sality | 4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Size

636KB
MD5

aad6e17fc6ab888f939189b1965875c0
SHA1

e4bbbb0f8d6f82e2f9c37d9b3d523d8c219e675d
SHA256

4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64
SHA512

31a2d0c0b88f2fef9b6aad2171498623a8d370793819223baea7749c3e07982717bca6546d3208a89b6ab0cf2488c2ba3a16ec9a873b05a3a4cf8ef1ad0e0539
SSDEEP

12288:AtpvoLeovtFUD5jaAwxpv0wVrfMSKuudo:Atpvod1FUDZh0pv0sDKuO

Score

10^/10

sality backdoor discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe:*:enabled:@shell32.dll,-1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe:*:Enabled:ipsec"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\R:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\T:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\H:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\I:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\L:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\M:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\N:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\U:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\Y:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\E:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\O:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\P:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\V:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\G:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\S:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\J:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\K:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\W:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\X:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened (read-only)	\??\Z:	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\Global.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\REGEDIT.EXE	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\regedit.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\tskmgr.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Default.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Global.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\SysWOW64\dllcache\svchost.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\svchost.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1452-6-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-8-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-11-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-9-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-10-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-12-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-15-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-17-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-16-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-22-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-21-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-24-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-81-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-84-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-98-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx
behavioral2/memory/1452-97-0x0000000002EB0000-0x0000000003F3E000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\WINDOWS\pchealth\Global.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\system\KEYBOARD.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Media\rndll32.pif	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Cursors\Boom.vbs	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\Cursors\Boom.vbs	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Fonts\wav.wav	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Fonts\Fonts.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Fonts\tskmgr.exe	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\Windows\SYSTEM.INI	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File opened for modification	C:\WINDOWS\Fonts\wav.wav	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
File created	C:\WINDOWS\Help\microsoft.hlp	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	1452	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\AutoEndTasks = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeDebugPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeTakeOwnershipPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeRestorePrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeBackupPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Token: SeChangeNotifyPrivilege	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 616	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	5
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 664	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	7
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 772	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	8
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 780	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	9
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 788	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	10
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 892	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	11
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 944	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	12
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 316	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	13
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 440	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	14
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 728	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	15
PID 1452 wrote to memory of 992	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	16
PID 1452 wrote to memory of 992	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	16
PID 1452 wrote to memory of 992	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	16
PID 1452 wrote to memory of 992	1452	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe	16

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3176
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3844
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3940
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4048
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:2896
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3968
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4180
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2996
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1876
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2440
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4204
- C:\Windows\System32\rundll32.exe
  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
  2⤵
  PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1104
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2656
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1396
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2044

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2912

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3296

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3512
- C:\Users\Admin\AppData\Local\Temp\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe
  "C:\Users\Admin\AppData\Local\Temp\4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64N.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Modifies system executable filetype association
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 2184
    3⤵
    - Program crash
    PID:3800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5052

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1452 -ip 1452
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe

Filesize
636KB

MD5
aad6e17fc6ab888f939189b1965875c0

SHA1
e4bbbb0f8d6f82e2f9c37d9b3d523d8c219e675d

SHA256
4cb2032ca9e2a32a89c95558a4bec6fe02117c1a16790d7faea35ab765392f64

SHA512
31a2d0c0b88f2fef9b6aad2171498623a8d370793819223baea7749c3e07982717bca6546d3208a89b6ab0cf2488c2ba3a16ec9a873b05a3a4cf8ef1ad0e0539

Download Submit
memory/1452-11-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-98-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-1-0x000000007FE40000-0x000000007FE4B000-memory.dmp

Filesize
44KB

Download
memory/1452-5-0x000000007FE40000-0x000000007FE4B000-memory.dmp

Filesize
44KB

Download
memory/1452-6-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-8-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1452-9-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-10-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-12-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-14-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1452-13-0x0000000004AE0000-0x0000000004AE2000-memory.dmp

Filesize
8KB

Download
memory/1452-97-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-2-0x0000000076F62000-0x0000000076F63000-memory.dmp

Filesize
4KB

Download
memory/1452-21-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-18-0x0000000004AE0000-0x0000000004AE2000-memory.dmp

Filesize
8KB

Download
memory/1452-16-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-22-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-19-0x0000000004AE0000-0x0000000004AE2000-memory.dmp

Filesize
8KB

Download
memory/1452-24-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-3-0x0000000076F63000-0x0000000076F64000-memory.dmp

Filesize
4KB

Download
memory/1452-81-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-84-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1452-114-0x000000007FE40000-0x000000007FE4B000-memory.dmp

Filesize
44KB

Download
memory/1452-17-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download
memory/1452-102-0x0000000004AE0000-0x0000000004AE2000-memory.dmp

Filesize
8KB

Download
memory/1452-15-0x0000000002EB0000-0x0000000003F3E000-memory.dmp

Filesize
16.6MB

Download