eafe1d4feba8cfe6af297ea5e7a1e7c8498c770939e9c16b7705e2a7b3caa8582d6785abf6581b71870f5

Download Submit
C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
221KB

MD5
d3b86e4ae95ff3bcf2cd451c18275957

SHA1
b6bd88f380df07d48c939dcffd2dc986c59975c4

SHA256
d5452f20991b529e241b7ce1879375d8121b533c0f0c7b8d9049ab3466da67dd

SHA512
3a490cf6b61b638416a6171ce2794c5e991d8c1dd36eafe1d4feba8cfe6af297ea5e7a1e7c8498c770939e9c16b7705e2a7b3caa8582d6785abf6581b71870f5

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
219KB

MD5
e9e5a123a662c9e1791b223af6e966d8

SHA1
5e88a36bddea41cdf89443347c5bef84eda8d55d

SHA256
0b9470a0011087df68f00199cde399b42b89abb3168d6fa3e9d3721cc249e17e

SHA512
c323a603c665dfa72f82bccdba8312655dfb8d0b4ce6429992575a5d4e88a0691f4d49f848cc4356cf6d8db253cf4ba72e3602ed89e10c60e152318723b362fa

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
219KB

MD5
e9e5a123a662c9e1791b223af6e966d8

SHA1
5e88a36bddea41cdf89443347c5bef84eda8d55d

SHA256
0b9470a0011087df68f00199cde399b42b89abb3168d6fa3e9d3721cc249e17e

SHA512
c323a603c665dfa72f82bccdba8312655dfb8d0b4ce6429992575a5d4e88a0691f4d49f848cc4356cf6d8db253cf4ba72e3602ed89e10c60e152318723b362fa

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
219KB

MD5
e9e5a123a662c9e1791b223af6e966d8

SHA1
5e88a36bddea41cdf89443347c5bef84eda8d55d

SHA256
0b9470a0011087df68f00199cde399b42b89abb3168d6fa3e9d3721cc249e17e

SHA512
c323a603c665dfa72f82bccdba8312655dfb8d0b4ce6429992575a5d4e88a0691f4d49f848cc4356cf6d8db253cf4ba72e3602ed89e10c60e152318723b362fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
28b32aa5ff3510390e757a05e43f3b95

SHA1
ec807cc921ef696297c7783aa463bbdea3b9d696

SHA256
3482ea10aa62bb911999d06d1f8f875103e97140d691a6b7b202349f9674b0d7

SHA512
78b598cd8e59ef5f038482576a8746233d66d592ea579691a88d53a38f4baaea7b7e4c8fb2f31ca8d496788e1d1a32fd936adf7a323220e41c1f758f852a9d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
5006b8e985c5838b7fd2f2b558a65bc4

SHA1
183ff15e0faedf346305fd6fe1c70c9c7a1eef4a

SHA256
fcbfec9f5fd0e10d44778c1df64d8612281cd39881cdfd0aa8ca30d13655655a

SHA512
56526aaf34500a94404e83461b3580513be1f07b288485c7059fc1ec86b77cda50da613b7def2fe6a8e2d04bb3d522fdffb5f7e9293eab06e86cd2d6af24a1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7E301575BABDCBC6D3C3B91BC6B458AD

Filesize
471B

MD5
342da2c33af109ac503ef72014789071

SHA1
9f9ce9e9c713ba3ebf8d2c2339b9ec2fa506567a

SHA256
beade5b410ce931a244db18222f0228e501d4c517a29a1af6e316f6c2fc340a7

SHA512
a743f374f1ace6ea6dfd7450cd5ccd6d7bd4d2e9a098932aff6105786a3b5e96647bce9a5029e2265517930478b41d96e261fd3cd9e7b4575605e679065101e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b471219f5fee5716d2afcbe747afb50d

SHA1
f4e79a06d319d4a0ffd361589447e3e22fab33fa

SHA256
fc66de950228a2078e15d4ee0ee87cf3f4fdd568b72a89e61fb31df4f18530b5

SHA512
fcf13478ef9ec7818c7c57e5e53731d8469d9d9236cf9aef867358f573c7cb4ca2bc0c55c8c6c903b30fa585c661fa5b974a2d52e9a8d23406def127bd3e2d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
5ead58a20e092483fc1752c99c926b0e

SHA1
af28a6025dcb3259525073c8f38fbceb851b73c8

SHA256
fcaa58d44c3be739f8183e6044b666ee867c708f1cd8675bac08a33f3db7ee64

SHA512
9e36f8d0b366300335b40cb82a79dbcecbd1a0fe0bf6a1f8bf4d3642dcd4bfba8b4d46e0f6de375dc2db172b80d2565f6386e539163203cd95bdb871b89f76c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7E301575BABDCBC6D3C3B91BC6B458AD

Filesize
406B

MD5
023b5904670005fca1f8cc9bf14fcf3c

SHA1
69dc6de25331641a4f9f23e1fb2885824a77d967

SHA256
2ffc5c6f9ab517b25c3bba9e2c958a11ab67e17aa63abe3828fc16026229e335

SHA512
2fcbe4e2168782a9e3b32ce31e46218ffeca3cc06c612eb9ee2679118cf8e090abce36cec90e9811581c324b56d357a6fec397aad35324331f09ea3a5614b6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5046d71af75b69f75366f1d934f75e9

SHA1
007abde669a3ca153eac984a9de77a81304e880b

SHA256
0d985030bd84ada80c84a3caaee4b6666cef664871091e8ce0b78255e4de162a

SHA512
ac1120d5ab59bd144e9b94e4d32affe60211264430fe46f835825b047c91347c771119c249c3c8559d43d6bca550e7a2d47f938480084a3089f49b23d0500ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0e1926acd910b109bd81122c9b7bc07

SHA1
62f0de1d845d10181a6c10df40157d9ae9120dc6

SHA256
702702cfe81aa007c78073f8f83962e572089ef376fd74604227f4a80224d5a5

SHA512
b7760640afebf7662b8bab8f7b79ad5a3d74199e6bee303a9de2ce8fa3f42516019a2331e243528991f7e7df78d48753fc12f1b5293765f45e2f4a0014ee8665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
5fc9a0dcc92491aae8de42ee7ebcb8c2

SHA1
dd39cb9ae3fd798d12d0e81188f63aa347a0ea47

SHA256
ec11be7c6ff78a871fe1b3968e14391ed2b75ee76cdcdaa1eda780992cf11280

SHA512
a585238088583f7d67701e7976104efbcfe8e4c3e4fb61f4b5a43750d32b8c3dfa3ad5293da91c76165f224f9bcd6805557d6db28c32f2d5b0ab4ca3a58a0330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fc79f7d5f8442a3bba4d352491d39c32

SHA1
4cac8fa3aa4f13cbdf91740f83a53b08ae1aca85

SHA256
29a59d3685665625988a3538f508cd8b9e5bacb20038dcf78a7d9abafdd78539

SHA512
d66d86dca23c86cc096255432724142f9c2a09412039515d1e408f0ab0335378ecf588605ab68f36a2196d132f9eab88aa62f6d42be6a9c55f9917e9451369b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\main.4e219663.chunk[1].js

Filesize
273KB

MD5
87b518e8e45487e774f8d47f2dc0026f

SHA1
e5da4365a7867737da9b39ef021cf9f35d12cc5b

SHA256
1ef669d1914ecf9299396df700b34839c61c6bb24297dc6b4284820eb5f2e5d9

SHA512
7b8b1c87c0eb5ab34d515df4880b88dcc5bf7c6b5089349bcf05cd2bb82a0152ba7ebd21fa45fabbc460076543e7e563f881234d3b1dbe66188e98d01a8c7d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXJIW9HP\search[1].svg

Filesize
391B

MD5
a6ad6e65373db8c1b1f154c4c83f8ce5

SHA1
84cc007d6d682c589e1e1f87482a5278830f3000

SHA256
920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563

SHA512
09b6d4711c284b1a04c9c4d874f3d1ddfc876c1491fb2aa283a13505bcdbfe90b02731d0b7ad5f492b1dda2161a4afe20040801ea634d2727cde84319adfb1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\caf[1].js

Filesize
143KB

MD5
828617b5452d4e9de31fbea1420adf13

SHA1
5e57799115640a59be11c231c483d5627b2d624e

SHA256
fd661c6f74593303ff4667fd893a951e4bce7cf93f89f5cb95ff265595d7015c

SHA512
9c4ab8cbec196ab6d6e19665dc22208b1c314db6e62f0d6a9d7edc4daaeae8279da25bbf5c7e40f6f2034a39491b89a8ce175c9164805a5da4d4bd434319d452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z4TAQ562\2.5940ae1c.chunk[1].js

Filesize
418KB

MD5
04bb6e8d9135d976f28e9ba68fbc6f67

SHA1
fe386efd5e23414c48e37d3dbfe340f1ae5d4d4a

SHA256
b81d40ef3e5928c7bee6ec287ecebfea17f6d62b277916f0b70d223fa4881d18

SHA512
aa21f0744d9e6d286506e425af6f1ea091ebcbe3c671fe339d5c3c18e541323cada2182fae79e3c910aabf4d225142b2bd8458b890322e07f4f9084cf686fbd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\chevron[1].svg

Filesize
200B

MD5
11b3089d616633ca6b73b57aa877eeb4

SHA1
07632f63e06b30d9b63c97177d3a8122629bda9b

SHA256
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

SHA512
079b0e35b479dfdbe64a987661000f4a034b10688e26f2a5fe6aaa807e81ccc5593d40609b731ab3340e687d83dd08de4b8b1e01cdac9d4523a9f6bb3acfcba0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5ZF6LL7U.txt

Filesize
115B

MD5
58be3ec61a95b2973b3a7845eb00a3c3

SHA1
761dbde58c2821ab1ae2f8ee1539c6e599ce99a0

SHA256
60d0d08fc07d97144fefe602edb96ea9dd7d823b38253a120cf75aae59f1615d

SHA512
bf15134db37f863596bf47d815b6872c3b85b26ebe8f38865ab0740d3e8106018b1c0e212ffa0ffafc69640c9ec6dfa94050880e6800a0ac10a944fc583cd0db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MUESV7D6.txt

Filesize
330B

MD5
d8833351fe7b2a179adb509c9e69188a

SHA1
ca392110c0aabe373e775830907b4e2708b2231a

SHA256
2fd2f09ffe8d14bcd6ee2972f137c40b868abe7e9b78ea96a630a7e74a8d7a15

SHA512
b1030f2d970fd7e9e7a78a56fe5b787e96eb244317ba03d5c7e81f25f64043624bfd8ab1a34e679ffe7c111c5fd6a0c82d8f9c0a5d968bc5efb43f0505dd6050

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NKK15DI0.txt

Filesize
432B

MD5
91e247ff20f3bcafa6fc2b0afbfdcf51

SHA1
69f0883950f57eb384d52bd325804bb4719ee44e

SHA256
86ad9e9cd631c7fcc3b3aa6784a5cce1f619c6a1eaececdeced9491cfa911db1

SHA512
ad4300309a8493b2ab07beb0d578d324dea5d76fa8c06eba1633b985f66a0aa2a9ed742f577e2435fa7f5a5725659f65593ee82540970547c9a08322fd5d5d2e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OXEXPIPN.txt

Filesize
608B

MD5
36e7d2ddef996fd5020d5e606c214401

SHA1
469ea610bba6a589db769938ae4b68639f3ee2e2

SHA256
3eb5ce59aafbcdd593a6161399421dc5f464711eb978bc2ed45b471b387830ae

SHA512
1f55a2f9c243741fd481cf386e3e358bd046040092c17864f4ba891ad07e3c1f142230e37ab7a0fb7916ac45a24073036b3a9945e650d2bf775f46b80fc6dea6

Download Submit
\Program Files (x86)\Adobe\acrotray .exe

Filesize
221KB

MD5
d3b86e4ae95ff3bcf2cd451c18275957

SHA1
b6bd88f380df07d48c939dcffd2dc986c59975c4

SHA256
d5452f20991b529e241b7ce1879375d8121b533c0f0c7b8d9049ab3466da67dd

SHA512
3a490cf6b61b638416a6171ce2794c5e991d8c1dd36eafe1d4feba8cfe6af297ea5e7a1e7c8498c770939e9c16b7705e2a7b3caa8582d6785abf6581b71870f5

Download Submit
\Program Files (x86)\Adobe\acrotray .exe

Filesize
221KB

MD5
d3b86e4ae95ff3bcf2cd451c18275957

SHA1
b6bd88f380df07d48c939dcffd2dc986c59975c4

SHA256
d5452f20991b529e241b7ce1879375d8121b533c0f0c7b8d9049ab3466da67dd

SHA512
3a490cf6b61b638416a6171ce2794c5e991d8c1dd36eafe1d4feba8cfe6af297ea5e7a1e7c8498c770939e9c16b7705e2a7b3caa8582d6785abf6581b71870f5

Download Submit
\Program Files (x86)\Adobe\acrotray.exe

Filesize
219KB

MD5
e9e5a123a662c9e1791b223af6e966d8

SHA1
5e88a36bddea41cdf89443347c5bef84eda8d55d

SHA256
0b9470a0011087df68f00199cde399b42b89abb3168d6fa3e9d3721cc249e17e

SHA512
c323a603c665dfa72f82bccdba8312655dfb8d0b4ce6429992575a5d4e88a0691f4d49f848cc4356cf6d8db253cf4ba72e3602ed89e10c60e152318723b362fa

Download Submit
\Program Files (x86)\Adobe\acrotray.exe

Filesize
219KB

MD5
e9e5a123a662c9e1791b223af6e966d8

SHA1
5e88a36bddea41cdf89443347c5bef84eda8d55d

SHA256
0b9470a0011087df68f00199cde399b42b89abb3168d6fa3e9d3721cc249e17e

SHA512
c323a603c665dfa72f82bccdba8312655dfb8d0b4ce6429992575a5d4e88a0691f4d49f848cc4356cf6d8db253cf4ba72e3602ed89e10c60e152318723b362fa

Download Submit
memory/320-63-0x0000000000000000-mapping.dmp

Download
memory/364-77-0x0000000000000000-mapping.dmp

Download
memory/820-70-0x0000000000000000-mapping.dmp

Download
memory/1556-89-0x0000000000000000-mapping.dmp

Download
memory/1696-55-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1828-82-0x0000000000000000-mapping.dmp

Download
memory/1960-58-0x0000000000000000-mapping.dmp

Download