c949db9fb84a53c8e80f100389ea7006a44a9f57d98134c3d7abc73aa5c823b2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
Size

466KB
MD5

4a85a67e0175956b1f9ce180c2fe1fe0
SHA1

36ef240009c9f6157a1f07b5767acb3e499e5e40
SHA256

c949db9fb84a53c8e80f100389ea7006a44a9f57d98134c3d7abc73aa5c823b2
SHA512

0078538a6ecc7d4a5befec1027ddf39cf7850f6e38ae7ff7b3638b8d7983dd8c0543410616b912fc6efc79f8d5270f02f35f1a5767aca8a675ba7f36ea9f9515
SSDEEP

6144:hm6UslnVK8ZiOdphJ/6pMjT5/7riwtIQnpzoFOkjI7TLOvOXgxcXXvWbVkXP7RDd:hmDslUSCaZVW0KGQqB1KiqWwcX

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2780	wmpscfgs.exe
2064	wmpscfgs.exe
1648	wmpscfgs.exe
1600	wmpscfgs.exe

Loads dropped DLL 6 IoCs

pid	Process
2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
2780	wmpscfgs.exe
2780	wmpscfgs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe"	wmpscfgs.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray .exe	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
File created	C:\Program Files (x86)\259429647.dat	wmpscfgs.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	wmpscfgs.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray .exe	wmpscfgs.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray.exe	wmpscfgs.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	wmpscfgs.exe
File created	C:\Program Files (x86)\259471143.dat	wmpscfgs.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
File created	C:\Program Files (x86)\259429818.dat	wmpscfgs.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000864a965aad77f4f1f1e2b06ba95ad4112666e5e22d920783ebd867aea8669186000000000e80000000020000200000003a639452eb6ef945f4950a6632851c3ffbc46fd47aa3d4e3ebc6672454eaffe92000000023f1424dcf0b89f615abb1e317890ee269e73a9dee41bdb30b8b9199534d1ca9400000006b65a6804ac236bc02a9907f38118f5903cbfc015fa51dde61d4ebc463ab06fb98bcc7691a4647d3aaf26c656d4a4e03c556c44e5cea7b592d5a5913a1ae883c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00038a673c0cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5982E11-782F-11EE-AFEF-5E0D397D2A60} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CED0E31-782F-11EE-AFEF-5E0D397D2A60} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000003d3b551ee361197c6a7d5f861fcef6784e228e6e51868dcf6d471532b9ce7a88000000000e80000000020000200000001986b91a5c0b76dc226f6c9b37685b97ace585054fa29e5bc0b8e0d11fecbcc9900000008ee72d9bb16b13e1c3886430a4429a277b724b5eb9e21e9058e20f2a6024b3d0119e9e81f6ee63907246205540a4cfd1b1600f08ec739e27308c7351c3af1cad9c180a47d45f05cfb434fa68270d0bc36f569b9d17279690350a578f153682a35921d3ede5498bc1dde262a56299233fdca323261c65d3f9f4de2468e46d3839db9f5fd92fe1892f16ba61b679e70f0340000000dc5bece21bcf7f9430a618ecdc3ca639c21e9cfe83544cc3348746c23e1be66b5342e6533c5a27d2eaa573241e9543f15683ca7746f1434a6129dadab10cca5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 30ce226f3c0cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "4"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
2780	wmpscfgs.exe
2780	wmpscfgs.exe
2064	wmpscfgs.exe
2064	wmpscfgs.exe
1600	wmpscfgs.exe
1648	wmpscfgs.exe
1648	wmpscfgs.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
Token: SeDebugPrivilege	2780	wmpscfgs.exe
Token: SeDebugPrivilege	2064	wmpscfgs.exe
Token: SeDebugPrivilege	1600	wmpscfgs.exe
Token: SeDebugPrivilege	1648	wmpscfgs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2524	iexplore.exe
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2284	iexplore.exe
2284	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2780	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	28
PID 2980 wrote to memory of 2780	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	28
PID 2980 wrote to memory of 2780	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	28
PID 2980 wrote to memory of 2780	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	28
PID 2980 wrote to memory of 2064	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	29
PID 2980 wrote to memory of 2064	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	29
PID 2980 wrote to memory of 2064	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	29
PID 2980 wrote to memory of 2064	2980	NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe	29
PID 2524 wrote to memory of 2508	2524	iexplore.exe	32
PID 2524 wrote to memory of 2508	2524	iexplore.exe	32
PID 2524 wrote to memory of 2508	2524	iexplore.exe	32
PID 2524 wrote to memory of 2508	2524	iexplore.exe	32
PID 2780 wrote to memory of 1600	2780	wmpscfgs.exe	36
PID 2780 wrote to memory of 1600	2780	wmpscfgs.exe	36
PID 2780 wrote to memory of 1600	2780	wmpscfgs.exe	36
PID 2780 wrote to memory of 1600	2780	wmpscfgs.exe	36
PID 2780 wrote to memory of 1648	2780	wmpscfgs.exe	37
PID 2780 wrote to memory of 1648	2780	wmpscfgs.exe	37
PID 2780 wrote to memory of 1648	2780	wmpscfgs.exe	37
PID 2780 wrote to memory of 1648	2780	wmpscfgs.exe	37
PID 2284 wrote to memory of 2140	2284	iexplore.exe	39
PID 2284 wrote to memory of 2140	2284	iexplore.exe	39
PID 2284 wrote to memory of 2140	2284	iexplore.exe	39
PID 2284 wrote to memory of 2140	2284	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4a85a67e0175956b1f9ce180c2fe1fe0_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
  c:\users\admin\appdata\local\temp\\wmpscfgs.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
    c:\users\admin\appdata\local\temp\\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\259471143.dat

Filesize
4B

MD5
4352d88a78aa39750bf70cd6f27bcaa5

SHA1
3c585604e87f855973731fea83e21fab9392d2fc

SHA256
67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450

SHA512
edf92e3d4f80fc47d948ea2f17b9bfc742d34e2e785a7a4927f3e261e8bd9d400b648bff2123b8396d24fb28f5869979e08d58b4b5d156e640344a2c0a54675d

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f68669b1e7d00c810d112447c731ec

SHA1
fb04378881faf1c0c1acae24972140bf1e1af88e

SHA256
baa9b782ddd05e0dcbbaba5460abde767792344df3e5e903a8e2dde8f774db1f

SHA512
7e25a3614d3add2ba02699087b0af2502fd4eb06f67f7847528ca344947bcae77c169a00b0dd5691a647bd793317e956bef3b3da29879f508b1841bcc608053d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e25792336549093f6625a58649102e7e

SHA1
b89feb3001e5c1a2d0fba19ad7c5a55778f490d0

SHA256
cf01f35d54562508913283e1f6b20d43b03f5363a40560355e36ae4a23657f4d

SHA512
b1a48e0d225b086c1628ab63add9756926ab74591f97b76e63017b2318d687ab0d5b6c63365c3b67c98e7ab6ba384cab61a7a04b941060f578bdb06c41883c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b041b582101c3720d7f86cd53be2bad

SHA1
08b9ecbea661090dbd533cbf6058cc3873f442db

SHA256
6247c408b33f11da0e5e2394698ec26f231061630c644718d9a6fa1f55acc460

SHA512
fd54deaf4cc45d5c7d52c2eb1c4b3a1a6e08cabb67fc513769871a79838244ba8a78f09c0f58c504a45f635e43aecf8b079f207718bf19d6f7a33dec51da004d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daac4aa250892a289c959f4e19f34daf

SHA1
d03bc3f7fd0fad4fe1d3bb1b6b9d0d263ea56a41

SHA256
6a87d7d51d395331a284cc64c23dc72d036f9104d601865ada819ce152ccd0a0

SHA512
a49925efdcc74ac01dded2702c98de395218f4e4e0166e2e011230a859f5c5305ed46baaa21dc3f68e338297132dfc79d50955f198b7353f2488eb198d759e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13357263734e009526b2a05d05a18493

SHA1
2f3b263a7a654120e0e2bbd3095b7e803a12f4f8

SHA256
8b7a7341c666b6ed23dab6214ffec2df20147477631ad024540aa21209154e6f

SHA512
e00126f7275950d02ea620cba85b60d542800f814566741e591b8eeb8e8566afcbde90476f6629ef7a71ec4f9724af5d14fe511c2d439d40c5271aeca638d3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a78745c4a6d60101763177b421184276

SHA1
ce0e0795d1a23fb660a9a2343eae0137cf6331c5

SHA256
83892a6b01537811521fc74c8bf4fffbb64d1d9b801a3d469025599412110635

SHA512
df754e41ac462ce67e94899894953194aae825c2b75bbecfc0a8ee7fc11832693113532eae6775c9057cffb369a76b69b1df519d3d3695e6d441732168647c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d774d313f310cbb28d4d05cdf2a4058

SHA1
adc378a189674a852d4b774b7dec60819f30955e

SHA256
ca00146c23bb3a6a0f5a3e59681801b71866a153e6116686daf21ce0baa0072f

SHA512
8ad6e2983eb9f34392061b6308f2cd81ded55230c819ba35f2e12f1287fcabf12c99cbc38a169042095d7260a5ddf3ebbb8273dee9623183704cfc65c9fb4787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d0ed29730710ff8c9cce2a3a9dfb713

SHA1
9329333c06bd951cbea929df57d4d7f8bb7d7b54

SHA256
08fd3309b1229916fc53a55cb80ab926ba0af57afbdc92257a08d504cf28a8ba

SHA512
26bbdeacdefc0acebeea31b300c9f46260dd7280f304e2ba0be139708acab797783d12a084468a6eac2183bde9dc11846816442a712147c3b80338d271112a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d4b619eb7e1da9d1a955bd989da0abc

SHA1
90f4fec8191e3597e424877cdaae84aa912363cb

SHA256
532c2c61237370e44f8e148ee00079de357e0eb47f5799b2265b04fe676a973c

SHA512
acef6713a8bb23c299bda4aa21486d1922dedb5dc72aec0b06a101582ea9efa972cf34c6fbab7982a4ef8424467d9be8c1084ad5de27f01f93f598f64fcaeeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f41ca7b14b267a4f9a8c0c8b9cc72c0

SHA1
9ac1dbddacd22f1f691b6209f14c426e542eca4e

SHA256
1b59a605c20bd807d5f30cdcda332efb4b2a705c74cfad71b65e9407a192d501

SHA512
81ca22855e47fada791f8dfe300b4ec01458c7099f92c670537345cc008c2e9ed7a1b03cf06463d406bbea7c3f9f8fb911489cc068c315d7b6ae45400c813042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc2367c34dcdf765c16f15759a924d4

SHA1
02d4a5746c9196dc8a8f804d805eea3901c898de

SHA256
8b1535b6bbeac4a602e1609c539a1a2af327da11291a7fef4d309d7b57b09144

SHA512
eff4516c4f5bdbe000ce6efff54ff7b7f8ee93e01733d82d6db35d95ca1b60ddc05eb1e9ce1cbdb06f057c1e34ddbbe2376da95c1b6ccb1f3ca238cac6428015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66431d5ca698ca92afedcc3b07f85f31

SHA1
9e5ce0ebe16b42e1264a77ef96461afb5c91bda1

SHA256
74792b1dc1ce1069aee56fa1aa1aea4c271430d9a2039513513c71ac26987820

SHA512
2ae21eabccf96196da17d4a898b44df61fa4bd918e73a50dea05371865899e309983d280f8a66adb01915dc3faf42a7d7dbfebf56d2ed3a80734c21680e68f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1599b5ad73997202668205f759d5bc

SHA1
2b29a09d647d66dcdeca8e4a3c05e7cfc625feb7

SHA256
609cb901b9e0fe22b41f4111aa1425b1a5c55b51565389c4351096f5d76f1914

SHA512
6a5c11960ce3fb1fe1d7fb73c6c43463957c5bb3c3133ca71bed3e5c3977512b50ce48fe382d93cfe7d8ced4e198639dfb2a8cb38a45ab25e8cd90d73efb071b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90da33eefb318e4248d56f16d184400b

SHA1
45b18e977608caf4985d4e7adbad7870f9253a23

SHA256
766fddac687047587d465de4e4cfcf0b1b0ca8a99f77bc8492561ef7e1ad498e

SHA512
5d72d6ea78f8a3602cd8f33f851f6969921416a54451461ae0064ca4c5fe8c10e39e527c3378db6e0e9e796acabb31dbf72861ab0bc92200b329da42be711bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ccfa6458aa5aca55a6f92b0127ab76e

SHA1
8cd82271ab510a67ed59d0aa1a21177f88a1b5e3

SHA256
3cb26d0871e895714d05d3a915e9640454572cac2cb7fef32d1e05041f2465f5

SHA512
742ea296c0103c00dd90fc2655da31b8e7cf704dcbce6799f8d745a8eb5c5bbe2b58397677883bcd33da283dcf3e9941402e2f6099a14e050f8a391d68b15327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70bb3e5727ec86a0a60caa1813af72de

SHA1
5d3534dddf3b42b1e62be1d539132566447183ba

SHA256
c8eea5ce08ceb5e806587620e26e9aa746277488f6a0df885e74397e0e43c3c4

SHA512
2e31c734df025cf6b980509fd9a572452d68f751120642490e4935be1a6c0f1213a3197749c9e1fff6cade4f2020a398f1f44b29608e9d6304bdec098272a221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a070f50643f8e4ece480e323414556bc

SHA1
7d1cde252847e5ae56038b34d3c3a0816a0c317d

SHA256
7c99cb23ca30fa331d11f69f0f1411664cd25c7549aa47c261b0af3d2b4e6574

SHA512
4d6a1c2fee1b2a332bc0910e06a90a2c6860a4eb8dabbc33a014e3c06933177488c2b5a81f3eaa5f539b07483b72f7601512ee3e95520bb40168329efbc4c7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26dbff3164c3d58c8d5af1c50fe11cec

SHA1
132dc22de8220a5f69b8525c177578f520b749f6

SHA256
57a75404196eb586f23da08c20c5afc1e6388e44a6a7ccc7c187811e7b3ade47

SHA512
76c5e49e528e510e52b21d94f9a33a89173525dbd20b69ba7f2dfe120aa66455ad0e785f4c6ff9f4605dcb13b4dd7d9f862b2aa8ee78cdabd1f736bfec8c608e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a66993ee6d145373af1df1a0943873

SHA1
2f8c4fd9132dbf3abfbbd35827bbe4a69a0eab81

SHA256
55981a5ed259cdd5ef1eeead672f55cadb02e3eb25377f79358b5ae48781cd1e

SHA512
5bb593d9889db4ae7abfe0f8e3cd0744a876d1bf0a6db87b5c874db17fd948e0e7a75fc332e403411b7923279a11fe9f1eeeba65aa0d6a8a40c8b2e4a18076aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FDA.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA05A.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
\??\c:\program files (x86)\adobe\acrotray .exe

Filesize
489KB

MD5
e851829bb227a64441810fae116a153a

SHA1
754713e79b6fefd65fd541cdf8b2e41d8e22e43c

SHA256
f15dc204df29ab67d24f9b1993693603c2f26d6b39ed9e33ff595af0a5c1a860

SHA512
7c76275d44873b0e7f7d1d6e9251bfdd760ee73242caa9a37a25a6ccfa354a1b106baf0e29378c44a2f28b9feb21aef78702b682cdf0010c72309e0ec543bfe8

Download Submit
\??\c:\program files (x86)\adobe\acrotray.exe

Filesize
470KB

MD5
9bd30b80feea13e9b2998b8eae3bd306

SHA1
31ccc755972eb58f50c1de63350da8a51deac473

SHA256
341da88923bb58da9b2f65cc2828a9d1a646662734417efba11928384d229ad5

SHA512
0102c5973816185c7b766e2258e70cecd4db85e2ccaead81b3f4a4a5c10d71e3a38144933f03ebb61090902f0fc176646a256972cdeb1cf8bf9f4c1394221427

Download Submit
\??\c:\program files (x86)\microsoft office\office14\bcssync.exe

Filesize
473KB

MD5
353570c2a8ff14899f4918e36ea9c148

SHA1
e9a80920c9a269ea228067aea3ef7cfdd7438170

SHA256
6367fe75ff16ddf6ff7d0014a26661a3b93e69252fa712ae6e13572d936b7f27

SHA512
567d5c52ceb9260f23ee5eda07c3bcaa1c42e568e5efe3d15283073041cb5870901c9372ad7f5e384a0df52ee89ddfd25124f9d4a303d044e493774e601bf3cc

Download Submit
\??\c:\users\admin\appdata\local\temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
501KB

MD5
e1d4b625cff7be7ce1cb16d85174d8d0

SHA1
e14749dc7cba5cea2153d9d1f87abe6d5d6aab80

SHA256
8fb89af65a34931a5facbb48f2a04cf8fec20ef6ce74605786b2363e27a92ee3

SHA512
86c2436714711890a24cfae17149daa25b56d9db4d06dd2ffb5472849d85234febe29738f335aee39da0d45f96c92b5dd098dd3161fe9bcc4cec3bd2cf131b4a

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

Filesize
469KB

MD5
b03361d03ffbc69df4b71058d95136c0

SHA1
0cfb3017a3f8f19c4b40fe04e3a058e578de60da

SHA256
b6f300bfdbda48aa32ab1cbb199ca72ac63f60f9c2b38f7661ba9c816bbae10f

SHA512
3ace5fbf93763f4baf92c402deeb336c1a0789876f29e8c971b80ed8dc09b1ba28a24abe78c9b5ff070ca958de67ba194671c16ee8b9e57fc6b6dee97e0f0fb2

Download Submit
memory/1648-771-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2064-35-0x0000000000380000-0x0000000000382000-memory.dmp

Filesize
8KB

Download
memory/2780-22-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2980-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download