5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
Size

271KB
MD5

b573831955c382dd5bd7952fb163e7e6
SHA1

a1ef9d631be063cfcd5cd155bddb8e8b25e05d91
SHA256

5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b
SHA512

493ded2a4e1861aebe6f05f89b83f034bbd9727867de9b0063e1be2ee5635dd9664583f1d65cd388bcbdddcc272a716fb8f2adf66ecbf9f5bfde9c7cb4455d44
SSDEEP

6144:Ll51orRJXlDixHkUXe34cEOkCybEaQRXr9HNdvOa:NqXUHkUXe3GOkx2LIa

Score

10^/10

upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1192 created 420	1192	Explorer.EXE	23

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\3FXe3DL.sys	SndVol.exe

Deletes itself 1 IoCs

pid	Process
2468	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2984	15bd5e46
2664	SndVol.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2780-0-0x00000000010C0000-0x0000000001149000-memory.dmp	upx
behavioral1/files/0x000b00000001200c-2.dat	upx
behavioral1/memory/2984-3-0x0000000000DF0000-0x0000000000E79000-memory.dmp	upx
behavioral1/memory/2780-45-0x00000000010C0000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/2984-48-0x0000000000DF0000-0x0000000000E79000-memory.dmp	upx
behavioral1/memory/2780-52-0x00000000010C0000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/2984-54-0x0000000000DF0000-0x0000000000E79000-memory.dmp	upx
behavioral1/memory/2984-81-0x0000000000DF0000-0x0000000000E79000-memory.dmp	upx
behavioral1/files/0x000b00000001200c-83.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A	15bd5e46
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A	15bd5e46
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	SndVol.exe
File created	C:\Windows\Syswow64\15bd5e46	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	15bd5e46
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	SndVol.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	15bd5e46
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	15bd5e46
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	15bd5e46
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	SndVol.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	15bd5e46
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	15bd5e46
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	SndVol.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	SndVol.exe
File created	C:\Windows\system32\ \Windows\System32\aa4kYp3h.sys	SndVol.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	15bd5e46

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\331650	15bd5e46
File created	C:\Windows\SndVol.exe	Explorer.EXE
File opened for modification	C:\Windows\SndVol.exe	Explorer.EXE
File created	C:\Windows\ZCUbOhqe.sys	SndVol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
856	timeout.exe
1856	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	15bd5e46
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	15bd5e46
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadNetworkName = "Network 3"	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	15bd5e46
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7b-56-12-81-46\WpadDecisionTime = 80aae9e7d2f5d901	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	15bd5e46
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadNetworkName = "Network 3"	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	15bd5e46
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadDecisionTime = 80aae9e7d2f5d901	15bd5e46
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SndVol.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SndVol.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	15bd5e46
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	15bd5e46
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadDecisionReason = "1"	15bd5e46
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7b-56-12-81-46\WpadDetectedUrl	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SndVol.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7b-56-12-81-46	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\52-7b-56-12-81-46	15bd5e46
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadDecisionReason = "1"	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SndVol.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	15bd5e46
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}\WpadDecision = "0"	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	15bd5e46
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B5D89268-B33C-4666-A104-F3C47A143D52}	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	15bd5e46
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-7b-56-12-81-46\WpadDecisionTime = 608398e9d2f5d901	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	15bd5e46
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SndVol.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SndVol.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	15bd5e46
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	15bd5e46
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	15bd5e46
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	15bd5e46
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	SndVol.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	SndVol.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	15bd5e46
2984	15bd5e46
2984	15bd5e46
2984	15bd5e46
2984	15bd5e46
2984	15bd5e46
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
2984	15bd5e46
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe
2664	SndVol.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
Token: SeTcbPrivilege	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
Token: SeDebugPrivilege	2984	15bd5e46
Token: SeTcbPrivilege	2984	15bd5e46
Token: SeDebugPrivilege	2984	15bd5e46
Token: SeDebugPrivilege	1192	Explorer.EXE
Token: SeDebugPrivilege	1192	Explorer.EXE
Token: SeIncBasePriorityPrivilege	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
Token: SeDebugPrivilege	2984	15bd5e46
Token: SeDebugPrivilege	2664	SndVol.exe
Token: SeDebugPrivilege	2664	SndVol.exe
Token: SeDebugPrivilege	2664	SndVol.exe
Token: SeIncBasePriorityPrivilege	2984	15bd5e46

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1192	2984	15bd5e46	10
PID 2984 wrote to memory of 1192	2984	15bd5e46	10
PID 2984 wrote to memory of 1192	2984	15bd5e46	10
PID 2984 wrote to memory of 1192	2984	15bd5e46	10
PID 2984 wrote to memory of 1192	2984	15bd5e46	10
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2664	1192	Explorer.EXE	29
PID 2984 wrote to memory of 420	2984	15bd5e46	23
PID 2984 wrote to memory of 420	2984	15bd5e46	23
PID 2984 wrote to memory of 420	2984	15bd5e46	23
PID 2984 wrote to memory of 420	2984	15bd5e46	23
PID 2984 wrote to memory of 420	2984	15bd5e46	23
PID 2780 wrote to memory of 2468	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe	30
PID 2780 wrote to memory of 2468	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe	30
PID 2780 wrote to memory of 2468	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe	30
PID 2780 wrote to memory of 2468	2780	5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe	30
PID 2468 wrote to memory of 856	2468	cmd.exe	32
PID 2468 wrote to memory of 856	2468	cmd.exe	32
PID 2468 wrote to memory of 856	2468	cmd.exe	32
PID 2468 wrote to memory of 856	2468	cmd.exe	32
PID 2984 wrote to memory of 740	2984	15bd5e46	33
PID 2984 wrote to memory of 740	2984	15bd5e46	33
PID 2984 wrote to memory of 740	2984	15bd5e46	33
PID 2984 wrote to memory of 740	2984	15bd5e46	33
PID 740 wrote to memory of 1856	740	cmd.exe	35
PID 740 wrote to memory of 1856	740	cmd.exe	35
PID 740 wrote to memory of 1856	740	cmd.exe	35
PID 740 wrote to memory of 1856	740	cmd.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe
  "C:\Users\Admin\AppData\Local\Temp\5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\5255876df0e3edd6dbd5e20b3a4197e452d6e9c7ef6832a64c192931e5b5731b.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:856

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\SndVol.exe
  "C:\Windows\SndVol.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664

C:\Windows\Syswow64\15bd5e46
C:\Windows\Syswow64\15bd5e46
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\15bd5e46"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SndVol.exe

Filesize
267KB

MD5
c3489639ec8e181044f6c6bfd3d01ac9

SHA1
e057c90b675a6da19596b0ac458c25d7440b7869

SHA256
a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103

SHA512
63b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9

Download Submit
C:\Windows\SysWOW64\15bd5e46

Filesize
271KB

MD5
730473b4b675f8f53a5d08f164a3a44e

SHA1
c0a37e7b8303445bd42148dd786c78df992771c6

SHA256
965245c7a0822383d2dddc3f1d007afeb530a97d5ac0b1e5ed97f76d2d816be0

SHA512
241ab5722b9ba93d9d9e0275122c7496c861d364c79439c1236ecb3d182ddd64f12f5921c0d9147fce9cc54f174dc7f803e6057a00f6754f2c70b98f76b01a54

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Windows\Syswow64\15bd5e46

Filesize
271KB

MD5
730473b4b675f8f53a5d08f164a3a44e

SHA1
c0a37e7b8303445bd42148dd786c78df992771c6

SHA256
965245c7a0822383d2dddc3f1d007afeb530a97d5ac0b1e5ed97f76d2d816be0

SHA512
241ab5722b9ba93d9d9e0275122c7496c861d364c79439c1236ecb3d182ddd64f12f5921c0d9147fce9cc54f174dc7f803e6057a00f6754f2c70b98f76b01a54

Download Submit
memory/420-51-0x00000000007F0000-0x0000000000818000-memory.dmp

Filesize
160KB

Download
memory/1192-21-0x00000000039D0000-0x00000000039D3000-memory.dmp

Filesize
12KB

Download
memory/1192-23-0x00000000039D0000-0x00000000039D3000-memory.dmp

Filesize
12KB

Download
memory/1192-25-0x00000000039D0000-0x00000000039D3000-memory.dmp

Filesize
12KB

Download
memory/1192-26-0x0000000006C20000-0x0000000006D19000-memory.dmp

Filesize
996KB

Download
memory/1192-67-0x0000000006C20000-0x0000000006D19000-memory.dmp

Filesize
996KB

Download
memory/2664-108-0x00000000007F0000-0x0000000000818000-memory.dmp

Filesize
160KB

Download
memory/2664-31-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2664-43-0x0000000000550000-0x000000000061B000-memory.dmp

Filesize
812KB

Download
memory/2664-119-0x00000000043E0000-0x00000000045A5000-memory.dmp

Filesize
1.8MB

Download
memory/2664-47-0x0000000000550000-0x000000000061B000-memory.dmp

Filesize
812KB

Download
memory/2664-46-0x000007FEBF2C0000-0x000007FEBF2D0000-memory.dmp

Filesize
64KB

Download
memory/2664-44-0x0000000000550000-0x000000000061B000-memory.dmp

Filesize
812KB

Download
memory/2664-118-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2664-41-0x0000000000160000-0x0000000000163000-memory.dmp

Filesize
12KB

Download
memory/2664-117-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2664-37-0x0000000000160000-0x0000000000163000-memory.dmp

Filesize
12KB

Download
memory/2664-113-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2664-29-0x0000000000060000-0x0000000000123000-memory.dmp

Filesize
780KB

Download
memory/2664-116-0x00000000043E0000-0x00000000045A5000-memory.dmp

Filesize
1.8MB

Download
memory/2664-82-0x0000000000550000-0x000000000061B000-memory.dmp

Filesize
812KB

Download
memory/2664-115-0x00000000043E0000-0x00000000045A5000-memory.dmp

Filesize
1.8MB

Download
memory/2664-106-0x0000000037B90000-0x0000000037BA0000-memory.dmp

Filesize
64KB

Download
memory/2664-114-0x00000000043E0000-0x00000000045A5000-memory.dmp

Filesize
1.8MB

Download
memory/2664-109-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2664-110-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2664-111-0x00000000007F0000-0x0000000000818000-memory.dmp

Filesize
160KB

Download
memory/2664-112-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2780-52-0x00000000010C0000-0x0000000001149000-memory.dmp

Filesize
548KB

Download
memory/2780-0-0x00000000010C0000-0x0000000001149000-memory.dmp

Filesize
548KB

Download
memory/2780-45-0x00000000010C0000-0x0000000001149000-memory.dmp

Filesize
548KB

Download
memory/2984-3-0x0000000000DF0000-0x0000000000E79000-memory.dmp

Filesize
548KB

Download
memory/2984-81-0x0000000000DF0000-0x0000000000E79000-memory.dmp

Filesize
548KB

Download
memory/2984-54-0x0000000000DF0000-0x0000000000E79000-memory.dmp

Filesize
548KB

Download
memory/2984-48-0x0000000000DF0000-0x0000000000E79000-memory.dmp

Filesize
548KB

Download