3add55ddeb3740a7a9fa222dc8bf4ac777407d07c7504ccccb5d46d950cd365b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Size

336KB
MD5

6e3e6a5e0abfff33a2e67a850c240340
SHA1

42a57757d38510d213b434de24abd462c209f13d
SHA256

3add55ddeb3740a7a9fa222dc8bf4ac777407d07c7504ccccb5d46d950cd365b
SHA512

c55fa6873a394946827f71cbff643c163c08ec8e996975b4d6ba012bbfde08e8aececfa93a36eadcaa3d1ad251215de0627a63492669bb11e5ac835095775147
SSDEEP

6144:2hF4cO+wWJH7igNgjdFKsloSWRARoYlld9n2Qpmx:2MVzX5oSVoYXC

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
884	xk.exe
3196	IExplorer.exe
3800	WINLOGON.EXE
2740	CSRSS.EXE
536	SERVICES.EXE
1520	LSASS.EXE
1584	SMSS.EXE
4852	xk.exe
2076	IExplorer.exe
4136	WINLOGON.EXE
2396	CSRSS.EXE
3528	SERVICES.EXE
4196	LSASS.EXE
4228	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e14-8.dat	upx
behavioral2/files/0x0006000000022e19-56.dat	upx
behavioral2/files/0x0006000000022e19-55.dat	upx
behavioral2/memory/884-57-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/884-60-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1d-62.dat	upx
behavioral2/memory/3196-64-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1d-63.dat	upx
behavioral2/memory/3196-67-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1f-69.dat	upx
behavioral2/memory/3800-70-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1f-71.dat	upx
behavioral2/memory/3800-74-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e20-76.dat	upx
behavioral2/memory/4904-77-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/2740-78-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e20-79.dat	upx
behavioral2/memory/2740-82-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e21-84.dat	upx
behavioral2/memory/536-85-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e21-86.dat	upx
behavioral2/memory/536-89-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e22-91.dat	upx
behavioral2/files/0x0006000000022e22-93.dat	upx
behavioral2/memory/1520-92-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/1520-96-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e23-98.dat	upx
behavioral2/files/0x0006000000022e23-100.dat	upx
behavioral2/memory/1584-99-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/1584-103-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e19-227.dat	upx
behavioral2/memory/4852-228-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/4852-231-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1d-233.dat	upx
behavioral2/memory/2076-234-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/2076-237-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e1f-239.dat	upx
behavioral2/memory/4136-240-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/4136-243-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e20-245.dat	upx
behavioral2/memory/2396-246-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/2396-249-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e21-251.dat	upx
behavioral2/memory/3528-253-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/3528-255-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e22-257.dat	upx
behavioral2/memory/4196-258-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/4196-263-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/files/0x0006000000022e23-291.dat	upx
behavioral2/memory/4228-292-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/4228-295-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral2/memory/4904-296-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	F:\desktop.ini	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened for modification	C:\desktop.ini	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File created	C:\desktop.ini	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened for modification	F:\desktop.ini	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\R:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\W:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\B:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\G:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\N:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\Q:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\X:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\Y:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\Z:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\I:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\L:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\K:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\O:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\P:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\S:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\T:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\E:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\H:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\V:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\M:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened (read-only)	\??\U:	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File created	C:\Windows\SysWOW64\shell.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File created	C:\Windows\SysWOW64\Mig2.scr	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
File created	C:\Windows\xk.exe	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\Desktop\	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
884	xk.exe
3196	IExplorer.exe
3800	WINLOGON.EXE
2740	CSRSS.EXE
536	SERVICES.EXE
1520	LSASS.EXE
1584	SMSS.EXE
4852	xk.exe
2076	IExplorer.exe
4136	WINLOGON.EXE
2396	CSRSS.EXE
3528	SERVICES.EXE
4196	LSASS.EXE
4228	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 884	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	89
PID 4904 wrote to memory of 884	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	89
PID 4904 wrote to memory of 884	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	89
PID 4904 wrote to memory of 3196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	90
PID 4904 wrote to memory of 3196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	90
PID 4904 wrote to memory of 3196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	90
PID 4904 wrote to memory of 3800	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	91
PID 4904 wrote to memory of 3800	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	91
PID 4904 wrote to memory of 3800	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	91
PID 4904 wrote to memory of 2740	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	92
PID 4904 wrote to memory of 2740	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	92
PID 4904 wrote to memory of 2740	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	92
PID 4904 wrote to memory of 536	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	94
PID 4904 wrote to memory of 536	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	94
PID 4904 wrote to memory of 536	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	94
PID 4904 wrote to memory of 1520	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	95
PID 4904 wrote to memory of 1520	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	95
PID 4904 wrote to memory of 1520	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	95
PID 4904 wrote to memory of 1584	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	96
PID 4904 wrote to memory of 1584	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	96
PID 4904 wrote to memory of 1584	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	96
PID 4904 wrote to memory of 4852	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	103
PID 4904 wrote to memory of 4852	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	103
PID 4904 wrote to memory of 4852	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	103
PID 4904 wrote to memory of 2076	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	104
PID 4904 wrote to memory of 2076	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	104
PID 4904 wrote to memory of 2076	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	104
PID 4904 wrote to memory of 4136	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	106
PID 4904 wrote to memory of 4136	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	106
PID 4904 wrote to memory of 4136	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	106
PID 4904 wrote to memory of 2396	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	107
PID 4904 wrote to memory of 2396	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	107
PID 4904 wrote to memory of 2396	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	107
PID 4904 wrote to memory of 3528	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	108
PID 4904 wrote to memory of 3528	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	108
PID 4904 wrote to memory of 3528	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	108
PID 4904 wrote to memory of 4196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	109
PID 4904 wrote to memory of 4196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	109
PID 4904 wrote to memory of 4196	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	109
PID 4904 wrote to memory of 4228	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	112
PID 4904 wrote to memory of 4228	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	112
PID 4904 wrote to memory of 4228	4904	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe	112

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6e3e6a5e0abfff33a2e67a850c240340.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4904
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:884
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3196
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3800
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2740
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:536
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1520
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1584
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4852
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4136
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2396
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3528
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4196
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
336KB

MD5
ffcc557fb8dedc8199ab2ee4a8bac09a

SHA1
5ef12fc563e5b156712605aa23a1a4ec994324a9

SHA256
742d8998aa0a716ea52ee2da0b6e3852b45fdd2a7307c157c2ddfe2844c5d16b

SHA512
ecdba0839c573d71b338b1efe3c6740696d70bbba8be66fae931d5f77228985a14795308d4b291a210639147fef414082601760910524ed13d16fe3b60858876

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
336KB

MD5
630f336de029cdb0e2d8466e1492551e

SHA1
cccd33418e75db43617699c6e5564f074bec3d7f

SHA256
cbe5016300835a8b65b7f33db76e398c61c5b68159da6f78d585a8dd34af95f2

SHA512
e09efe728183f734628c5d275e630b4862c0dc4602c22337696b8679007fcd0770375325640b5b6e59c73d0db6f35ba68e89f75432c5d1616ee16a7ae3170a08

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
336KB

MD5
7238e700ce9a3121e4a83232c1523840

SHA1
927c1963796fc73853f6d7e2b7d006199082e86e

SHA256
dfd20b0e755cede74e844c603270214a42cccf3f71490dcdd73f9cd575ce0326

SHA512
6af2b1ea9259bc2541c0a5a03ea7bac3101deb322bd21b7a1ef5c4fd658187e7e11f8dedb94a421e8c19d4f009e02976fb46e35b38eaceabda1373f527cf5666

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
336KB

MD5
35d09acd4ad8a7b508bf84bb6840c5b2

SHA1
3ebccd5fdaeb09956ac9e5ea06427639589a91b1

SHA256
54c5800c56a18d8e91415ed980757fb6e5b10ca3252da9c9acef46382659aea9

SHA512
39c9025aae4de28aae482204f5263f65bc52dc042a56c5085bb7f5748d9a45bd5be0675dc44090f04effdaab33e4ee17a1064a53f25a0788d15c0161c4227e69

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
336KB

MD5
42286253bf362efd3d1222019276bf58

SHA1
63700ccfeaa24e5e0117dc2593aaf96ea5b2149b

SHA256
c79583423aa15fe56a97a5c62632d05ff51c1c36204568d66948354645471656

SHA512
6a86a13a94d8aef3082176a9a609981e72bf5adb1e0e8ede1a52747f748f6266cedac5c3846fcd92a2652c5b45c30eb7ed94200eceb21be15977b3956f5a1f10

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
336KB

MD5
43775c3ec1647a9c9eac14d96d2888f9

SHA1
2e2d573fbff12258d5e7a36f629080840b57a385

SHA256
3988d0c425ac22c472f8ca96b40fc0c71f1529be812b57da804bda9dd88f94bc

SHA512
c417969db024e66e215627c4fa5b74c23ddc983a55c2970d8935c6eca2073a27ea21c44345e0ad899e0a567b99f62d19ff1730293b72733b3f5027cd257c9b85

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
336KB

MD5
2b5849c88a6eafb9ce923677fa0a3e27

SHA1
7cd18c0bdd064e0021be4e3c47d064ff387af654

SHA256
d5ea892bb5a1b0adb897aa40a7fc2d239015ba876c9dcb557cb825ff6b6b4b1e

SHA512
08357da3f64a64b25d8d99da65743d918d97979587455e203a53a89dce66fbadbffb60121c924db5f0d45da1fabfaed0a25a9f41e2d9ea5ea19fc6338456711e

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
336KB

MD5
85549a17c0a9c71b6436ff7343525296

SHA1
37518b54175d79c11e183d5f1f90367931d2c5aa

SHA256
c4c2a3c530996ef2ac7c5c8c829786a9ea6a6be28ca59e7a9ab87f31301b2bd7

SHA512
c51b6eb3f8b4a0e564e74621f843c0c75f0e9d169c3dbeb5e639cc1d90fa1c4e65dbc5ef1ddeb3fe676a2efb406b464b34117a0e33fe9a5dab2ec8d6e30c9118

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
336KB

MD5
1f93f30ef7874f31a13da50c8c1b8464

SHA1
7c9340f59dff288ce708afab258bb48c2f30047e

SHA256
d6f8168c13012f8bcbf76d25fba27d20482204e3393d9d6d11030c75d26410e0

SHA512
8275273c44ad65140f222af496a52beadc2da06f663eda49c5225281e617214bccd83c1257ecb58b1d26b79a77a1f41c7655fc1df3111d938d291f18e679a6db

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
336KB

MD5
319a1d848c0a088846120900caba6607

SHA1
0025e3863d39daf6e4be93154c002968b0dc7c22

SHA256
c264137c9ef8eda406682fe5b2fe4b200860762e1939baaf4ce49571e3007a47

SHA512
ce904483a9940bcda61b455b4a6f7106efd382d96b85d4d72938c742240e8560b3595a69adbcb8fdb6740c8400ab8698d1b56100b400ad1e5a9f59de31074bb5

Download Submit
C:\Users\Admin\AppData\Local\winlogon.exe

Filesize
336KB

MD5
6e3e6a5e0abfff33a2e67a850c240340

SHA1
42a57757d38510d213b434de24abd462c209f13d

SHA256
3add55ddeb3740a7a9fa222dc8bf4ac777407d07c7504ccccb5d46d950cd365b

SHA512
c55fa6873a394946827f71cbff643c163c08ec8e996975b4d6ba012bbfde08e8aececfa93a36eadcaa3d1ad251215de0627a63492669bb11e5ac835095775147

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
336KB

MD5
630f336de029cdb0e2d8466e1492551e

SHA1
cccd33418e75db43617699c6e5564f074bec3d7f

SHA256
cbe5016300835a8b65b7f33db76e398c61c5b68159da6f78d585a8dd34af95f2

SHA512
e09efe728183f734628c5d275e630b4862c0dc4602c22337696b8679007fcd0770375325640b5b6e59c73d0db6f35ba68e89f75432c5d1616ee16a7ae3170a08

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
336KB

MD5
35d09acd4ad8a7b508bf84bb6840c5b2

SHA1
3ebccd5fdaeb09956ac9e5ea06427639589a91b1

SHA256
54c5800c56a18d8e91415ed980757fb6e5b10ca3252da9c9acef46382659aea9

SHA512
39c9025aae4de28aae482204f5263f65bc52dc042a56c5085bb7f5748d9a45bd5be0675dc44090f04effdaab33e4ee17a1064a53f25a0788d15c0161c4227e69

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
336KB

MD5
43775c3ec1647a9c9eac14d96d2888f9

SHA1
2e2d573fbff12258d5e7a36f629080840b57a385

SHA256
3988d0c425ac22c472f8ca96b40fc0c71f1529be812b57da804bda9dd88f94bc

SHA512
c417969db024e66e215627c4fa5b74c23ddc983a55c2970d8935c6eca2073a27ea21c44345e0ad899e0a567b99f62d19ff1730293b72733b3f5027cd257c9b85

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
336KB

MD5
85549a17c0a9c71b6436ff7343525296

SHA1
37518b54175d79c11e183d5f1f90367931d2c5aa

SHA256
c4c2a3c530996ef2ac7c5c8c829786a9ea6a6be28ca59e7a9ab87f31301b2bd7

SHA512
c51b6eb3f8b4a0e564e74621f843c0c75f0e9d169c3dbeb5e639cc1d90fa1c4e65dbc5ef1ddeb3fe676a2efb406b464b34117a0e33fe9a5dab2ec8d6e30c9118

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
336KB

MD5
319a1d848c0a088846120900caba6607

SHA1
0025e3863d39daf6e4be93154c002968b0dc7c22

SHA256
c264137c9ef8eda406682fe5b2fe4b200860762e1939baaf4ce49571e3007a47

SHA512
ce904483a9940bcda61b455b4a6f7106efd382d96b85d4d72938c742240e8560b3595a69adbcb8fdb6740c8400ab8698d1b56100b400ad1e5a9f59de31074bb5

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
336KB

MD5
4c4d938250a048797117d24eac1f4f71

SHA1
60edee25304041b1de4da1d4736479cbe0d73e1d

SHA256
d8563ff7117ef383e500440f86332e0cc8262122b2d264ab93de3669b7002d4b

SHA512
be40585f852ef109fa4483f1ecf4b06cbd6615ce13f8e76541618b303311b2c2745c296bb5082fc1eafde37ce8e3661cd19725d9cb1af75726f414fbcf333e6e

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
336KB

MD5
f1816fcaee7dbd966ba4cc1c6e688e39

SHA1
f88e1f7a5e60bba5a8d5e8581b40b5e504846619

SHA256
e6ddf26339ab5c54b8275d1469db97502617019a80c9326c9ec7d9310bce7a87

SHA512
ad408eaed4df354966655cd5cbdd98b3b2eaf600b3e4074efa7cfffe5e73d4fefb5acb35c855b11fe4374d157f463c3398900f727707d2faffcff7a15222d16f

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
336KB

MD5
f1816fcaee7dbd966ba4cc1c6e688e39

SHA1
f88e1f7a5e60bba5a8d5e8581b40b5e504846619

SHA256
e6ddf26339ab5c54b8275d1469db97502617019a80c9326c9ec7d9310bce7a87

SHA512
ad408eaed4df354966655cd5cbdd98b3b2eaf600b3e4074efa7cfffe5e73d4fefb5acb35c855b11fe4374d157f463c3398900f727707d2faffcff7a15222d16f

Download Submit
C:\Windows\xk.exe

Filesize
336KB

MD5
c5a627cab34ae573de259644e3f9e544

SHA1
8577647ce747b30486f543e428097b9f8e0e6e73

SHA256
6d101d3e45ed48305f8d66d979e75dfd5fbf94d3b48002a3d78c1cade9b54337

SHA512
51a5ca20ecf35bd30adaf2473638e2285b155b9b84617dff6493f94b228ff1e77e69d640698d8e9f7eb11d581e7caee747bcd80d6de9dd0ecc8b7cde333061bf

Download Submit
C:\Windows\xk.exe

Filesize
336KB

MD5
82887113028d5aab1899cabf8b310a11

SHA1
ce75b2d12e8f1c39a5b112729c8387c68bfd62bd

SHA256
5fec8a3a18fea80d5e661f61123a4430baa6d1ab51821232abfab240fad74c8e

SHA512
f6c93e0d9348b608339dbd8281b8b0dbc82c432f384684e3a1344b0beb2f4f485fd4e87cf5c085e7b1ff57dbea658886f61cd955132e0f516870afbfbb53cbd9

Download Submit
C:\Windows\xk.exe

Filesize
336KB

MD5
82887113028d5aab1899cabf8b310a11

SHA1
ce75b2d12e8f1c39a5b112729c8387c68bfd62bd

SHA256
5fec8a3a18fea80d5e661f61123a4430baa6d1ab51821232abfab240fad74c8e

SHA512
f6c93e0d9348b608339dbd8281b8b0dbc82c432f384684e3a1344b0beb2f4f485fd4e87cf5c085e7b1ff57dbea658886f61cd955132e0f516870afbfbb53cbd9

Download Submit
C:\XK\Folder.htt

Filesize
640B

MD5
5d142e7978321fde49abd9a068b64d97

SHA1
70020fcf7f3d6dafb6c8cd7a55395196a487bef4

SHA256
fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

SHA512
2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

Download Submit
C:\desktop.ini

Filesize
217B

MD5
c00d8433fe598abff197e690231531e0

SHA1
4f6b87a4327ff5343e9e87275d505b9f145a7e42

SHA256
52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e

SHA512
a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1

Download Submit
memory/536-85-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/536-89-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/884-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/884-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1520-92-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1520-96-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1584-103-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1584-99-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2076-234-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2076-237-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2396-246-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2396-249-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2740-78-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2740-82-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3196-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3196-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3528-253-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3528-255-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3800-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3800-70-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4136-240-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4136-243-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4196-258-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4196-263-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4228-292-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4228-295-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4852-231-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4852-228-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4904-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4904-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4904-296-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download