61cb3786b5ee1578358b41b6f23e0f78a78a5954f8d761846e1c84ad521ca159

Analysis

max time kernel
163s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

364b0867184a62e362272b89e4adec90_exe32.exe
Size

196KB
MD5

364b0867184a62e362272b89e4adec90
SHA1

b0025bcdd7ee5e3d44b6519419b409df8c954b2d
SHA256

61cb3786b5ee1578358b41b6f23e0f78a78a5954f8d761846e1c84ad521ca159
SHA512

c948d6230417e5604c4003cc29ee57991723d3692c97a708d6c21623dc561326ddfc6ef0622ae34510967454df2ee7d7959629805de7249e9ad6f69d18115a2e
SSDEEP

3072:ZOgUXoutNZFHxZVX4/awxfodLJUBv9Bsor1rHjhMU9npQQpmuG:ZFYoSNRARoYlld9n2Qpmx

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	364b0867184a62e362272b89e4adec90_exe32.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	364b0867184a62e362272b89e4adec90_exe32.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	364b0867184a62e362272b89e4adec90_exe32.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	364b0867184a62e362272b89e4adec90_exe32.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 13 IoCs

pid	Process
1700	xk.exe
2772	IExplorer.exe
3060	WINLOGON.EXE
2564	CSRSS.EXE
752	SERVICES.EXE
672	LSASS.EXE
1816	xk.exe
2680	IExplorer.exe
2116	WINLOGON.EXE
1644	CSRSS.EXE
2320	SERVICES.EXE
1788	LSASS.EXE
1952	SMSS.EXE

Loads dropped DLL 22 IoCs

pid	Process
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1212	364b0867184a62e362272b89e4adec90_exe32.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	364b0867184a62e362272b89e4adec90_exe32.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1212-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000015c69-8.dat	upx
behavioral1/files/0x000a000000015c88-108.dat	upx
behavioral1/memory/1700-111-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1700-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015db4-114.dat	upx
behavioral1/files/0x0006000000015db4-116.dat	upx
behavioral1/files/0x0006000000015db4-120.dat	upx
behavioral1/memory/2772-121-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2772-124-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015e08-125.dat	upx
behavioral1/files/0x0006000000015e08-127.dat	upx
behavioral1/files/0x0006000000015e08-131.dat	upx
behavioral1/memory/3060-134-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1212-137-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015e3d-138.dat	upx
behavioral1/files/0x0006000000015e3d-143.dat	upx
behavioral1/files/0x0006000000015e3d-135.dat	upx
behavioral1/memory/2564-146-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015eb2-147.dat	upx
behavioral1/files/0x0006000000015eb2-149.dat	upx
behavioral1/files/0x0006000000015eb2-153.dat	upx
behavioral1/memory/752-154-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015ec6-164.dat	upx
behavioral1/memory/752-158-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/672-168-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015ec6-160.dat	upx
behavioral1/files/0x0006000000015ec6-157.dat	upx
behavioral1/memory/672-177-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000a000000015c88-224.dat	upx
behavioral1/memory/1816-229-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015db4-235.dat	upx
behavioral1/files/0x0006000000015db4-231.dat	upx
behavioral1/files/0x0006000000015db4-228.dat	upx
behavioral1/files/0x0006000000015e08-245.dat	upx
behavioral1/files/0x0006000000015e08-241.dat	upx
behavioral1/memory/2680-239-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015e08-238.dat	upx
behavioral1/memory/2116-249-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015e3d-250.dat	upx
behavioral1/files/0x0006000000015e3d-252.dat	upx
behavioral1/files/0x0006000000015e3d-256.dat	upx
behavioral1/memory/1644-261-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015eb2-264.dat	upx
behavioral1/files/0x0006000000015eb2-268.dat	upx
behavioral1/files/0x0006000000015eb2-260.dat	upx
behavioral1/memory/2320-272-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015ec6-273.dat	upx
behavioral1/files/0x0006000000015ec6-280.dat	upx
behavioral1/files/0x0006000000015ec6-276.dat	upx
behavioral1/memory/1788-283-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016059-284.dat	upx
behavioral1/memory/1212-286-0x00000000004B0000-0x00000000004DF000-memory.dmp	upx
behavioral1/files/0x0006000000016059-291.dat	upx
behavioral1/files/0x0006000000016059-287.dat	upx
behavioral1/memory/1952-294-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1212-449-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	364b0867184a62e362272b89e4adec90_exe32.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\desktop.ini	364b0867184a62e362272b89e4adec90_exe32.exe
File opened for modification	F:\desktop.ini	364b0867184a62e362272b89e4adec90_exe32.exe
File created	F:\desktop.ini	364b0867184a62e362272b89e4adec90_exe32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\J:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\L:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\Q:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\R:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\S:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\W:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\E:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\N:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\X:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\H:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\I:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\K:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\U:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\Z:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\B:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\M:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\O:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\P:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\T:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\V:	364b0867184a62e362272b89e4adec90_exe32.exe
File opened (read-only)	\??\Y:	364b0867184a62e362272b89e4adec90_exe32.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	364b0867184a62e362272b89e4adec90_exe32.exe
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\shell.exe	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\Windows\SysWOW64\shell.exe	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	364b0867184a62e362272b89e4adec90_exe32.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	364b0867184a62e362272b89e4adec90_exe32.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\Windows\xk.exe	364b0867184a62e362272b89e4adec90_exe32.exe
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\Desktop\	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	364b0867184a62e362272b89e4adec90_exe32.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309A-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EA-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F0-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E1-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063083-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063035-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063026-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063103-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DA-0000-0000-C000-000000000046}\ = "_ImportanceRuleCondition"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DD-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304F-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D0-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063034-0000-0000-C000-000000000046}\ = "_MailItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308C-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067355-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A7-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D1-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300F-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\ = "Exception"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063073-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C4-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EA-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063005-0000-0000-C000-000000000046}\ = "_Inspector"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304F-0000-0000-C000-000000000046}\ = "ExplorerEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C3-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063073-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\ = "_BusinessCardView"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308C-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063072-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046}\ = "ResultsEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FE-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063086-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F9-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1184	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1212	364b0867184a62e362272b89e4adec90_exe32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1184	OUTLOOK.EXE
1184	OUTLOOK.EXE
1184	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1184	OUTLOOK.EXE
1184	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1212	364b0867184a62e362272b89e4adec90_exe32.exe
1700	xk.exe
2772	IExplorer.exe
3060	WINLOGON.EXE
2564	CSRSS.EXE
752	SERVICES.EXE
672	LSASS.EXE
1816	xk.exe
2680	IExplorer.exe
2116	WINLOGON.EXE
1644	CSRSS.EXE
2320	SERVICES.EXE
1788	LSASS.EXE
1952	SMSS.EXE
1184	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1700	1212	364b0867184a62e362272b89e4adec90_exe32.exe	28
PID 1212 wrote to memory of 1700	1212	364b0867184a62e362272b89e4adec90_exe32.exe	28
PID 1212 wrote to memory of 1700	1212	364b0867184a62e362272b89e4adec90_exe32.exe	28
PID 1212 wrote to memory of 1700	1212	364b0867184a62e362272b89e4adec90_exe32.exe	28
PID 1212 wrote to memory of 2772	1212	364b0867184a62e362272b89e4adec90_exe32.exe	29
PID 1212 wrote to memory of 2772	1212	364b0867184a62e362272b89e4adec90_exe32.exe	29
PID 1212 wrote to memory of 2772	1212	364b0867184a62e362272b89e4adec90_exe32.exe	29
PID 1212 wrote to memory of 2772	1212	364b0867184a62e362272b89e4adec90_exe32.exe	29
PID 1212 wrote to memory of 3060	1212	364b0867184a62e362272b89e4adec90_exe32.exe	30
PID 1212 wrote to memory of 3060	1212	364b0867184a62e362272b89e4adec90_exe32.exe	30
PID 1212 wrote to memory of 3060	1212	364b0867184a62e362272b89e4adec90_exe32.exe	30
PID 1212 wrote to memory of 3060	1212	364b0867184a62e362272b89e4adec90_exe32.exe	30
PID 1212 wrote to memory of 2564	1212	364b0867184a62e362272b89e4adec90_exe32.exe	31
PID 1212 wrote to memory of 2564	1212	364b0867184a62e362272b89e4adec90_exe32.exe	31
PID 1212 wrote to memory of 2564	1212	364b0867184a62e362272b89e4adec90_exe32.exe	31
PID 1212 wrote to memory of 2564	1212	364b0867184a62e362272b89e4adec90_exe32.exe	31
PID 1212 wrote to memory of 752	1212	364b0867184a62e362272b89e4adec90_exe32.exe	32
PID 1212 wrote to memory of 752	1212	364b0867184a62e362272b89e4adec90_exe32.exe	32
PID 1212 wrote to memory of 752	1212	364b0867184a62e362272b89e4adec90_exe32.exe	32
PID 1212 wrote to memory of 752	1212	364b0867184a62e362272b89e4adec90_exe32.exe	32
PID 1212 wrote to memory of 672	1212	364b0867184a62e362272b89e4adec90_exe32.exe	33
PID 1212 wrote to memory of 672	1212	364b0867184a62e362272b89e4adec90_exe32.exe	33
PID 1212 wrote to memory of 672	1212	364b0867184a62e362272b89e4adec90_exe32.exe	33
PID 1212 wrote to memory of 672	1212	364b0867184a62e362272b89e4adec90_exe32.exe	33
PID 1212 wrote to memory of 1816	1212	364b0867184a62e362272b89e4adec90_exe32.exe	34
PID 1212 wrote to memory of 1816	1212	364b0867184a62e362272b89e4adec90_exe32.exe	34
PID 1212 wrote to memory of 1816	1212	364b0867184a62e362272b89e4adec90_exe32.exe	34
PID 1212 wrote to memory of 1816	1212	364b0867184a62e362272b89e4adec90_exe32.exe	34
PID 1212 wrote to memory of 2680	1212	364b0867184a62e362272b89e4adec90_exe32.exe	35
PID 1212 wrote to memory of 2680	1212	364b0867184a62e362272b89e4adec90_exe32.exe	35
PID 1212 wrote to memory of 2680	1212	364b0867184a62e362272b89e4adec90_exe32.exe	35
PID 1212 wrote to memory of 2680	1212	364b0867184a62e362272b89e4adec90_exe32.exe	35
PID 1212 wrote to memory of 2116	1212	364b0867184a62e362272b89e4adec90_exe32.exe	36
PID 1212 wrote to memory of 2116	1212	364b0867184a62e362272b89e4adec90_exe32.exe	36
PID 1212 wrote to memory of 2116	1212	364b0867184a62e362272b89e4adec90_exe32.exe	36
PID 1212 wrote to memory of 2116	1212	364b0867184a62e362272b89e4adec90_exe32.exe	36
PID 1212 wrote to memory of 1644	1212	364b0867184a62e362272b89e4adec90_exe32.exe	37
PID 1212 wrote to memory of 1644	1212	364b0867184a62e362272b89e4adec90_exe32.exe	37
PID 1212 wrote to memory of 1644	1212	364b0867184a62e362272b89e4adec90_exe32.exe	37
PID 1212 wrote to memory of 1644	1212	364b0867184a62e362272b89e4adec90_exe32.exe	37
PID 1212 wrote to memory of 2320	1212	364b0867184a62e362272b89e4adec90_exe32.exe	38
PID 1212 wrote to memory of 2320	1212	364b0867184a62e362272b89e4adec90_exe32.exe	38
PID 1212 wrote to memory of 2320	1212	364b0867184a62e362272b89e4adec90_exe32.exe	38
PID 1212 wrote to memory of 2320	1212	364b0867184a62e362272b89e4adec90_exe32.exe	38
PID 1212 wrote to memory of 1788	1212	364b0867184a62e362272b89e4adec90_exe32.exe	40
PID 1212 wrote to memory of 1788	1212	364b0867184a62e362272b89e4adec90_exe32.exe	40
PID 1212 wrote to memory of 1788	1212	364b0867184a62e362272b89e4adec90_exe32.exe	40
PID 1212 wrote to memory of 1788	1212	364b0867184a62e362272b89e4adec90_exe32.exe	40
PID 1212 wrote to memory of 1952	1212	364b0867184a62e362272b89e4adec90_exe32.exe	41
PID 1212 wrote to memory of 1952	1212	364b0867184a62e362272b89e4adec90_exe32.exe	41
PID 1212 wrote to memory of 1952	1212	364b0867184a62e362272b89e4adec90_exe32.exe	41
PID 1212 wrote to memory of 1952	1212	364b0867184a62e362272b89e4adec90_exe32.exe	41

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	364b0867184a62e362272b89e4adec90_exe32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	364b0867184a62e362272b89e4adec90_exe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	364b0867184a62e362272b89e4adec90_exe32.exe

C:\Users\Admin\AppData\Local\Temp\364b0867184a62e362272b89e4adec90_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\364b0867184a62e362272b89e4adec90_exe32.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1212
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1700
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2772
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3060
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2564
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:752
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:672
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1816
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2680
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2116
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1644
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1788
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1952

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
230KB

MD5
d13cf56d38e40909e8809f3e040b7892

SHA1
7acb8c0545736e086806dc97ba139f31a5ca5c0c

SHA256
2d98bad3680d07c84ccd9ae45724d7b9d49c1af3351d2508789c46686a21daa9

SHA512
32bebd5e9ac6427b579938e2fd6928509712ea4a78bbc7035495a36d7d57d38466629a80389bcae44503ca2078b0c5b28f295a6487bb407ed4de272b99c4066d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
230KB

MD5
6ed24aa539521ac9fb226e53cd8fcd78

SHA1
02b116f19c4f259889f6194665161e5889841289

SHA256
2e7379c2c200c8a80ece9578f05bcd9bc6f740ebee65e8b64965ca57d3041c82

SHA512
cf085bde9d8cd2c38d0d50ab06ef2e71d2c8c22b2feeb2143f60fd663cfaff818b80fa01b74e2274ba838c37e2e05d7df758b62e226e28011dd266df1a5c3334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
7b2e729b74708bc56446fd78d4ac62a0

SHA1
1235ecc3e917692a4deacf1cb95fcdbb5e7b30d8

SHA256
d86c9caf51027de700708b2c678aaf60e3e13dd669fbb3a918b84e6a9b37711f

SHA512
35ae4c5c7806a4a4607d5e76c82500fca08ba9e486961fd78381a0765dde0284667639738943485abd20ac6cee88d13f20d9f983bddd9e1e93b29210deabb137

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
9cc98c869b1ea0cc6ccf4d7400f78482

SHA1
2ab91486660ff04df77a2e36374955797021ab4f

SHA256
18c344e60ac83192e7c402e3645d27fd84e1ccffd9580f8a385ddd194e39d443

SHA512
c9816fc6a7717d07ae6fe49eafde9a32a6bd656322f2cef39fc72e5371e72c7089e5d549dc767d4772591b91558e378c420c208c8a9657a1120ebeb1363b7434

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
3d168217a0276e39c5a217f3246cbe0b

SHA1
cd2537d33c3e744e559d6aea273781f1868cdab6

SHA256
c42de6b1f8f9bc2affce2b48c2a56b6ed49c972597a4ffbce1009c2ac2b5c4d0

SHA512
2020837472a1b24a63e642210b054480925ef31689321ce2e9705580693b0529c0ca29cb821ace5955992cfbb2303e64a7175b0bc5d1ae12956692ff5a638729

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
c38b012281fc2f60725e491151909d9b

SHA1
fe3ca41a6330b1eb6cca1da3f528dee612bea697

SHA256
abc1ab6bd80ff48fc0ab589b34c8713c542da1b9bff4ce057c1818d4f78ba857

SHA512
bd8f1e0a0ac1da6f5b2b83a6ee7b5c11f93a1debb8c1bca29beaab307e04a2645f0c2238ac4e09167188873d2aa7001470d7dd2520fc9c96ade48ba5c4d947b9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
196KB

MD5
0ef48b61bc523d1dbdfcc5944a103feb

SHA1
a37b100ed942d564110d93497dd00e3e895e1d89

SHA256
753ee689b5b876bf3f97102ab8aa0e9245d2295018c141ac7c3e99ee3922850e

SHA512
21b9151493afffc6695cbc5c5100e6ee163085893073dc09bbfcd4228abc342d85d52f20a04ebff439c953a4d6225c45f4f97ccb9c55952cfa1d6a87145d01b5

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
c3ed73ea2f3210077fd46b38f52e8ef6

SHA1
7096bace84137e6b2a2429d9e829e8b0388b0e93

SHA256
35dab9878d37f3180c8ba409c66f8a752ff988cd0cac597f137dbdbd5358f76a

SHA512
c2942d0f2c986f105399a73e91f9ae81c4d1343f4b232f36942491b7178bcb951aae6aca87c95dfca24c6a610c1505608bea5a48b17ccfd4322fbb70ee2e8d7d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
1526613fcda75e8464d6f46e79c83bce

SHA1
69d14c76c3431cc12fa70e6666411146d146f614

SHA256
caf66582aad554a717aa236eb6f5195739a135df6b529fe32504c80981724426

SHA512
eeb2c5818d2d3c15693cb6f540cfb193cf047b6cee4604c3a3e9c624dee467b5b146d8d1a9b798364bd71ad6bdb1ece43cf3de3ca74343e0180642efbf6e3439

Download Submit
C:\Users\Admin\AppData\Local\services.exe

Filesize
196KB

MD5
364b0867184a62e362272b89e4adec90

SHA1
b0025bcdd7ee5e3d44b6519419b409df8c954b2d

SHA256
61cb3786b5ee1578358b41b6f23e0f78a78a5954f8d761846e1c84ad521ca159

SHA512
c948d6230417e5604c4003cc29ee57991723d3692c97a708d6c21623dc561326ddfc6ef0622ae34510967454df2ee7d7959629805de7249e9ad6f69d18115a2e

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
50a52ff86359816b3bd185e7d2c58b44

SHA1
c8308521407b67113104d27cb0ad42d9022607ac

SHA256
cba69b919268a215d1a05f98b70d989c20ae50efcc7cab09a5c852a8667f9816

SHA512
b2401c91917ae98a95b7a989bb5ce2e795da31072d4658b45f9f29e39e1f9a61f7ad6f86cf783eed95dba50b7ef2207a9cdebefd9321932398ede060ab462f09

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
02d376dacff23be6394ecfff8b0db363

SHA1
060296c6c9a9f0c3b071087ba97fdbc45b5cd213

SHA256
3451691b473dc218e1d1629b8db2d821c20c957b6c81cdce3ae966149ae7c6c8

SHA512
d60414aeb4ccea726b074b07a083f57df2fe221b832204e12ce6dbc9ea1b117562139879bca8afbe0751148ca50556d6c08643887ca78d70a44c1153a9e2f91e

Download Submit
C:\Windows\xk.exe

Filesize
196KB

MD5
96fb97dd64a4ff94973e83028ecc7ded

SHA1
6be52da5eac397bf64d983b8e6c71095dad51c74

SHA256
f0f2ef6e761178e530469abe3a5cccad84363dfd4d48df0e131c393d0da50b10

SHA512
e8e7b313915d96088d06067e80ea408df119f86a8471f8a0e66691867965f671d78d5ffcf40166058dc735c08d8904cccf8c5ac957bef04c7d9d4ac6a0ab1d29

Download Submit
C:\Windows\xk.exe

Filesize
196KB

MD5
0ae72b95d2db294a5351c3a764285085

SHA1
dbe610e72adf3ee60a34745235b1246c3ed8d059

SHA256
91e3244898fe7605e2ce664b9868b32b2cc19f680ad6dd097ef7082d33d20694

SHA512
f808447b4848835911d734732d483873ae10b47f6f2246e6cccc70a40b1fdf4aa951d04bab7ec83995d47caedd73450c68e0ce7a6eb50db36ae4d173719eb4bd

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
7b2e729b74708bc56446fd78d4ac62a0

SHA1
1235ecc3e917692a4deacf1cb95fcdbb5e7b30d8

SHA256
d86c9caf51027de700708b2c678aaf60e3e13dd669fbb3a918b84e6a9b37711f

SHA512
35ae4c5c7806a4a4607d5e76c82500fca08ba9e486961fd78381a0765dde0284667639738943485abd20ac6cee88d13f20d9f983bddd9e1e93b29210deabb137

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
7b2e729b74708bc56446fd78d4ac62a0

SHA1
1235ecc3e917692a4deacf1cb95fcdbb5e7b30d8

SHA256
d86c9caf51027de700708b2c678aaf60e3e13dd669fbb3a918b84e6a9b37711f

SHA512
35ae4c5c7806a4a4607d5e76c82500fca08ba9e486961fd78381a0765dde0284667639738943485abd20ac6cee88d13f20d9f983bddd9e1e93b29210deabb137

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
9cc98c869b1ea0cc6ccf4d7400f78482

SHA1
2ab91486660ff04df77a2e36374955797021ab4f

SHA256
18c344e60ac83192e7c402e3645d27fd84e1ccffd9580f8a385ddd194e39d443

SHA512
c9816fc6a7717d07ae6fe49eafde9a32a6bd656322f2cef39fc72e5371e72c7089e5d549dc767d4772591b91558e378c420c208c8a9657a1120ebeb1363b7434

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
196KB

MD5
9cc98c869b1ea0cc6ccf4d7400f78482

SHA1
2ab91486660ff04df77a2e36374955797021ab4f

SHA256
18c344e60ac83192e7c402e3645d27fd84e1ccffd9580f8a385ddd194e39d443

SHA512
c9816fc6a7717d07ae6fe49eafde9a32a6bd656322f2cef39fc72e5371e72c7089e5d549dc767d4772591b91558e378c420c208c8a9657a1120ebeb1363b7434

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
196KB

MD5
58d2491d4b879124a8afcf5d120064ab

SHA1
5e23391e19d68dc43e0908e93588722cf4939e18

SHA256
6d8d075c96802de87230a20f6afd83297bfbe300c79f4cdb247d87b6f05f2c3a

SHA512
4f0a593a74eefdeaa5ef114bbe0825503110f4a79d18d171b083e058984581a892e56a1d67156667c50137b7ed9d0646b8b59b2107a63ad2e1c19c47870bff33

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
3d168217a0276e39c5a217f3246cbe0b

SHA1
cd2537d33c3e744e559d6aea273781f1868cdab6

SHA256
c42de6b1f8f9bc2affce2b48c2a56b6ed49c972597a4ffbce1009c2ac2b5c4d0

SHA512
2020837472a1b24a63e642210b054480925ef31689321ce2e9705580693b0529c0ca29cb821ace5955992cfbb2303e64a7175b0bc5d1ae12956692ff5a638729

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
3d168217a0276e39c5a217f3246cbe0b

SHA1
cd2537d33c3e744e559d6aea273781f1868cdab6

SHA256
c42de6b1f8f9bc2affce2b48c2a56b6ed49c972597a4ffbce1009c2ac2b5c4d0

SHA512
2020837472a1b24a63e642210b054480925ef31689321ce2e9705580693b0529c0ca29cb821ace5955992cfbb2303e64a7175b0bc5d1ae12956692ff5a638729

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
c38b012281fc2f60725e491151909d9b

SHA1
fe3ca41a6330b1eb6cca1da3f528dee612bea697

SHA256
abc1ab6bd80ff48fc0ab589b34c8713c542da1b9bff4ce057c1818d4f78ba857

SHA512
bd8f1e0a0ac1da6f5b2b83a6ee7b5c11f93a1debb8c1bca29beaab307e04a2645f0c2238ac4e09167188873d2aa7001470d7dd2520fc9c96ade48ba5c4d947b9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
196KB

MD5
c38b012281fc2f60725e491151909d9b

SHA1
fe3ca41a6330b1eb6cca1da3f528dee612bea697

SHA256
abc1ab6bd80ff48fc0ab589b34c8713c542da1b9bff4ce057c1818d4f78ba857

SHA512
bd8f1e0a0ac1da6f5b2b83a6ee7b5c11f93a1debb8c1bca29beaab307e04a2645f0c2238ac4e09167188873d2aa7001470d7dd2520fc9c96ade48ba5c4d947b9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
196KB

MD5
0ef48b61bc523d1dbdfcc5944a103feb

SHA1
a37b100ed942d564110d93497dd00e3e895e1d89

SHA256
753ee689b5b876bf3f97102ab8aa0e9245d2295018c141ac7c3e99ee3922850e

SHA512
21b9151493afffc6695cbc5c5100e6ee163085893073dc09bbfcd4228abc342d85d52f20a04ebff439c953a4d6225c45f4f97ccb9c55952cfa1d6a87145d01b5

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
196KB

MD5
0ef48b61bc523d1dbdfcc5944a103feb

SHA1
a37b100ed942d564110d93497dd00e3e895e1d89

SHA256
753ee689b5b876bf3f97102ab8aa0e9245d2295018c141ac7c3e99ee3922850e

SHA512
21b9151493afffc6695cbc5c5100e6ee163085893073dc09bbfcd4228abc342d85d52f20a04ebff439c953a4d6225c45f4f97ccb9c55952cfa1d6a87145d01b5

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
c3ed73ea2f3210077fd46b38f52e8ef6

SHA1
7096bace84137e6b2a2429d9e829e8b0388b0e93

SHA256
35dab9878d37f3180c8ba409c66f8a752ff988cd0cac597f137dbdbd5358f76a

SHA512
c2942d0f2c986f105399a73e91f9ae81c4d1343f4b232f36942491b7178bcb951aae6aca87c95dfca24c6a610c1505608bea5a48b17ccfd4322fbb70ee2e8d7d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
c3ed73ea2f3210077fd46b38f52e8ef6

SHA1
7096bace84137e6b2a2429d9e829e8b0388b0e93

SHA256
35dab9878d37f3180c8ba409c66f8a752ff988cd0cac597f137dbdbd5358f76a

SHA512
c2942d0f2c986f105399a73e91f9ae81c4d1343f4b232f36942491b7178bcb951aae6aca87c95dfca24c6a610c1505608bea5a48b17ccfd4322fbb70ee2e8d7d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
1526613fcda75e8464d6f46e79c83bce

SHA1
69d14c76c3431cc12fa70e6666411146d146f614

SHA256
caf66582aad554a717aa236eb6f5195739a135df6b529fe32504c80981724426

SHA512
eeb2c5818d2d3c15693cb6f540cfb193cf047b6cee4604c3a3e9c624dee467b5b146d8d1a9b798364bd71ad6bdb1ece43cf3de3ca74343e0180642efbf6e3439

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
196KB

MD5
1526613fcda75e8464d6f46e79c83bce

SHA1
69d14c76c3431cc12fa70e6666411146d146f614

SHA256
caf66582aad554a717aa236eb6f5195739a135df6b529fe32504c80981724426

SHA512
eeb2c5818d2d3c15693cb6f540cfb193cf047b6cee4604c3a3e9c624dee467b5b146d8d1a9b798364bd71ad6bdb1ece43cf3de3ca74343e0180642efbf6e3439

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
50a52ff86359816b3bd185e7d2c58b44

SHA1
c8308521407b67113104d27cb0ad42d9022607ac

SHA256
cba69b919268a215d1a05f98b70d989c20ae50efcc7cab09a5c852a8667f9816

SHA512
b2401c91917ae98a95b7a989bb5ce2e795da31072d4658b45f9f29e39e1f9a61f7ad6f86cf783eed95dba50b7ef2207a9cdebefd9321932398ede060ab462f09

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
50a52ff86359816b3bd185e7d2c58b44

SHA1
c8308521407b67113104d27cb0ad42d9022607ac

SHA256
cba69b919268a215d1a05f98b70d989c20ae50efcc7cab09a5c852a8667f9816

SHA512
b2401c91917ae98a95b7a989bb5ce2e795da31072d4658b45f9f29e39e1f9a61f7ad6f86cf783eed95dba50b7ef2207a9cdebefd9321932398ede060ab462f09

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
02d376dacff23be6394ecfff8b0db363

SHA1
060296c6c9a9f0c3b071087ba97fdbc45b5cd213

SHA256
3451691b473dc218e1d1629b8db2d821c20c957b6c81cdce3ae966149ae7c6c8

SHA512
d60414aeb4ccea726b074b07a083f57df2fe221b832204e12ce6dbc9ea1b117562139879bca8afbe0751148ca50556d6c08643887ca78d70a44c1153a9e2f91e

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
196KB

MD5
02d376dacff23be6394ecfff8b0db363

SHA1
060296c6c9a9f0c3b071087ba97fdbc45b5cd213

SHA256
3451691b473dc218e1d1629b8db2d821c20c957b6c81cdce3ae966149ae7c6c8

SHA512
d60414aeb4ccea726b074b07a083f57df2fe221b832204e12ce6dbc9ea1b117562139879bca8afbe0751148ca50556d6c08643887ca78d70a44c1153a9e2f91e

Download Submit
memory/672-177-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/672-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/752-158-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/752-154-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1184-319-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1184-423-0x0000000073EE1000-0x0000000073EE2000-memory.dmp

Filesize
4KB

Download
memory/1184-450-0x0000000073A1D000-0x0000000073A28000-memory.dmp

Filesize
44KB

Download
memory/1184-320-0x0000000073A1D000-0x0000000073A28000-memory.dmp

Filesize
44KB

Download
memory/1212-275-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-335-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-225-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-269-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-109-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-263-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-220-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-257-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-449-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-422-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-142-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-381-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-166-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-286-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1212-247-0x00000000004B0000-0x00000000004DF000-memory.dmp

Filesize
188KB

Download
memory/1644-261-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1700-113-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1700-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1788-283-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1816-229-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1952-294-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2116-249-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2320-272-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2680-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-121-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3060-134-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download