warzonerat | 96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39

Analysis

max time kernel
117s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
Size

2.9MB
MD5

fad1f55e473ce8bb0992f7aac9541280
SHA1

c2dba04ca0b8ac04f673d45f8c3244d0af5eb2a4
SHA256

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39
SHA512

d5c1e30c5b9a555e9bb16a1d742c6b343778ed934ccbf5181ddc537935104e6d7dd4ec29564f79179d1a84f3b668cf9e610f97865c02d96185c3757e41cc7f91
SSDEEP

24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHN:7v97AXmw4gxeOw46fUbNecCCFbNecO

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 3 IoCs

Processes:

cmd.execmd.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 16 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
1548	explorer.exe
2080	explorer.exe
2544	explorer.exe
888	spoolsv.exe
2240	spoolsv.exe
1300	spoolsv.exe
2356	spoolsv.exe
2424	spoolsv.exe
2928	spoolsv.exe
2772	spoolsv.exe
1700	spoolsv.exe
2012	spoolsv.exe
1948	spoolsv.exe
1708	spoolsv.exe
1864	spoolsv.exe
1364	spoolsv.exe

Loads dropped DLL 23 IoCs

Processes:

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2544	explorer.exe
2544	explorer.exe
888	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
1300	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
2424	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
2772	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
2012	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
1708	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
1364	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 2604 set thread context of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 set thread context of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 set thread context of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 1548 set thread context of 2080	1548	explorer.exe	explorer.exe
PID 2080 set thread context of 2544	2080	explorer.exe	explorer.exe
PID 2080 set thread context of 1872	2080	explorer.exe	diskperf.exe
PID 888 set thread context of 2240	888	spoolsv.exe	spoolsv.exe
PID 1300 set thread context of 2356	1300	spoolsv.exe	spoolsv.exe
PID 2424 set thread context of 2928	2424	spoolsv.exe	spoolsv.exe
PID 2772 set thread context of 1700	2772	spoolsv.exe	spoolsv.exe
PID 2012 set thread context of 1948	2012	spoolsv.exe	spoolsv.exe
PID 1708 set thread context of 1864	1708	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 11 IoCs

Processes:

explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

spoolsv.execmd.exespoolsv.exespoolsv.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.execmd.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exespoolsv.exespoolsv.execmd.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
1548	explorer.exe
888	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
1300	spoolsv.exe
2544	explorer.exe
2424	spoolsv.exe
2544	explorer.exe
2772	spoolsv.exe
2544	explorer.exe
2012	spoolsv.exe
2544	explorer.exe
1708	spoolsv.exe
2544	explorer.exe
1364	spoolsv.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

pid	process
2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
1548	explorer.exe
1548	explorer.exe
2544	explorer.exe
2544	explorer.exe
888	spoolsv.exe
888	spoolsv.exe
2544	explorer.exe
2544	explorer.exe
1300	spoolsv.exe
1300	spoolsv.exe
2424	spoolsv.exe
2424	spoolsv.exe
2772	spoolsv.exe
2772	spoolsv.exe
2012	spoolsv.exe
2012	spoolsv.exe
1708	spoolsv.exe
1708	spoolsv.exe
1364	spoolsv.exe
1364	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exeexplorer.exe

description	pid	process	target process
PID 2604 wrote to memory of 2368	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	cmd.exe
PID 2604 wrote to memory of 2368	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	cmd.exe
PID 2604 wrote to memory of 2368	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	cmd.exe
PID 2604 wrote to memory of 2368	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	cmd.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2604 wrote to memory of 2348	2604	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2672	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2348 wrote to memory of 2412	2348	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	diskperf.exe
PID 2672 wrote to memory of 1548	2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	explorer.exe
PID 2672 wrote to memory of 1548	2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	explorer.exe
PID 2672 wrote to memory of 1548	2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	explorer.exe
PID 2672 wrote to memory of 1548	2672	96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe	explorer.exe
PID 1548 wrote to memory of 564	1548	explorer.exe	cmd.exe
PID 1548 wrote to memory of 564	1548	explorer.exe	cmd.exe
PID 1548 wrote to memory of 564	1548	explorer.exe	cmd.exe
PID 1548 wrote to memory of 564	1548	explorer.exe	cmd.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe
PID 1548 wrote to memory of 2080	1548	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
"C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
  C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
    C:\Users\Admin\AppData\Local\Temp\96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39N.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:564
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2080
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1796
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2792
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1960
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2864
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:912
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1556
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1796
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1872
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
fad1f55e473ce8bb0992f7aac9541280

SHA1
c2dba04ca0b8ac04f673d45f8c3244d0af5eb2a4

SHA256
96a8236dcc4bd2a392a82075f38327843610b5d86d2ef1095afcf8b461e58c39

SHA512
d5c1e30c5b9a555e9bb16a1d742c6b343778ed934ccbf5181ddc537935104e6d7dd4ec29564f79179d1a84f3b668cf9e610f97865c02d96185c3757e41cc7f91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
01ae08c9e52c70b35a18b8b763756604

SHA1
3014ce0962ce7f59a98c8208ecc041881f9d5cbd

SHA256
9d19594b6ed23563784aaef642373f58aa7cf884bad5f6eb200f1b8cb8861b57

SHA512
ad9cbef48e8a4a184ce71e5ba912419d8c5bd39b219661785860d26c98f8c0477b4ac64b39ddbfc359ee5328174bee1b90bdc637e733ef1da5e044135c8ee106

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
1.7MB

MD5
60006b4212da312cc07f21221ce6ec3d

SHA1
6663f53ec0d985bd85a24c13ef39c2156cdbc0cb

SHA256
e9a3ffd6a91e4a0677b9d726ef5fb98d15627a01ddfef911b747773ef1a0b96e

SHA512
bdba9701dcd52c068ca2d3fb82b8e6eb48fd694a46eeef63c5ab122dd71017718670b95fa6fae5b51be7e0776213c687b3a9e55b4aa86ce0366a75c79356b03e

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
dc59477ff6bfbadfe07d5e0d240b73bd

SHA1
0f15ee29d2d6de38bd8544cb3fca3aa68e7af6f0

SHA256
bb91239f5a84e21c9eea2f366b630918f8c505c59fdccd0fa0ed6f72aafd79ec

SHA512
d35afb938c3a79464c69296842f96472065f0584740ab098b535d2f93084a445bd981f004ca1b12dc23e4595dfcea113be3f2ae6e0a1238f9a3c8a7ce66eab58

Download Submit
\Windows\system\spoolsv.exe

Filesize
1.1MB

MD5
b3a33a64fa19ed784f6c034ed1a3a3bf

SHA1
d89891c9e054f308dd23bd51c42d43da11013dd7

SHA256
f25adc00c0f04e1a6c7fe9ad212587f61707a0944f1107931f01073f2ce52725

SHA512
0590707e484029831e42223b0d64311d0a2b5a95f7ce480e89022b1d21f3be905b3e70e5b691dd509039cf1822340e0a295ef306737bfce401084b365b676b0f

Download Submit
memory/760-551-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1700-392-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1864-494-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1948-443-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2080-175-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2080-139-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2240-240-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2348-37-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-32-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-30-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-22-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-9-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-42-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-51-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2348-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-49-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-7-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-40-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-39-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-27-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-41-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-84-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-43-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-18-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-48-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2348-45-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2348-46-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2356-285-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2412-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2412-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2544-176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2928-344-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download