b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9

Analysis

max time kernel
151s
max time network
164s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Size

7.5MB
MD5

6f34f4960831a63db667d0fd0bd15a5f
SHA1

36fc7d1c610d4929d590a3d925c7c503dce1cf9d
SHA256

b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9
SHA512

fb517e5b7485b592bf98ab0e980ea090960d6aff63a7edf95cacc8e957d39ccf57b3d1775d89d03a231533828d64bf8d78f87c01b061121193b02b94fff0abe2
SSDEEP

196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQncryfEQuN82nN6WQ:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxK

Score

10^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

ACProtect 1.3x - 1.4x DLL software 11 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000126a6-57.dat	acprotect
behavioral1/memory/1912-58-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral1/memory/1912-64-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral1/files/0x000a00000001232e-72.dat	acprotect
behavioral1/files/0x00080000000126a6-74.dat	acprotect
behavioral1/files/0x00080000000126a6-73.dat	acprotect
behavioral1/memory/1296-76-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral1/files/0x000a00000001232e-84.dat	acprotect
behavioral1/files/0x00080000000126a6-86.dat	acprotect
behavioral1/files/0x00080000000126a6-85.dat	acprotect
behavioral1/memory/1608-87-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\spools.exe	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1912-54-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/files/0x00080000000126a6-57.dat	upx
behavioral1/memory/1912-58-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/1912-59-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1308-62-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1912-63-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1912-64-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/1308-65-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1296-68-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/files/0x000b000000012326-70.dat	upx
behavioral1/files/0x000c0000000054a8-69.dat	upx
behavioral1/files/0x000a00000001232e-72.dat	upx
behavioral1/files/0x00080000000126a6-74.dat	upx
behavioral1/files/0x00080000000126a6-73.dat	upx
behavioral1/memory/1296-75-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1296-76-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/1608-80-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/files/0x000a00000001232e-84.dat	upx
behavioral1/files/0x00080000000126a6-86.dat	upx
behavioral1/files/0x00080000000126a6-85.dat	upx
behavioral1/memory/1608-87-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/1608-89-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1576-93-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1252-94-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\Q:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\M:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\F:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\I:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\K:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\J:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\Q:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\P:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\R:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\X:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\S:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\J:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\U:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\I:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\P:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\G:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\K:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\W:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\O:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\R:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\K:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\O:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\J:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\V:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\X:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\O:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\N:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\X:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\M:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\X:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\W:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\O:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\W:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\J:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\W:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\F:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\I:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\N:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\E:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\P:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\E:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\T:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\L:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\R:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\R:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\G:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\L:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\R:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\J:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\I:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\K:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\N:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\T:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\S:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\V:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\E:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\N:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\H:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\T:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\F:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\X:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\V:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened (read-only)	\??\E:	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ftpdll.dll	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1296	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1576	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	29
PID 1912 wrote to memory of 1576	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	29
PID 1912 wrote to memory of 1576	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	29
PID 1912 wrote to memory of 1576	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	29
PID 1912 wrote to memory of 1308	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	32
PID 1912 wrote to memory of 1308	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	32
PID 1912 wrote to memory of 1308	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	32
PID 1912 wrote to memory of 1308	1912	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	32
PID 1308 wrote to memory of 1296	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	34
PID 1308 wrote to memory of 1296	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	34
PID 1308 wrote to memory of 1296	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	34
PID 1308 wrote to memory of 1296	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	34
PID 1308 wrote to memory of 1608	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	36
PID 1308 wrote to memory of 1608	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	36
PID 1308 wrote to memory of 1608	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	36
PID 1308 wrote to memory of 1608	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	36
PID 1308 wrote to memory of 1576	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	39
PID 1308 wrote to memory of 1576	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	39
PID 1308 wrote to memory of 1576	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	39
PID 1308 wrote to memory of 1576	1308	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	39
PID 1608 wrote to memory of 1252	1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	41
PID 1608 wrote to memory of 1252	1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	41
PID 1608 wrote to memory of 1252	1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	41
PID 1608 wrote to memory of 1252	1608	b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe	41

C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
"C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
  C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1296
- - C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
      C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
      4⤵
      Enumerates connected drives
      PID:1252
- - C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    C:\Users\Admin\AppData\Local\Temp\b5cc55e50a3e2f9ab5bd9a74285be645fb463842c4c5c9c4843e6f314b9b1ed9.exe
    3⤵
    - Enumerates connected drives
    PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
5e9fc5735c6f6d59c13551ef83d7e3b4

SHA1
ff08507b6afa438652f8ef436ca9827584b979a8

SHA256
ac7469bd9cbe457f094e12097223aa264ce4343dad55684065f6f964fd4d15cc

SHA512
5a3fa6ed1c7a1fef5bcb28d8f3d292d71d24b8a26058cc4308e9d35d31d18c72dfb194efe91312a296ae3bcde49bda08ba2abd12f6f069d27f4cd66714f0fa37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
ee1d383f12d023e7da5027d0be71597c

SHA1
cd17da63aabdc839d914a87758dd4404d0d46829

SHA256
83fbf606c63ed7f8d2d870b0308a164a59826f57e47582849f7dca33bcb2886a

SHA512
af19535afcb64d74d09bd7444e366849cba16473814520542c7500064b33081c031750e357428514f82518f009631c99ec515fa438dea157e9c7351f9ce3a57e

Download Submit
C:\Users\Admin\Local Settings\Application Data\cftmon.exe

Filesize
7.5MB

MD5
f173cfc787fb1a46f0ec60ca81fdbfad

SHA1
0b10dbe28a8ef602d7979f65deb01d3259c98b1b

SHA256
4fe7fbf5d08de26ebe784a009e2775fc7fc0ef229d33bf6b78e33e5b7a0c09f2

SHA512
f31f5537757ecf82a03fb93c4f9c398875ed642868af65293acd0a157150bdb705acbf3447f32808bb8cd1d2b1c9df11ab93436c2853912c4f1ec24d45a400dc

Download Submit
C:\Users\Admin\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
C:\Users\Admin\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
C:\Windows\SysWOW64\drivers\spools.exe

Filesize
7.5MB

MD5
09b071e1185105142d3910f23f6e56dc

SHA1
2821eafef670461a07fd02490945646535520ec0

SHA256
30ae6e7628f13572e5bb8f8f14bf69fb75b568ed86f91acf353162aa96458ff3

SHA512
44d278996721e938139eaf52169678744c747e0cc5714698f0d1b859f797e3580e4eba8fb6f896fa431ca5ae46d1f8805d830f26581f28e6a743a2a3969e3362

Download Submit
C:\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
C:\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
memory/1252-94-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-75-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-76-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/1296-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1308-88-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-67-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-95-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1308-77-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-79-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-92-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/1308-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1576-93-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1608-87-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/1608-89-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1608-80-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1608-96-0x00000000027B0000-0x00000000027D6000-memory.dmp

Filesize
152KB

Download
memory/1912-58-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/1912-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1912-61-0x00000000029D0000-0x00000000029F6000-memory.dmp

Filesize
152KB

Download
memory/1912-56-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1912-64-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/1912-54-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1912-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download