27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00db28e5a7412cf4a6f87f8589244cd1.exe
Size

1.9MB
MD5

00db28e5a7412cf4a6f87f8589244cd1
SHA1

49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7
SHA256

27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c
SHA512

3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba
SSDEEP

24576:mX7tyazXp4qrSJZHJTEyMkbjla5TA3fmpKuUJBU8uQgyfg29H4EG7FhfESrpBrmi:mqR1a5T+fvmr0p4BDfzjmIADb

Score

10^/10

credential_access execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\System.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\System.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\System.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\NetHood\\spoolsv.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\System.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\lua\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2704	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2704	schtasks.exe	29

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1512	powershell.exe
2172	powershell.exe
2064	powershell.exe
2404	powershell.exe
1784	powershell.exe
1852	powershell.exe
1592	powershell.exe
2568	powershell.exe
1732	powershell.exe
2976	powershell.exe
2216	powershell.exe
1244	powershell.exe
2152	powershell.exe
2420	powershell.exe
1208	powershell.exe
2768	powershell.exe
1204	powershell.exe
2208	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2588	System.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Common Files\\System\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Admin\\NetHood\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Common Files\\System\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\VideoLAN\\VLC\\lua\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Admin\\NetHood\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\VideoLAN\\VLC\\lua\\System.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC6C5346487F4A4F9EB41F3827281F488C.TMP	csc.exe
File created	\??\c:\Windows\System32\qrosn9.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\System.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\27d1bcfc3c54e0	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files (x86)\Common Files\System\System.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files (x86)\Common Files\System\27d1bcfc3c54e0	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\System.exe	00db28e5a7412cf4a6f87f8589244cd1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1748	schtasks.exe
3068	schtasks.exe
2144	schtasks.exe
1648	schtasks.exe
1064	schtasks.exe
2888	schtasks.exe
2656	schtasks.exe
2912	schtasks.exe
1704	schtasks.exe
2840	schtasks.exe
268	schtasks.exe
2228	schtasks.exe
1684	schtasks.exe
2636	schtasks.exe
1228	schtasks.exe
1388	schtasks.exe
1652	schtasks.exe
2072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe
2524	00db28e5a7412cf4a6f87f8589244cd1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	System.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	00db28e5a7412cf4a6f87f8589244cd1.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2588	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2584	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	90
PID 2524 wrote to memory of 2584	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	90
PID 2524 wrote to memory of 2584	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	90
PID 2584 wrote to memory of 2276	2584	csc.exe	35
PID 2584 wrote to memory of 2276	2584	csc.exe	35
PID 2584 wrote to memory of 2276	2584	csc.exe	35
PID 2524 wrote to memory of 1852	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 2524 wrote to memory of 1852	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 2524 wrote to memory of 1852	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 2524 wrote to memory of 1592	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 2524 wrote to memory of 1592	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 2524 wrote to memory of 1592	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 2524 wrote to memory of 1208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 2524 wrote to memory of 1208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 2524 wrote to memory of 1208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 2524 wrote to memory of 2420	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 2524 wrote to memory of 2420	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 2524 wrote to memory of 2420	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 2524 wrote to memory of 1732	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 2524 wrote to memory of 1732	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 2524 wrote to memory of 1732	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 2524 wrote to memory of 2568	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 2524 wrote to memory of 2568	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 2524 wrote to memory of 2568	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 2524 wrote to memory of 2976	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 2524 wrote to memory of 2976	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 2524 wrote to memory of 2976	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 2524 wrote to memory of 1512	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 2524 wrote to memory of 1512	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 2524 wrote to memory of 1512	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 2524 wrote to memory of 1784	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 2524 wrote to memory of 1784	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 2524 wrote to memory of 1784	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 2524 wrote to memory of 2216	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	65
PID 2524 wrote to memory of 2216	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	65
PID 2524 wrote to memory of 2216	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	65
PID 2524 wrote to memory of 2152	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	66
PID 2524 wrote to memory of 2152	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	66
PID 2524 wrote to memory of 2152	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	66
PID 2524 wrote to memory of 2404	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	67
PID 2524 wrote to memory of 2404	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	67
PID 2524 wrote to memory of 2404	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	67
PID 2524 wrote to memory of 2172	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 2524 wrote to memory of 2172	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 2524 wrote to memory of 2172	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 2524 wrote to memory of 2208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	70
PID 2524 wrote to memory of 2208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	70
PID 2524 wrote to memory of 2208	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	70
PID 2524 wrote to memory of 1204	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 2524 wrote to memory of 1204	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 2524 wrote to memory of 1204	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 2524 wrote to memory of 1244	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	73
PID 2524 wrote to memory of 1244	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	73
PID 2524 wrote to memory of 1244	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	73
PID 2524 wrote to memory of 2064	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	74
PID 2524 wrote to memory of 2064	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	74
PID 2524 wrote to memory of 2064	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	74
PID 2524 wrote to memory of 2768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	75
PID 2524 wrote to memory of 2768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	75
PID 2524 wrote to memory of 2768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	75
PID 2524 wrote to memory of 1768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	87
PID 2524 wrote to memory of 1768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	87
PID 2524 wrote to memory of 1768	2524	00db28e5a7412cf4a6f87f8589244cd1.exe	87
PID 1768 wrote to memory of 2788	1768	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe
"C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o21bvv0f\o21bvv0f.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8823.tmp" "c:\Windows\System32\CSC6C5346487F4A4F9EB41F3827281F488C.TMP"
    3⤵
    PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\System\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M0TzPY7NM9.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2788
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2584
- - C:\Program Files (x86)\Common Files\System\System.exe
    "C:\Program Files (x86)\Common Files\System\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\NetHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\lua\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\M0TzPY7NM9.bat

Filesize
229B

MD5
4bd3c0365c0197ccad01489a8cf57475

SHA1
fa167d8339713c32fe570739ad1dfc4636ee12c9

SHA256
f0845880573cdb190739a0f95221338322909402ca937c3e3415cc4e0178b774

SHA512
3c3120a0ffd3ad383b93edfd2fa3ff8806122c70fb9d88277907821da07152796c384d4425eb86d026c1a847d1406e705a9531b466c385bed05de3b935d9a155

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8823.tmp

Filesize
1KB

MD5
9f4f441e02cb0cae9077ef5698b451a0

SHA1
d02fc1b962655d3e57b2e3d06a428e835ad8db06

SHA256
ec3a9f3a462bb63ea10fc5c1b966ddac9306c74735d406d078ff7bc55cbd0075

SHA512
ea5e51cfa51f8c2e10d929e6c5165b2279bf859782a0618518c1218866f4f9f1a14168a861e1b71de06099dc039cd202dd8f701194f1453ad12b6d7938e3aaff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\spoolsv.exe

Filesize
1.9MB

MD5
00db28e5a7412cf4a6f87f8589244cd1

SHA1
49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7

SHA256
27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

SHA512
3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f416124c4d59f2b1537cddcff052135a

SHA1
81e1a11dc39e458715aaf7f2534dc61cf936ef55

SHA256
ca3149e29417eefaf0b09302f3b2bddcbd04f0a3c98ba7d503ac21dc3c2a421a

SHA512
a4e355136eef22c13b0449495df94f06b2d09e2c9437d9b9913f5cfd2d9e31c979ad02a7a419763cb3ac56a4dd69853bfbabd0045f72b345bafb00f365df91e4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\o21bvv0f\o21bvv0f.0.cs

Filesize
366B

MD5
70cb6f26a3bda3837d37a448bb76d837

SHA1
1ca99224740c2eaff90d1f8b2b26c59d0c736f3d

SHA256
e7211db47052aee0c555479bd8e49bfa5d24af122d32a2bac35ac0650710922a

SHA512
3bd7c1eefdc075cf69dd548d661c78c66c4b7d9ac0aee3974bbc001c3d175805ff5017acd37830c5aa7c98da5883195c1f70f85bc0d2c0b4c9ae397d0d631014

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\o21bvv0f\o21bvv0f.cmdline

Filesize
235B

MD5
134a4899d1cf0866de9bda84bd7203d9

SHA1
981abe6053e9624a1cd978a04307c5bb73e11221

SHA256
9ed54f1f96ff5cab374e1c82a5953ccd2b9eb4744110e3e84a3de49cd4b19aa0

SHA512
05b340339ef59b4dfe2abf26ececed419785d393b5168f67fceb28b855289de6e57afb46ef863f0188fed49cc210e00ced53fca68902b9b612702d40b307bb89

Download Submit
\??\c:\Windows\System32\CSC6C5346487F4A4F9EB41F3827281F488C.TMP

Filesize
1KB

MD5
332eb1c3dc41d312a6495d9ea0a81166

SHA1
1d5c1b68be781b14620d9e98183506f8651f4afd

SHA256
bab20fa8251fcee3c944e76bdc082850ae4a32fd2eff761fec3bc445f58d11f2

SHA512
2c5ae1de2d4cb7f1e1540b455f7876eb1f494cda57bfb8e78a81aa01f3f453c5488b986cd170d6dc96bf684874c54257bfd0335a78764cc3fa43fe310a0cf440

Download Submit
memory/1208-64-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1208-65-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2524-10-0x0000000000440000-0x000000000045C000-memory.dmp

Filesize
112KB

Download
memory/2524-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/2524-25-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-23-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-22-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2524-20-0x0000000000480000-0x000000000048E000-memory.dmp

Filesize
56KB

Download
memory/2524-18-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-17-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/2524-15-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/2524-13-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-12-0x0000000000460000-0x0000000000478000-memory.dmp

Filesize
96KB

Download
memory/2524-24-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-8-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-7-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-6-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2524-4-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-67-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-66-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-3-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-2-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-63-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/2524-1-0x0000000000910000-0x0000000000B0A000-memory.dmp

Filesize
2.0MB

Download
memory/2588-147-0x00000000009A0000-0x0000000000B9A000-memory.dmp

Filesize
2.0MB

Download