e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
Size

3.6MB
MD5

7c3b6a7c2de1cc8c037818a6c2dc3ce2
SHA1

2a32e017d73cc9af9ae56ac5d68deeb684b8429e
SHA256

e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f
SHA512

bf19b68384a4cea0693412d7dfded2dc9cdb15e1632f538a8c83cc7f4a6b54b29fbeacd01162d9dda0243d6872477a90278a9e6beadf97bd397c9d4318134132
SSDEEP

768:m/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTAM:m/roM7ZJfUQWgY54vqy

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe

Executes dropped EXE 1 IoCs

pid	Process
1236	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
File created	C:\Windows\SysWOW64\rundII32.exe	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
File created	C:\Windows\SysWOW64\rundll32.exe	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d7165b16cc78b4489067006bf32ad8e00000000020000000000106600000001000020000000f2828d2775e25e8c66a5914363d9254b3af3206d773dc1e718157cb1c0f9f557000000000e8000000002000020000000b73264e3a2b538a4ce41e255d10babaa56ddfd75516cf784afcd92221f11c85f200000003599d299c3ecffbd8f2870c28f2ea8576ccda6318b68e7464ff86ffa85e3637e400000004617ae12fa2cc011e4941cd5cdab65fb3b61dc26982deec628fb328209459f7be746f149130f7f7042b562945567f5eb41f6c88b1de1f4d8bccf0752575ff7e5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435385841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d7165b16cc78b4489067006bf32ad8e000000000200000000001066000000010000200000007ae21551354e9f93804c341b0edc96b9a4293c9c707489aa8e3933403be15fed000000000e80000000020000200000002022998e19b45d2da5323287f2fc8d0917dc066de43de14077e2a4c8734d28a390000000b0ffa414a6b949e2c8efca0a21e80cc66f416cd26ccdb6bc6f508372fe924cd113e44676bf3440953e2c9114fa1303041e30df0e64db57322f697c605b396aa948d1a8e4e171d2ebbf16338d8b1a5ad06bdbeb707a7f195d84ec4831a55050ffe7f9b96c7b1a86dee838b5bad33993d6fef133f0b227c69a106cc18a902046f5079afef38ce2ff851de3d85d31f234d240000000066e2e825122fb4661d3b4f28e84973ce07e73cadb4de5198abf95886640de293b720b7840e310a607be14ea965e8a93388519051fa964f471072db14eb57ae0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000aad3d1221db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62BCC511-8D05-11EF-BCE0-DECC44E0FF92} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000005259721f102054656d700000360008000400efbee85884685259721f2a00000000020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e8588468122041707044617461003c0008000400efbee8588468e85884682a000000ec0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000e858c96910204c6f63616c00380008000400efbee8588468e858c9692a000000ff0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c6003100000000005259721f10204530444441327e310000ae0008000400efbe5259721f5259721f2a000000095d01000000080000000000000000000000000000006500300064006400610032003300390064006400340063006600320034006500630037003000310035006500630063006100340039003300650065006400650032006400630037006500610064006600300064006300370030006300370062003900350030003100620066003700350036006600310034003300300030006600000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e8580f6f100041646d696e00380008000400efbee8588468e8580f6f2a00000031000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e85884681100557365727300600008000400efbeee3a851ae85884682a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe
1236	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1236	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
1236	msng.exe
2968	iexplore.exe
2968	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2064	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	30
PID 2152 wrote to memory of 2064	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	30
PID 2152 wrote to memory of 2064	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	30
PID 2152 wrote to memory of 2064	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	30
PID 2152 wrote to memory of 1236	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	31
PID 2152 wrote to memory of 1236	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	31
PID 2152 wrote to memory of 1236	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	31
PID 2152 wrote to memory of 1236	2152	e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe	31
PID 1236 wrote to memory of 2832	1236	msng.exe	33
PID 1236 wrote to memory of 2832	1236	msng.exe	33
PID 1236 wrote to memory of 2832	1236	msng.exe	33
PID 1236 wrote to memory of 2832	1236	msng.exe	33
PID 2856 wrote to memory of 2968	2856	explorer.exe	35
PID 2856 wrote to memory of 2968	2856	explorer.exe	35
PID 2856 wrote to memory of 2968	2856	explorer.exe	35
PID 2968 wrote to memory of 2580	2968	iexplore.exe	36
PID 2968 wrote to memory of 2580	2968	iexplore.exe	36
PID 2968 wrote to memory of 2580	2968	iexplore.exe	36
PID 2968 wrote to memory of 2580	2968	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe
"C:\Users\Admin\AppData\Local\Temp\e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85aac40432267dcf82c2303ebf33291e

SHA1
bd04d6ef1e1d59eea5729382901cd69ddec5cbb5

SHA256
9d65f845f37ae8bac34e96ef21532dd7d360b225e1f507a819015f0b2b886912

SHA512
3b461e3882173481b2a5d736bcaef30a333c73541a00d5db306f406200db007d286db1ca7851bf3a3eca3c1050bb5fa1a6db8145c34e5c336ca0fccbfeecb9b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3b9abe7ac14c72e44b78d3cdfa5642

SHA1
cdc2a4bb5e1f027b6710689d0abd6aa126eb4536

SHA256
bd9b70b55eed5f2a9ec6de1c63145c5dc7c4c686f1d37a619937b1f25b75f984

SHA512
74fe033551f62c9fa4fff869db7d2ff82761305f9febdb56166571668a1f97b601e485a928bff9c1ea9a99855443d1d76e4f0652f7bdd80e2709614ababc1e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81fd69eee3ba19b6dfa75a03ec18d27e

SHA1
2a24cc1979d2ff27dcd99d68bd2e726796f55382

SHA256
0ec0765fe1d3043cd8d27e8882acedd17df842fe98020059094cefa5fe410519

SHA512
c755c8818e64f1152761406f20e2f8842e7e54cc50282b07de7d46151c0e7e9157d49374f23984b76d959800db4c2614be292d7361b03e6e470e25773ceac188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94ade7d8a9ac8fad539a01169014e152

SHA1
3fd88de4380096805bd52f751226c6dd7a1c43ed

SHA256
6e485738595f1ae258d9b4dce8bf4ff4d6a322e8cd5eed389c4ea1a92346a1c5

SHA512
116588a5bf3053169c6e1aa2cd2b364fdbcd52f0573293b53ba454d7b9909c096dca2fb7a749f517b322227aebb172a7bb903163ca4719c7d2a4a5e5508891a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9788057b065c1df4277fe9099a9dd397

SHA1
9a9c707ebd96146f9189963b80efcd726ca0f0da

SHA256
7368c240cdb3a8e643a0fd555aa1e2d784b7e4c51bd9016f65edbdf14d40301c

SHA512
47e191be26ccc6296a8f75b290c6b08887dad84366696694e2f6fdf44e6b9c47ea43bd4ecf35279a3a9d9a2ffd087c017a53bb29e5c75c4cd0a936f7b407e00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce67477f143555ae23fd709afb4d6bf8

SHA1
ac74f7c10a682c1c29882f9304da636ac9fcb868

SHA256
8ec65e5635904c4f7d069611e3c8daeb4f1bb5e74aaad78cb98a0ef354e96988

SHA512
58751a2f1d111b5b60290e7c4eaf5678672e7ba166d2cead30281b532a313e3345c1400b007e49e847e43957b33e6e867cf1965aa4f7c5f006767f88528ba584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aee924c435b92309ca1ab7f718ce11c8

SHA1
68bec21d19347fdf2a8a6e1deff48eb0d00ff1d6

SHA256
f3642412c8796218500d9062fd9ad202859ab33033c221e687b5abf7a6dffe2e

SHA512
2fd4dc15e4c4b9af3f8ed9d7ced537667d21a9eac2c4467e7018cdda753180fca6c3ab18a9f628a0d36238ecde6b6b157473f73f703da15299cbeb355db95601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
431a245c21625f347985622384538812

SHA1
9ea7c7a1153a0acd68595c3997e6d69f60fd7372

SHA256
4546b59b4bc22686ea10353e6dfac3a4821c39781951c5da4f4068f8064fb98a

SHA512
103a38fd6e23038563b986f41f7bbcc68cd3ae725e28eeeed165bc29c4b02d47f2dc98dc634a25194d7a582472c28b96ae79a26ab45dcfdbc3139e23c02f3104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85be72bb6ad529e8f30472ac1906816d

SHA1
969897e56eefd7be59ba8d057b4f1d25ce76c5ad

SHA256
4c0aa5b09df92741907f9d0171e4c5229bbe9615ac7beb2c68c3d98087371045

SHA512
24c789b03f79452d7df10aa80ece6934db63524a389b3c1827b1de74839612865f3ceb2ae5f09c09d005ff09336f92da39e37c918f66de032d675403a6be60ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e15fe0d190de3598480ebbfaa899182

SHA1
fdac4d26d8c43749ec80291925f12f99c64054ed

SHA256
e9c2231e3bdf69a3a4012276203a8b09d610d4263717a0bf7709bd80ec4079d8

SHA512
0754d0a0d7f937d6d149f3d99bc85004f427964230b474bb17e134f09191ed037e3afd6c16b51cecbf57f61436c4e6ab3ac338536aa27ad4b01ed83ddc1034db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4490e46a358d055a10b8fc5cc21adaa5

SHA1
fdb5f325717367d1cafbef1eb5da3b09164ba33c

SHA256
c48174f55e2b31f4704e21bace74074a1e0d426f176de87c95d13de1e36e2d6c

SHA512
bb6093e75e52f2382bf13b2cc0b2c1bc43af75674b27fad188353587473d0c4e784f162a58e3f07015b3caaa62095d69044e406df2b9ccb3adfaea5c1b81873e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341888acaa07adfd480bfed0e35dea7f

SHA1
a605c0893c143c2eae2c5c885da2b31a899e1f47

SHA256
4f74d1943677d124b32a323e30c0ce5aae728a9792eca7d107bf672136095811

SHA512
5c4cf70a8e722c6c053288fc39e969e44f207fa69e5f3dd410e1ccda07e859983657a40e6daffc78ca514e36d9e179753c78bb3e1b2b14c4c9b12b274bade8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c1ce005d7869ed1d611b0e8fccaac6

SHA1
6d3e3515fd81b713d5b2b451268098aebee16476

SHA256
7e25a84dff75bda53dfd3a8f3bfc59ac1762e6cc883a70e25e482404d9596626

SHA512
bd40a20b3d3729b83e23f0085229ee4969a206fff8d385927f8e11a16442321bf7cef8e6b0a418fe9d57e8812bab1431aee43672a27ac2e7865483534f946964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35bdeaf1e5df4da180dc4256e52f1a8a

SHA1
6cae0ba57754e5416bfd53ae0b33c8b8e9f29dd0

SHA256
9da84e8ee31bef16449a9423f4ccc77ab2f800fc21a53b9072d0494b9f8a6768

SHA512
6dcd6e60b26fc528df134f89f0b8eb8572776392e84c6054f3472485087d9ff28d749428d1f7b5f85658bf0659a0aaec5f3edc8394681a4125f7671f2c3ebd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bba59d9f24a0ca3ed0e9ac50ac41504

SHA1
e07c163c924aa496c96d0aa566e1e7f2e652ebe2

SHA256
166c4e538db259ecf6c830ec0616a9d0c07d51d8485f678e642adeb1b38d7745

SHA512
db4f8d08acc602f289fd120d91c759e8f0c340ed9a4ef98a709c93a6b751589b541b9114ed43fe7cab818c5332cee9fcc7d176e9fdded791120a21db6a27ff84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6541f6954c2968c4f4663123ad01f12b

SHA1
6d8810769295c314088382d7d8ceb5d7f44f4287

SHA256
e0a71b7c3ac861dfc9afb25b1fed84b11e3050e73574f8646d955f6808e5f360

SHA512
d84d0ac528e3b0ce15706bcc14bc43ffacccc12a0a7a29800dcbf81976d404d456b6b273b8a820562374720e8d2b4915508c87001aba3e8125139a633c5c51aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
684e29c02f94a7c813319d35070f9b79

SHA1
61ab421ba93ed297cf0b8792432d88b21034049d

SHA256
f36a0bff184fcf8839c81498113bc58416bdbfa377f91f65517e53ada9cd0727

SHA512
050de73a96d5380a2680bb6eae7b8ee02835df84e5e1fb94c1b633f805e664d41e883e6b69feea065dbcdb211b3d2a8052428a8ca4acc5533512f240a9a34526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb76709e5678ef7165410fd7b5fd165

SHA1
8226cc2554b0ad02dfd6e79c12565693ded9e51c

SHA256
32f033b28086c29aafdca8ce8947dfa060346bb9513c215b3b9f6bdd5d160975

SHA512
12862d383ea9a0774e035a1dafbbe34b7b61c98e321c36c3f0a0e60319d2c1b6b7b23255f716b42d9677468787b805b59c06c9e6e0085b7e5e823d4a84b05292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
185f89704a5a2d98a5d840cda4e4fac4

SHA1
7c9f7b341ed451857db233daf542ed14608260fb

SHA256
3cd6478ebb34f160399395e06cabab21ace8ca9550edf8fd9b2b6c5e0488588a

SHA512
386be8dcb2dd5a9b8d4d3c02bd569ee948696ffdb83e98c943dfd07142ffc577d40f0c93f02ecb7541d841a2846b8c4458da2a2c26ffe0a3098365313d7b4840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1FA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
100B

MD5
8646e0b8e29e6dfdcaa4de203bb84bb1

SHA1
89504c126afc099f83b177c52cd7c001611f5dfc

SHA256
67a6245b04d28668c423a1f593b8f9005ef7d74731467a546ae19e7801f52940

SHA512
a7100f506477473793b12b68c0419319da7cec94fa924dbbae1c32c6402e9161e37df98409b269d9c993f278327c7f2196150cdf62fe76bfb6f947d5272a4ea5

Download Submit
\Windows\SysWOW64\msng.exe

Filesize
3.6MB

MD5
7c3b6a7c2de1cc8c037818a6c2dc3ce2

SHA1
2a32e017d73cc9af9ae56ac5d68deeb684b8429e

SHA256
e0dda239dd4cf24ec7015ecca493eede2dc7eadf0dc70c7b9501bf756f14300f

SHA512
bf19b68384a4cea0693412d7dfded2dc9cdb15e1632f538a8c83cc7f4a6b54b29fbeacd01162d9dda0243d6872477a90278a9e6beadf97bd397c9d4318134132

Download Submit
memory/1236-121-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1236-62-0x00000000007D0000-0x00000000007D2000-memory.dmp

Filesize
8KB

Download
memory/2072-26-0x0000000003A50000-0x0000000003A60000-memory.dmp

Filesize
64KB

Download
memory/2152-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2152-14-0x0000000003360000-0x00000000033CD000-memory.dmp

Filesize
436KB

Download
memory/2152-15-0x0000000003360000-0x00000000033CD000-memory.dmp

Filesize
436KB

Download
memory/2152-23-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download