gozi | 45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
Size

351KB
MD5

a47ee973940ba634ced04939b927e556
SHA1

31f361613a56e26ad3636cef4b51827e54df3c1d
SHA256

45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154
SHA512

8f3e78b45d548b23a889a230062bbfd0e692f3b0eab341954d4a1a86432ff8768b0af14f0005280452d0837756ae628d46fe7ef4983dfc6dc6b464752f73010b
SSDEEP

6144:ViceR0zXvZss0DYWQ9km7LWMCuMeGbfUTpYDDmu/+3fbZ:nzXvZ7p9hLWMCmG+pG/YZ

Score

10^/10

gozi ramnit 8585 banker discovery isfb spyware stealer trojan upx worm

Malware Config

Extracted

Family

gozi

Attributes

build
214131

Extracted

Family

gozi

Botnet

8585

mcc.avast.com

securezza.at

Attributes

build
214131
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012266-6.dat	upx
behavioral1/memory/2712-14-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2712-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2712-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2712-10-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2712-26-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2712-27-0x0000000000400000-0x000000000045D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 63 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d7e2c9c1d29d64b900cfe49cf0f08450000000002000000000010660000000100002000000050f9af8bba2f2c97b9535b7f7be3189945cdaea86d8a3ed0f0cddc3d43b12324000000000e8000000002000020000000f3bf917d5ebfe0a47d792ea8f9e9978cd11db08ef3471469fa208b5f386d9591200000008dfa10d28364fb1e13a355b8fb7ed8809bf1f43409af253d32172cec59e64faa40000000b4d4c204f37be2262e687c7584409a7cace116b4e703ab2900af075506fd2908b9132a3d83fb0c2f86e43dac69eb8318933e7208b26e4ab7310c4be37873d04e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08853316289db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d7e2c9c1d29d64b900cfe49cf0f08450000000002000000000010660000000100002000000023f07b4e2548b798062501b0b1600aecbd98bfd2455b6cbc254458dadefc600c000000000e80000000020000200000005de72b93ce533ea347246ebf0207378dfa5cb5a8419da72d76130ab659b251db90000000d0190de4af6860766840f595dd2e21f7631edff6f7e225a8f094cfd4ff3566e14977156a019919d7d1e2fcf81918301052eaca7a99d3e5afc42897c3316b0f764113bef79dc3eeaad37a2a4755d111c79f5e13f3baa5559a6f83f2f6040cc8b2756bde9eb079323033f66859a75dd017f5cb9e09c3d352747a2e6b5537cebebd03074cbce6870f62ff8c7cec12868e9840000000039da131f23dffe69be55f3b2a514589592ad5498db5e2a16b52c35209f881657b7feca00d2f65f2da14e921baa73577548853bd1ef3b0a11a3a15ae29c12e17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54BD1D81-F555-11EF-8BDE-523A95B0E536} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446855099"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54BA5E61-F555-11EF-8BDE-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2916	iexplore.exe
2608	iexplore.exe
2916	iexplore.exe
2916	iexplore.exe
2916	iexplore.exe
2916	iexplore.exe
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2608	iexplore.exe
2608	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
2916	iexplore.exe
2916	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
2916	iexplore.exe
2916	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
2916	iexplore.exe
2916	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
2916	iexplore.exe
2916	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
2916	iexplore.exe
2916	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2712	2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 2836 wrote to memory of 2712	2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 2836 wrote to memory of 2712	2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 2836 wrote to memory of 2712	2836	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 2712 wrote to memory of 2916	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 2712 wrote to memory of 2916	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 2712 wrote to memory of 2916	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 2712 wrote to memory of 2916	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 2712 wrote to memory of 2608	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 2712 wrote to memory of 2608	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 2712 wrote to memory of 2608	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 2712 wrote to memory of 2608	2712	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 2916 wrote to memory of 2704	2916	iexplore.exe	33
PID 2916 wrote to memory of 2704	2916	iexplore.exe	33
PID 2916 wrote to memory of 2704	2916	iexplore.exe	33
PID 2916 wrote to memory of 2704	2916	iexplore.exe	33
PID 2608 wrote to memory of 3060	2608	iexplore.exe	34
PID 2608 wrote to memory of 3060	2608	iexplore.exe	34
PID 2608 wrote to memory of 3060	2608	iexplore.exe	34
PID 2608 wrote to memory of 3060	2608	iexplore.exe	34
PID 2916 wrote to memory of 1568	2916	iexplore.exe	37
PID 2916 wrote to memory of 1568	2916	iexplore.exe	37
PID 2916 wrote to memory of 1568	2916	iexplore.exe	37
PID 2916 wrote to memory of 1568	2916	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
"C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
  C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2704
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:406532 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1568
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58dc4f17adbc095e5c4ae7a502ddaa8d

SHA1
2178c681f44a8b9b5539d59cfbd4dacea53a7433

SHA256
bcd836c8b96b2f2bc12f4ed41302169b51f3be1c49731421081556a5aeadf71e

SHA512
792f0d0e0a4adee0630d2997aa73dc8da6376f4a751d64d275f6ebc7cb1ab1506a7dc5079d5668060bebe767da897aeac4df6edd891192de87849e216fef664b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aae91d45f472068fc436b3527d679ba

SHA1
c68ac439b0acfa55f73b29ea4b7a375122a8ae71

SHA256
9a14785eab428650b2f357782c2a271d8fc156fdca5779afc71178af7552a6ce

SHA512
774be9adc58fed4b4d38beaec259101ade2c5e7123e1178559f55d40d4367d025ed780a77702ac9cbec5aca042278fc5197114899570a7d3b0690c3786c6aa66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a00e24d9c1b40ef19b8141cce7dc8eaa

SHA1
11387b5c74ce0970bd4ca71468e5168007a52f9e

SHA256
3553683cd99befe967935bd7e037301bb60968d40e78a85221b1d165a08e4381

SHA512
0a7935a47cc1aa9428288f88498b3ec1a35b152bd866a7e4a141c6dffde136c22335b42642821ee57d6941e28daea50ae3d0b65604538926456cfe0abb5b0207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b76da4ddb665836cd96fb37bce56bf

SHA1
0e37bc106c1777b475a0399295965e1e3a8fbc49

SHA256
3343384e11fcd5effa8c38cb64228bf58fc4898e8401e7d731b1603aa307279b

SHA512
c97a88484ba761eb8264517620cfaeb9ff37e7f21e77955f5b10dc67aa8d902af8400c0692e2f567f022ca27ab0ee276f453e3cf4135ac3dd85379c24fbf74e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
256a96479a62ac3bd893accac444d5fe

SHA1
60db23c31527bc422fe5addc56051ea665fbb1e6

SHA256
395f237178fd1e80fb421ac74efafefa0f787b7f17f2806ba9e70abbd04e09c7

SHA512
e381fe7dda8a05297d64013f89c43f07bcc4d0351b458250f881ce534e5db6469e2ecaf24962f8af84686ca4a52ec0009814be25c9d1f2ee055e224b99af1e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a441666a4397e487cb8041773181b140

SHA1
54583b329a8721ee8cc10dd924a6a17c29780ecf

SHA256
51f7b17704ccc5b4937d342483bfe585b3ddc97913eb4e9aaa2b4af6702e5397

SHA512
880cad60e9c4f8761f64752c663dcddf7b95c65568bd8e9dbdb108e42d2aba1ad66c62ed51fefbacc5f0a03d130616f928fcd8e50ef9f145e1cce3ab4d147542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da240320aea6dd96b03d86a1e0d0fdb4

SHA1
07aae11428c2d0cd99442ddc31ae90c204bb9ad9

SHA256
25b1c7ab672f2e06aeceedc7a9f6f25d497c9429e9acf3459a7722c7829f6843

SHA512
a8c88b90bf91f917e4a899f700a55deb9c0d41eb3844e16a65b13365db799b6abfdb5a85bb9e56f693e27c80bc32e857ea33edd7386e8a1a2ab8a983505b5b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f64fb02e934e3d0ea00d7d0adcaf70d

SHA1
10c5444f49086124cf344fd929acf54071abd82c

SHA256
40c8534fcf13c7a7cef7952b4756d15063c84cafc098834f46dd01efd538c93a

SHA512
b0ee7912c82cc5591938f4ca16dc15d4310f8bea7b81de990f9da9edfca75205e8c3fdaabd9e9e9bd09ba1160eb851f6b62776b262de0bbeacb9d8face42d9d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
603a7dee1b879f4b09d0b720aea10686

SHA1
2415a82f44992669f5421f73c09450332a7ddaec

SHA256
730dc373d2950b54104ab2bd59395328c107f4c083a362f0bf2568c6df3befa6

SHA512
21ff862531c9261428dd4e132c55fc53f0cefc4ffee05dad0eff0abe5281ea281f82db034cc3c75a74f1f49aeef02f49cee62953128a6e772c1124cfd098e819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c504ffd4865360e94c3873016d3241a

SHA1
bffdbedc1d20a5c4f5c43f38d546bf2227ad7ab5

SHA256
cbbe212ad3cd12ec8b0cfbcc6e0f524bff55464f3afe9c1bf07a21ee71255f10

SHA512
664a3dee2e82e5cd0fdfead1fae1bf70561c008ae63fea0b5a20046663a6b3aa48265e73155e2c11c4fcc1b402a4cf886c558e7134a2ed7fb87f74263468994f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f78ee55ee5dfab6124fd858bd3b33e

SHA1
b747afc9e1404ed36cb320bbae1d80005d747f49

SHA256
fa1a4541f4350e366b371cb6b8370074433081158d23cc048251196e4ba86ec4

SHA512
aa7f76a3915edf5ec8e0794febc5573a1571c9f1b6f85138d8c013afc4411801869e33560af0d4f430468dc8712091fad575523d67a19443d9ac9afd9aea4dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c31a7c4524738b454f92befa56d73c1

SHA1
ec86e17a22a46c77f4b75306018a68c248724b5b

SHA256
a341304c86277d4c004f8860b3a210b6273793c07a3753ee7487655e86db1306

SHA512
394f3bb980d189fb7d8c9b9aaf1255da16c21ac9cbbf93eeb3d36ec9376061721ab047430bd5423ccd2e3e445f50c658e39d9a71679e77038dbcae9d155947b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7afff2b45c3182cdf10321f89cd9586

SHA1
bcd7a3eb64199b443b506435ce8117176a17da15

SHA256
ee1b5d2bc1dd2ae5eda9eb0d8d15c19d242b10e2a96b06a0fbb2773a63032e79

SHA512
f47ac2f24ae33a3e74dd792c16bfacd816f9d0b7b9aa29e62e3095eb69dc81bb07118785e525a18b34674410cbc314403f4306cec6f6af0c21a92f5554c5a5de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f65616f990c8dd6532ee3abd546e97

SHA1
e9cfa6f41bcd0782e719afca1f80fdce1c89c8ea

SHA256
b2e549281e5df487fd4e845546057df1bbd412a9eff467253d63cea10b53d609

SHA512
aef9d946bea253b3c5437e50a96c601e1f3b282e21ed8db4471dc9be4504f7e621f09b3c3bc902d71a4b4c9eebfa6475c292e8c2102c179fdd38ab808678d63d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fbdcd24969df5d3a009f239739150e4

SHA1
5d72a695184cfe1858809e583fd4981bfd3c3128

SHA256
c3abe12885002fa118dfb50c83dfefb2f9c134aa3a03ab6fe5f8bfa89dce087c

SHA512
330db3b44e83d42f3aa8ef72ebfa09e6cca4f1b6ce79ef1570728a845d9223a46ab7cf239a96a051429a3b8d500bc3577b4e1b339af6e5b26e12b9272372f911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d6c000fdbea67bc727d9900b9842d77

SHA1
58d9cb9b59953c5896cfdb0b59db0f70c7985f55

SHA256
02a86fd3fd60cadaebde0c3724c2b87a72969b506d3fd2abd25c0b9a34c9fd56

SHA512
b6a92b6b10ce596222f4f53ef9a160d6d87d0786b83380c6d3d7f5865a91abdcec0343fe8f40dbccb46c70b6eba259e2572e880155fbb128d1f1f92649613b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9011b191d80c86ee07f4c6f43ca2e319

SHA1
9c5bd01c2273b59bf721ca9c564df6a6f94df4a1

SHA256
fdc2d6eb079e16fe371df566793dc8d54bfa43a528fb871889eea979e840460f

SHA512
4f61589bd7771d43b3b08886075911ccd6d2dd127a22ef68cd2e8c68083e07072c6f9a2bbc6350e2bc92ea83a775fca069d9938f72df201d4b4357f004c436c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9495604bc9ffad8bb6bd7461613d84a9

SHA1
7faa3eaac3fac74cec357af053b9921ad6ee8656

SHA256
3a2b589a929b80781e9fb75a47073c2e991f05d7e795e207c7bb4a8044a8bfea

SHA512
09be425b3c8bc80ecb2fe37e87d8270f67992e8997d8774a705f0879f6decaea1379a21ec63698d5443a7ce19bbd97f14f8ff87bb7b193a58e53bc6cde3c482f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06879a0b6516b141440eb77dca2050fa

SHA1
cd7812eedb261680402d22358720a2d8e6c6dabf

SHA256
b32119b533c0ebd0a50fa33c3fbd50a30f249a3569158b8da4f2531622ed3f70

SHA512
d26d9a6982524b29a6cbacdd69c551c4924691e34df8a6583e1308121ed2c018d7e493e529e6703c3cdd395161f78d2a8627d2e63476626e024669558d571904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd53b90a74fe3908c77415ce5230d0b5

SHA1
c7be8fddd414c05485ef6b42689764e953484536

SHA256
3c06a83eae6322778e7667c2e0682dfa3395a3b01a88636aabf3ca2bec9d6916

SHA512
ea80b18dcae91ac9300b231d42639ee3de289dcbb52f4ef8790c583fd31d6faca933bca657eecdcd8c49336df039e8e490f711a91b7e9c9bf500289c712b53b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86078973c32ab184760630777d3a4bcb

SHA1
baab8c3e519dd966de5a89ac12a1117c3dcce07c

SHA256
d015bdcefad9f185a983d0aa87c4dea3559933a5440cc5185a894052ecb47886

SHA512
0ff50d0dd677dc975d3f2a130cc2efb743bd59676ccf3e3b05bd82334cb379fdb2e993c74ab9db4e2682ff28f1d7e0d0b49831004415a72d5eaed4ab6cf7d63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{54BA5E61-F555-11EF-8BDE-523A95B0E536}.dat

Filesize
5KB

MD5
e840f1e695d053bed563913afe11fe72

SHA1
0b144d424c2855c563d97de27d544ff6ba9a778f

SHA256
43952cf346bab38d8c70eae81997cf3f90c8cc6ea9b05dd682f5677e59a0d3e6

SHA512
993e582c691a9c0f8cb0e19b0f06970ebfd4773b4bc1d4ab4a3a2c8dd920efd1158a496625312c350e545c3c31dcdd42925448a737474c1d3728f80fef607ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{54BD1D81-F555-11EF-8BDE-523A95B0E536}.dat

Filesize
4KB

MD5
7bb70c548b4bfc16f7a2a657148c21bb

SHA1
556661b73292b886010501a5014f84663e8d4cbb

SHA256
cd21900c80e4dba7984372c4a9fca8573bc7e4f15610e22e4f3c60606b021a20

SHA512
5924243c61c4918a608025500019eb78cf464ef17ecfe154514ad0223d6b1e41431faa58660c45db7ced0003cf1620754cea58376bcb0fe47c4b5b401e3fb066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\NewErrorPageTemplate[1]

Filesize
1KB

MD5
cdf81e591d9cbfb47a7f97a2bcdb70b9

SHA1
8f12010dfaacdecad77b70a3e781c707cf328496

SHA256
204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

SHA512
977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\dnserror[1]

Filesize
1KB

MD5
73c70b34b5f8f158d38a94b9d7766515

SHA1
e9eaa065bd6585a1b176e13615fd7e6ef96230a9

SHA256
3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

SHA512
927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\httpErrorPagesScripts[2]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A40.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFB417385C7A55510A.TMP

Filesize
16KB

MD5
5dee637a4de000cbc2f651179ca88971

SHA1
17b3ebeb87c314f90988873ffa859cc67c7e6e0a

SHA256
04ff763bbc687adec0b1757b62fb32959a44483a0cc9b1d86da2fcf8d2cb37a3

SHA512
f4503c0822a78358f83fb4cdd7ac8e08cb17526eaadf166f4ae788601384b7681aa0e6a45a11028b09a01194b7226c0a338b5b34dc54842ca5c7ae1b68d10edc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
43dcfc0d6c621a9cf4972bcf73ff6718

SHA1
6cf04b75047d30c13c4c93a8396191b26d99d5d6

SHA256
88482bfe43715a9f85523870edb4e8fa80ea3704c92cbd65620076bda10406fb

SHA512
e57faa56b22b47fa11954b2019a13c9c769b18c839d8ed9c93c638b34a7fd3c8ac8ddb00b7d597a6d91edbbe4e74f7f3ff4ffb28512f56285184407a1889af07

Download Submit
memory/2712-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2712-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2712-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2712-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2712-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2712-26-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2712-10-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2712-27-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2836-12-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/2836-23-0x0000000000340000-0x000000000034F000-memory.dmp

Filesize
60KB

Download
memory/2836-21-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2836-20-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2836-504-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/2836-503-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2836-22-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2836-9-0x0000000000220000-0x000000000027D000-memory.dmp

Filesize
372KB

Download
memory/2836-8-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download