9a28b37b1a41ec52993017236dd78e7259b95395bfa50227d93234d6248e3edf

Analysis

max time kernel
337s
max time network
337s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
27/05/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z.txt
Size

28B
MD5

140c08a251459d3da1442f427fc239a7
SHA1

028259a3584ae7893bd8f0d45433e1c9bfd763e4
SHA256

9a28b37b1a41ec52993017236dd78e7259b95395bfa50227d93234d6248e3edf
SHA512

d4a00853202b3edf7431ac48559e8256c7acb6172222cab1eeb3277aa349360b78f911c7a380fef9bf1dba706c7fa91183edaa665308d75449ad6c1960ce72d5

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
432	winrar-x64-701.exe
3484	winrar-x64-701.exe
2440	winrar-x64-701.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
656	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
9	camo.githubusercontent.com
57	camo.githubusercontent.com
59	camo.githubusercontent.com
71	camo.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\thunderhack-1.6.jar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3144	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
564	7zFM.exe
4624	OpenWith.exe
2356	OpenWith.exe
4676	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeRestorePrivilege	564	7zFM.exe
Token: 35	564	7zFM.exe
Token: SeDebugPrivilege	4336	firefox.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
564	7zFM.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
432	winrar-x64-701.exe
432	winrar-x64-701.exe
432	winrar-x64-701.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
3484	winrar-x64-701.exe
3484	winrar-x64-701.exe
3484	winrar-x64-701.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
2440	winrar-x64-701.exe
2440	winrar-x64-701.exe
2440	winrar-x64-701.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
2356	OpenWith.exe
4676	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3144	4704	cmd.exe	80
PID 4704 wrote to memory of 3144	4704	cmd.exe	80
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 3608 wrote to memory of 4336	3608	firefox.exe	85
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 1676	4336	firefox.exe	86
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87
PID 4336 wrote to memory of 2396	4336	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\z.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\z.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.0.787479415\714617103" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93314789-1986-483f-b7a0-309e77f4edde} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 1832 1b594705d58 gpu
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.1.4345937\255266609" -parentBuildID 20230214051806 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58486976-9d78-43d1-a2ad-9489439c35e7} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 2356 1b58058a258 socket
    3⤵
    - Checks processor information in registry
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.2.376376061\512906720" -childID 1 -isForBrowser -prefsHandle 2856 -prefMapHandle 2904 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c8e1adb-dd1d-40f5-be53-d8641756ef83} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 2940 1b596ef5e58 tab
    3⤵
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.3.1797458778\468637036" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3488 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17002d9d-896b-44e4-843d-9d7da4341873} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 3460 1b58057ae58 tab
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.4.1090227877\1160837300" -childID 3 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1169413c-cfc8-49f5-922a-86906d793217} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 2660 1b596318558 tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.5.1955067420\993337888" -childID 4 -isForBrowser -prefsHandle 2660 -prefMapHandle 5336 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f283de31-67e3-42ee-b54c-c5a924b966c5} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 5072 1b599e39058 tab
    3⤵
    PID:2472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.6.966612066\274598655" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5488 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b107d77-31d1-4b3d-8f69-5817fad12d12} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 5564 1b599e3ae58 tab
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.7.1004736232\1271802152" -childID 6 -isForBrowser -prefsHandle 5868 -prefMapHandle 5864 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cd58447-6448-4219-9d07-b29775c38b32} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 5880 1b59e188558 tab
    3⤵
    PID:1232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.8.1520046352\1462192" -childID 7 -isForBrowser -prefsHandle 3740 -prefMapHandle 3744 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc60bb9a-c580-4db4-88ef-2fd1ad7e7932} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 3728 1b580541b58 tab
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.9.48141908\11080704" -childID 8 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50893929-5c98-4124-87ed-f414ab81e1a5} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 5272 1b59c966558 tab
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4336.10.1387435496\694413487" -childID 9 -isForBrowser -prefsHandle 6404 -prefMapHandle 5552 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1348 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31ffd987-eee5-4d21-9895-6781de8bb21a} 4336 "\\.\pipe\gecko-crash-server-pipe.4336" 6360 1b59d78fe58 tab
    3⤵
    PID:4108
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:432
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3484
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\9a46b50f109f4a6d91c77ac416bd8d56 /t 1788 /p 432
1⤵
PID:1648

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\cfa2dcde3d7c412a99b6a67119555649 /t 1876 /p 3484
1⤵
PID:4068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4456

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\thunderhack-1.6.jar"
1⤵
PID:1072
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:656

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\thunderhack-1.6.jar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4624
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\thunderhack-1.6.jar"
  2⤵
  PID:2364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_thunderhack-1.6.zip\assets\thunderhack\lang\README.txt
1⤵
PID:2240

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\thunderhack-1.6.jAr"
1⤵
PID:2756

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\thunderhack-1.6.jAr"
1⤵
PID:2464

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\thunderhack-1.6.jAr"
1⤵
PID:2140

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f567d5a04ac34ebeb8a58a1b1ae88109 /t 4244 /p 2440
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b9c17602efee2570c419cb2baa4853c5

SHA1
841ac8ea3b4151f80198651d0830f6e91027c07e

SHA256
327d760c27c40a805caaf6fe37022035982911d58c9e5a473df5bc1f7df3fe2b

SHA512
01a27a8903697b6cf2bedc77b992e5c71dea308379139bc664ba8d094a425d634a6abc31edf0e2d5c5ae27e61382bc96b0ebcda7c6e9a126087d7c0a9cc10b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
cd2a10b5c87fe50a7b92942ec74ca1c1

SHA1
a635bdcfb5cbcf3fdba6d572db9c16e5729c3810

SHA256
2fe802904ef69efb0754489eacd9e7828e40a34ba9bf1e436d7ec0212ffdfb44

SHA512
10e7ee843c8b6bf84a83a6e73435cfd0cb2adb99c2d38e8555524bfa3aec9611ce78e904324d75f16e55fc4fd0692c3185802e22c5cf438ba882afea99c7ed82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\activity-stream.discovery_stream.json.tmp

Filesize
30KB

MD5
d6e2d0993d514b246a0043a15fe2923a

SHA1
9b0418f26460890c89bf21080ee4d5d59987852c

SHA256
6c2b4f7154879a4c5e213245bd75d26e0266b2bbdf5a9692e77523c8690368d1

SHA512
0cbd3f32dfe0f0b7844f6b586d1ba594e5ea7d9c8f054ec279001107dcb128d8e0cbb8288e421731f7ac811d95b124aac8d62ec15f7da1bf68fa74125f48d35d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\12022

Filesize
16KB

MD5
fd60aac06f2ea9c5d1dc61e677ae4f3c

SHA1
a899b7d66bfd16820e52dbd55c33f751938deb83

SHA256
63054779c6b45f797a82d56cfaccb33ad1663ce4dec8b11cd89ee080888b3367

SHA512
c4461fb848bd0919652a36444a01ce7f8c669156370f8f6dc711b8c5a3bb83b997f1104955431c69d4b6b94d313c20da70181fd12cd52707735760f82d04e0f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\21289

Filesize
16KB

MD5
38d48862a4eed64365f57c5c20df8d20

SHA1
2f7de99b75045734735faed35c731a2b6955c57f

SHA256
d0efe30ed4e88f819ef16825768af9905afe7e9ba7b7c4e64979f56919b16d66

SHA512
9bb78415daacd57828d7eef8799c0e130b9e95be16ea694e299702c3a2e460a16408046e9ab43e716195454054abf90fd983a22fbbf007f9611c5f74521249f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\26794

Filesize
11KB

MD5
5d9c0e38940a63aa2f160f790840c19e

SHA1
ee9f936ab43825eb6726f7c6b637937959ba2770

SHA256
55b9a4dc24dd880c0930859f615713325678a059afc998faea4a14a02058d346

SHA512
dc97063af8aa94f424e6b3e7b8a6ececc355789fc8620941a244b19a265be72fbc230724b2f5c65a790ddb73bfc497fadbf0540d27f2f6e9427998df80d03c70

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\28157

Filesize
16KB

MD5
2032417a26aabb9da6236c0f899d0b6b

SHA1
d6f0913a30f3473b00f1785a1981396b4fe1d98a

SHA256
822f2cbd6e26c18876f45f5e75fafb1968bbd1171b39ea3d7e96c9e2153d6a36

SHA512
c3c8bffc7187dc3c68540ec7d5401e2378743a7b693de1af803eb5c795df6a1114781d001e8f929a2dcacf2e297cb8921c607ce3f049f68b8a30f5c6e7725e3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\31728

Filesize
16KB

MD5
207ed6b424068e980003393326a99cb3

SHA1
2df1087622f98b273eafe7f368cf20aeb11be4a4

SHA256
6ad72a58f3d3dbc1622f1da2f6420b86d383efd87ae93b22a70f7213186656fb

SHA512
83d75dd2cce9f5df6fec4437181e780d9d60912a3f4136a996d68fd6db120a88c295e0f67d8ea1ad1b95362d07089a95411985a2e305ee5c475ecac706f368fa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\830

Filesize
10KB

MD5
285db2a4215f577d1479f53e3a59b8e9

SHA1
76b7e79274fcd0036da4292be6b104cc6df36d0d

SHA256
ea8b191098bc9c79db344ae36bcd8c4b97c9d1980c80bdb4dd504ab5eff5c9fa

SHA512
dc678d38f4e2580d78ad00a833f467db67db1e504c0b414e9c0d04b2952b3cd5d6e63e97598ff6b7b8d5b30c6d3818ae7a53b1772c0927d6f10613f3670db859

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\8328

Filesize
15KB

MD5
b383d05ed0fe886780d1e32345385085

SHA1
ce6cbe9888354c5ca15289fc49bf6f0588e0f901

SHA256
b7e832cab713a9829818fcf9761526a19e4dfd0ea755032c0e0ff93e1e9efb30

SHA512
cbb6753bf79735b2d8024beaf2b1c916d08b53fa09f91af6fecd422a5f2fe8e287329c9be3cce675527e298ad888f220b63574342c7657a5d00fb5090ca4ac61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\1158B341543196B1FFC5BA8A0B593ABD33165001

Filesize
60KB

MD5
7fbab21d686238efe4e9f9598c3c9af6

SHA1
93fd230265b50c36b4265548bc30071092e6d41c

SHA256
fddafe3dd5aaf581b8a5d67a303bc523f258995285fd71e6c1507a0c8634ded5

SHA512
d419b23df1cb13cc715fd3fde1270811775357eda348dec3db610465df93b25c0418744271ad4e42305caa5368ffce8377aa7ee9658d10f00e91011b8bcb73ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C

Filesize
412KB

MD5
115fa6b94aedf192fed15bc8d8f1454f

SHA1
abc524ffa069341757681d8f4e3a445baeb4567f

SHA256
cf0e84b8a2ebf3403522bf3af4b1044c0a76cbbdfd1d0f149923ef66aa85175b

SHA512
07910840b8a5625da185f49fdf77948d87be2f70a3bcf628ed9b739d701d94951e7cb46055f9afdff0b589e471c65b4e28d27d3f5c4c9ae5665e4feca06709b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
f21c999e04f3ef9f3473be78434a2559

SHA1
b2dc77a87b52e8f5cb8922eb1660876c8727026d

SHA256
a1494c58daaa5b71519cba0588d66fa75f7d9c78d7eb7093a98688ae11757614

SHA512
dcfab979c34fb1ca0f0c86caecc9171e632c326a546c7a303c45afc5808ad19626776754e00a1bf0bdce6a51249e78cea19cb9f45dda44c1622d5fc9ca71f402

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms~RFe5b1bf1.TMP

Filesize
19KB

MD5
dde6ae73d3ddf5716dcbb15caac7552d

SHA1
d8ea60099b4911ebee1e38f5458a5a6bf02c669c

SHA256
aa071a900dc6c28f924d808e43b0441406f7c0417a29e00769b1fa766f0d7d56

SHA512
5f9480c56ed565082f9a7d772c1a7472616fd15399f72877c141bbcfd7b5588ba2e8ffdf6eca579cdf2baba970c7facc3301a4b51f82d0306026e38d3d439c72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
6KB

MD5
6e72cc356595a7a119a9b146940144f4

SHA1
9e644d021853ed473eea573c274754a804ef2301

SHA256
6d020a20f276e3a3ef7af63241ee6eadc2ffdb72b5f2d79d9ee3a4512d485659

SHA512
6d174035d373cde2ed0bf3674af7b20545acfa26029b70bcc224eb251d9a9bbd56b3f4b41f6241cb422d38183accda43291ab5b0b2a3560ba66a48261336edb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
7KB

MD5
2ca8b7ed239fee09131c32624b01dd5c

SHA1
2da38f8db4056114524c2a89f6db23b25ec61164

SHA256
c177256c74f97bab80ee26c7962d409f6d655e07b0c62faf9273c725cc85d091

SHA512
d9d384a1122a286992a65d803641c3c8c6fcdb3e04afe5dce57617d244d4f95175e4dcef1942695de429bba0bab8a91e4a7cba9bdea3bde719b8aa6f50f9828a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs.js

Filesize
6KB

MD5
8596fad8550c46bdf6d89c9fdb9e923a

SHA1
fa05ca48191170849ca5c5a7aefff05f98e49f17

SHA256
7b1c9c345a8892740fea41e34abecfa8c023f8c2359a961046d5a5f348b41040

SHA512
8ba3bedc3bf49e5807e1b2383b10284526ce530654497c077a50e5f30dc5a0985bd70f3983ee6ede11c11d53b09a3d2440a2267eb7e906fc235cbba7cc0f4814

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs.js

Filesize
7KB

MD5
2b76205b6b85ac8abfeac35fc016cff6

SHA1
fa720ae8f42cc6c40645310954f36d9f372644eb

SHA256
29df89ee9618c328d67ad9e3e332f838c4ea62fab8499ac60c6c9439e0edccdb

SHA512
3de5ece08589dc97c1a8135cfcbf325792306feab611a9bc0d82cacaf266d1ec37ac4dcacd9c175d346a20647022c11f0dc09020aaf70eb6b07e499800906ad8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs.js

Filesize
7KB

MD5
4e7bc8f63f82a1ba1f8589a1d6df3946

SHA1
b37622f550b375c2e1935d90a4bd1a9d2878c4a5

SHA256
6942577ed6649399d219e7fceee13578b76e3ca95a04e1e42aabf22eaf1cb235

SHA512
470d9082ab3b45036145245430092185c94aaa16411cd4e63ce07fc44a6285832d5b8100cfc8ea0c5f61cdfd07ec159a9db955fd045368f17023909f2acaf3c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs.js

Filesize
7KB

MD5
f7ac6ee1f2a8b5e92c401a6cedc9ed04

SHA1
57fcc40ee61d33c170a1a4b204a59789e7acac6c

SHA256
1c637fcb1eea545ef97e2bb87a7339233a99ac388a64b63dd9ff426399ae3c52

SHA512
666189894498a1826f2eaf9116c7eae09de137a9d91c29fcd8609110aed6143f5bcf0fad11f84cf4431f25d217726af57aa0b370ed0825eed896a4ee625c345f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
420b06ed45f1d8cd19f3a4c24c934985

SHA1
7a5dd2f3cf3716e819490a05707f83778c5f47c5

SHA256
87cd4bedf0970d87d291e28ed642c827dd88dc53dc8f5df06501fb6a61831d79

SHA512
d0926fad12654ee10f4f9fce93aedf00f82bf74e8969383fb65deb45fd934ec923d057c912eefac90d9cc86de398208576fcbba8fb9f41541939a45fac416b20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
64e6555dd79aae6aa87fefdf4a3ef17c

SHA1
89bce61c4234b3343c18d9ffdf19efa63d5b4c5d

SHA256
1d4965588f13295d185eddb0988cc1fe73a04db11bd4451e282d2ebc780faeec

SHA512
59a2db0bdea5d1010c5ba50ace9404a5f443ca28c84cc650d61a09715ae5afa88e976eaf9f7f0b64149fe207f00570e00fac9e40a99a028c9200dda83761f3e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
efdfb8754336260e091d2d41904afaf2

SHA1
edad38fddd96e9f9ae4a831ddbd2375400240e13

SHA256
694c29ef72031748a22956de305ebb16a33cfca0c62b1e49ae8d2587327b9247

SHA512
e4fb9125150cbbdf256eec88256c156294620f7d458b1b97b89da70d4f44e4e45ef70ada8952cf355b9f08816d6eb04668f48913a00709d4c96d7cc2514b5f4f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
5c3f440b88ebd8f2f8e457814e5cafeb

SHA1
9ee77d31ada220e17f22ab460a3ef95d257e5aa2

SHA256
e6ab445378b5711bb77db770e039f1ed12178296bfa2b4086d6af9b31aa6e2ef

SHA512
ac71ac11a56e38c65817d4227505681b88a36eb0e16a6eb1a071b53a90a3354ef44dbb333b3f1280e9b569ac974bdb32b13aa7649fff1591b6ef51730bda9395

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
cb20cdce95241b26f2bdd6acf25434e6

SHA1
b82261c90c0e6d4b8a29f2180c16d51b012eef43

SHA256
82a50e6dec7e27512a8416d9caa5e139411d3f2fe119604a0d056295da26635b

SHA512
e942d88188a356ee680754b2d7e504aff87265be26446c1009a224c540103075988d355e100efc3c1e642fb1b1b1aae5ac7bfa4f255bfa9d80dcc2e7a9a26d09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
7a929c709d8d0d32ad4715b836becb17

SHA1
8ce5a24c2bd406cd76a3b789cb9968c20a892200

SHA256
55a6187d5898c8a05654aaeab97695bf2f74fbd943171d001ece1c73b6d1605a

SHA512
b37efb25b9de23b7a35cdb21cc3db42bc60a0183e0c1e59638af8531286bfb926f1eb0e53c485d1774e961274993cafbf02dac5d4b588b89a7d1d94f0f7c7da9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
bfead020ed1622b84abbbb664eef57be

SHA1
549caa5734afdc03fdf102f8fcf2c1e796a30802

SHA256
1b08dc41e31e422af5da69a76b5631c4beee96bc2357afad58cb87918f4ffd29

SHA512
0f594586756d46daacb1e46301d01757832ebe28eddec9de2e52278121f1b8a6d946a357ea8b3aa45860fff3c3dd13653a0184ad575bf23ed494e0a8571105f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
392320ca32e34f7e5c7ee6d4ee785a88

SHA1
02c477aba987ca758f57e3bd88071af398e7bfbb

SHA256
be37a5f02330831d2c5bfec0b1991985906af7f8f1e94f6c5052cfd4d534f276

SHA512
d6f215df3add30deb17cde5ed4abb1801367c843f2c0ea832a0e218d76b54bd3dd7547f3823b9d46e13b76e3bdf73fe67c468980df088204903fed377a618a2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore.jsonlz4

Filesize
9KB

MD5
c07004f305f55e4788b155a7f666e11a

SHA1
db1e74321e69e500085653b53ab411a50809f8bb

SHA256
37d00536a9faafb57a95c5d87b7ba9b2c05aac12333e0331b44dfee8cab4fe13

SHA512
dafa87d482a628e517220ce70f26f10065ecafc4f78841d474c9c2942acca71358a88d6efac28078f299d32437d75db9e3df5aaa7ff6b116a8eadec0009469cd

Download Submit
C:\Users\Admin\Downloads\thunderhack-1.6.jar

Filesize
5.5MB

MD5
d09b08e8a8b4fda3c4bc9fdd7e1d573a

SHA1
4d2e28b9cc7bab778943e1d51007feb32daeb866

SHA256
3cbd5128127ec3e1e2b6c10702175fdd0c2f7a58233673ad4844cfda8441f5c9

SHA512
b2482b31fa74d57bd63cf18178b70196aeb4e02abcbc3c5949378d4d20e4f7517c81f47bae5f5acc18a7edaaeed2a0e7a29f8e1a1301cd411f0257a667b748de

Download Submit
C:\Users\Admin\Downloads\thunderhack-1.k2cr8fcb.6.jar.part

Filesize
1.3MB

MD5
4caacd3f35e3e2ffdb7f3b9246ed28b4

SHA1
b7ec3838c1ca85a52d905d738e7509582b8e6ce8

SHA256
92b8efd1a0213c10cea1ed05dd3deeec5be74d0353a5998c6f1d05c4e6826517

SHA512
2c7c504877ac16ab99fdfaacf032d17723318c0b90a4bd6ebad3be5de1316c9f8f8c2a3ca4b172bcb1f1bc83c8af87e6671ab45721ac478cf6f47b58e746f9b4

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier

Filesize
167B

MD5
b4397fd9120f8b57b58e8fb76b10c2df

SHA1
591f19a1cd61d56f0448148cdb276b15aeaa0ba8

SHA256
f21d922c177d3ed923db12c9fd6e0cd83f7f4ffa9447653afd60d5c203bd82e0

SHA512
1fded971f2ff01ec4ff6a21a78736b4148503d50b23aca6d147cf5f6e43ab63cf3ec1c5e496d2feec3b1809ceabc2379ad779a3aca9104d58bc5964af797bcce

Download Submit
memory/1072-771-0x0000020D36810000-0x0000020D36811000-memory.dmp

Filesize
4KB

Download
memory/2140-850-0x000002C5559A0000-0x000002C5559A1000-memory.dmp

Filesize
4KB

Download
memory/2364-784-0x0000021C93DF0000-0x0000021C93DF1000-memory.dmp

Filesize
4KB

Download
memory/2464-838-0x0000024342170000-0x0000024342171000-memory.dmp

Filesize
4KB

Download
memory/2756-826-0x0000020D752D0000-0x0000020D752D1000-memory.dmp

Filesize
4KB

Download