Analysis
- max time kernel
24s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/11/2024, 07:52
General
- Target 1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe
- Size 2.9MB
- Sample241110-jqkkmawkbr
- SHA256 1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6f
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 18 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 16 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe"C:\Users\Admin\AppData\Local\Temp\1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@AEC12D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AEC12D.tmp.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 23647⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "8⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe10⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe"C:\Users\Admin\AppData\Local\Temp\1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC55⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC56⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC57⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC58⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC59⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC510⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC511⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC512⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE12⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC513⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE13⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC514⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE14⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC515⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC516⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE16⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC517⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE17⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC518⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE18⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC519⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE19⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC520⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE20⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC521⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC522⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE22⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC523⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE23⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC524⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE24⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC525⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE25⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC526⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE26⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC527⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE27⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC528⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE28⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC529⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE29⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC530⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE30⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC531⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE31⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC532⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE32⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC533⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE33⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC534⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE34⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC535⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE35⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC536⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE36⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC537⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE37⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC538⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE38⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC539⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE39⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC540⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE40⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC541⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE41⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC542⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE42⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC543⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE43⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC544⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE44⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC545⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE45⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC546⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE46⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC547⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE47⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC548⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE48⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC549⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE49⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC550⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE50⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC551⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE51⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC552⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE52⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC553⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE53⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC554⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE54⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC555⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE55⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC556⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE56⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC557⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE57⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC558⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE58⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC559⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE59⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC560⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE60⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC561⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE61⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC562⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE62⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC563⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE63⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC564⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE64⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC565⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE65⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC566⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE66⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC567⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE67⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC568⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE68⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC569⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE69⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC570⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE70⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC571⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE71⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC572⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE72⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC573⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE73⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC574⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE74⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC575⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE75⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC576⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE76⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC577⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE77⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC578⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE78⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC579⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE79⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC580⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE80⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC581⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE81⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC582⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE82⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-0EE37CC583⤵
-
-
C:\Windows\SysWOW64\XP-0EE37CC5.EXEC:\Windows\system32\XP-0EE37CC5.EXE83⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
1de7020e71b2873a436a3a1594fd9bffdda6356776c95d82435bfef1e86ccf6fN.exe
@AEC12D.tmp.exe
RegEx.fnr
com.run
dp1.fne
eAPI.fne
internet.fne
krnln.fnr
shell.fne
spec.fne
F1C2.tmp
tmpD273.tmp
tmpD364.tmp
WdExt.exe
Admin0.bat
Admin1.bat
mydll.dll
memory/432-1151-0x0000000000400000-0x000000000042A000-memory.dmp
memory/436-408-0x00000000027F0000-0x000000000280E000-memory.dmp
memory/436-405-0x0000000002360000-0x00000000023AA000-memory.dmp
memory/436-429-0x0000000000400000-0x000000000042A000-memory.dmp
memory/552-706-0x0000000000400000-0x000000000042A000-memory.dmp
memory/724-367-0x00000000024C0000-0x000000000250A000-memory.dmp
memory/724-373-0x0000000002F40000-0x0000000002F5E000-memory.dmp
memory/724-376-0x0000000002F60000-0x0000000002F71000-memory.dmp
memory/724-407-0x0000000000400000-0x000000000042A000-memory.dmp
memory/912-438-0x0000000000400000-0x000000000042A000-memory.dmp
memory/912-419-0x0000000002520000-0x0000000002531000-memory.dmp
memory/912-418-0x0000000002500000-0x000000000251E000-memory.dmp
memory/912-416-0x0000000002250000-0x000000000229A000-memory.dmp
memory/980-264-0x0000000000400000-0x000000000042A000-memory.dmp
memory/980-70-0x0000000000400000-0x000000000042A000-memory.dmp
memory/980-99-0x0000000002370000-0x00000000023BA000-memory.dmp
memory/980-182-0x00000000024C0000-0x00000000024DE000-memory.dmp
memory/980-189-0x0000000002620000-0x0000000002631000-memory.dmp
memory/1048-553-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1180-940-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1240-526-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1328-848-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1336-722-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1364-958-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1432-1128-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1448-859-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1732-394-0x0000000002910000-0x000000000292E000-memory.dmp
memory/1732-392-0x0000000002120000-0x000000000216A000-memory.dmp
memory/1732-395-0x0000000002950000-0x0000000002961000-memory.dmp
memory/1732-424-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1940-461-0x0000000002230000-0x000000000227A000-memory.dmp
memory/1940-463-0x00000000025F0000-0x000000000260E000-memory.dmp
memory/1940-464-0x0000000002610000-0x0000000002621000-memory.dmp
memory/1940-481-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2100-501-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2100-479-0x0000000002400000-0x000000000244A000-memory.dmp
memory/2100-483-0x0000000002900000-0x0000000002911000-memory.dmp
memory/2100-482-0x00000000028E0000-0x00000000028FE000-memory.dmp
memory/2176-778-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2340-652-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2348-888-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2612-497-0x00000000023D0000-0x000000000241A000-memory.dmp
memory/2612-499-0x00000000026D0000-0x00000000026EE000-memory.dmp
memory/2612-519-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2644-439-0x00000000021A0000-0x00000000021EA000-memory.dmp
memory/2644-472-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2644-442-0x0000000002930000-0x0000000002941000-memory.dmp
memory/2908-369-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2908-243-0x0000000002830000-0x0000000002841000-memory.dmp
memory/2908-239-0x00000000026F0000-0x000000000270E000-memory.dmp
memory/2908-230-0x0000000002260000-0x00000000022AA000-memory.dmp
memory/2976-661-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2992-425-0x0000000002190000-0x00000000021DA000-memory.dmp
memory/2992-431-0x00000000024F0000-0x000000000250E000-memory.dmp
memory/2992-544-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2992-432-0x0000000002510000-0x0000000002521000-memory.dmp
memory/2992-465-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3004-800-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3048-533-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3512-378-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3512-266-0x00000000024E0000-0x00000000024FE000-memory.dmp
memory/3512-269-0x0000000002500000-0x0000000002511000-memory.dmp
memory/3512-261-0x0000000002240000-0x000000000228A000-memory.dmp
memory/3620-971-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4168-916-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4504-508-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4504-492-0x0000000002810000-0x0000000002821000-memory.dmp
memory/4520-688-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4552-789-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4764-695-0x0000000000400000-0x000000000042A000-memory.dmp
memory/4884-17-0x0000000010000000-0x0000000010015000-memory.dmp
memory/5048-473-0x0000000002330000-0x000000000234E000-memory.dmp
memory/5048-474-0x0000000002590000-0x00000000025A1000-memory.dmp
memory/5048-488-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5136-560-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5244-622-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5268-569-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5364-903-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5404-824-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5448-580-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5624-587-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5700-627-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5720-643-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5744-1117-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5804-598-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5808-670-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5860-713-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5948-634-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6040-677-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6068-1108-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6076-605-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6120-943-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6256-835-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6304-733-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6492-742-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6680-751-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6832-813-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6860-758-0x0000000000400000-0x000000000042A000-memory.dmp
memory/6888-868-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7032-769-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7112-925-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7136-879-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7188-982-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7232-1164-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7296-1057-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7336-1050-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7384-995-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7532-1004-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7732-1017-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7856-1175-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7876-1076-0x0000000000400000-0x000000000042A000-memory.dmp
memory/7968-1028-0x0000000000400000-0x000000000042A000-memory.dmp
memory/8084-1097-0x0000000000400000-0x000000000042A000-memory.dmp
memory/8164-1041-0x0000000000400000-0x000000000042A000-memory.dmp