dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419

Analysis

user interaction
yes
max time kernel
76s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Abantes.exe
Size 2.7MB
Sample260822-ty2tzshr71
SHA256 dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419
MD5 cd2e58136d3049e9be40ae29f9250c93
SHA1 e97beb8b87d130e5c5745981e3614ed6aa3caae3
SHA512 3ad23ad35d23acfa9edc187f443f28c4bb11279472632726f450b10cc09a653e10f4832f9cca44d063ad1259de6c7017ca6ca8f64ed07d302c3b2d06628f0ba7
SSDEEP 49152:yi98eUDa7+tCg3e+zNWZjUDa7+tCg3e+zNWyUDa7+tCg3e+zNWR9Bh:yAC+7+p3ej2+7+p3ejh+7+p3ejDBh
TLSH
T140D5E113A6D0C521E5FA3B709B7289E90B367E18ACA0E5AF11153D8F3F716438C3576A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe, C:\\Windows\\Defender\\Abantes.exe"	Abantes.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 49 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe	Abantes.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4008	netsh.exe

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
3848	icacls.exe
4288	takeown.exe
2084	icacls.exe
3576	takeown.exe
1504	takeown.exe
4512	takeown.exe
3428	icacls.exe
1704	takeown.exe
2296	takeown.exe
3460	takeown.exe
1908	icacls.exe
4344	icacls.exe
4928	icacls.exe
2980	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Abantes.exe

Executes dropped EXE 1 IoCs

pid	Process
3500	Abantes.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1704	takeown.exe
3848	icacls.exe
4288	takeown.exe
2296	takeown.exe
3576	takeown.exe
1908	icacls.exe
4344	icacls.exe
2084	icacls.exe
3460	takeown.exe
1504	takeown.exe
4512	takeown.exe
4928	icacls.exe
2980	icacls.exe
3428	icacls.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Abantes.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	Abantes.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Defender\cursor.cur	Abantes.exe
File created	C:\Windows\Defender\icon.ico	Abantes.exe
File created	C:\Windows\Defender\LogonUIStart.exe	Abantes.exe
File created	C:\Windows\Defender\Payloads.dll	Abantes.exe
File created	C:\Windows\Defender\explorer.exe.mui	Abantes.exe
File created	C:\Windows\Defender\Abantes.exe	Abantes.exe
File created	C:\Windows\en-US\explorer.exe.mui	cmd.exe
File created	C:\Windows\Defender\IFEO.exe	Abantes.exe
File created	C:\Windows\Defender\Rules.exe	Abantes.exe
File created	C:\Windows\Defender\authui.dll.mui	Abantes.exe
File opened for modification	C:\Windows\Defender\wallpaper.jpg	Abantes.exe
File opened for modification	C:\Windows\en-US\explorer.exe.mui	cmd.exe
File created	C:\Windows\Defender\logonOverwrite.bat	Abantes.exe
File created	C:\Windows\Defender\LogonUi.exe	Abantes.exe
File created	C:\Windows\Defender\data.bin	Abantes.exe
File opened for modification	C:\Windows\Defender\Abantes.exe	Abantes.exe
File opened for modification	C:\Windows\Defender	Abantes.exe
File created	C:\Windows\Defender\Action.bat	Abantes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4504	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abantes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abantes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
228	timeout.exe
3912	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4040	taskkill.exe

Modifies Control Panel 16 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\Help = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\SizeNWSE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\SizeNESW = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\WallpaperStyle = "2"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\SizeWE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\NWPen = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\TileWallpaper = "0"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\No = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Mouse\MouseTrails = "7"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\Wait = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\UpArrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\SizeNS = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\SizeAll = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Cursors\Hand = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	Abantes.exe
3500	Abantes.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2332	Process not Found
4544	Process not Found
1300	Process not Found
2648	Process not Found
2564	Process not Found
4224	Process not Found
3164	Process not Found
1488	Process not Found
4708	Process not Found
2112	Process not Found
3300	Process not Found
1376	Process not Found
2292	Process not Found
5080	Process not Found
1820	Process not Found
804	Process not Found
3748	Process not Found
948	Process not Found
3972	Process not Found
4464	Process not Found
4312	Process not Found
2976	Process not Found
2008	Process not Found
1704	Process not Found
3572	Process not Found
1800	Process not Found
540	Process not Found
2960	Process not Found
1636	Process not Found
1668	Process not Found
3824	Process not Found
4088	Process not Found
3568	Process not Found
3932	Process not Found
5032	Process not Found
3376	Process not Found
5008	Process not Found
3500	Process not Found
1320	Process not Found
3508	Process not Found
3940	Process not Found
8	Process not Found
3436	Process not Found
4248	Process not Found
2664	Process not Found
2084	Process not Found
4968	Process not Found
2296	Process not Found
2448	Process not Found
3576	Process not Found
4508	Process not Found
2156	Process not Found
2252	Process not Found
4564	Process not Found
2864	Process not Found
2400	Process not Found
2968	Process not Found
1896	Process not Found
2192	Process not Found
3116	Process not Found
3740	Process not Found
3888	Process not Found
3204	Process not Found
4524	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	Abantes.exe
Token: SeTakeOwnershipPrivilege	1704	takeown.exe
Token: SeTakeOwnershipPrivilege	4288	takeown.exe
Token: SeDebugPrivilege	3500	Abantes.exe
Token: SeTakeOwnershipPrivilege	2296	takeown.exe
Token: SeTakeOwnershipPrivilege	3576	takeown.exe
Token: SeTakeOwnershipPrivilege	3460	takeown.exe
Token: SeTakeOwnershipPrivilege	4512	takeown.exe
Token: SeIncreaseQuotaPrivilege	4908	WMIC.exe
Token: SeSecurityPrivilege	4908	WMIC.exe
Token: SeTakeOwnershipPrivilege	4908	WMIC.exe
Token: SeLoadDriverPrivilege	4908	WMIC.exe
Token: SeSystemProfilePrivilege	4908	WMIC.exe
Token: SeSystemtimePrivilege	4908	WMIC.exe
Token: SeProfSingleProcessPrivilege	4908	WMIC.exe
Token: SeIncBasePriorityPrivilege	4908	WMIC.exe
Token: SeCreatePagefilePrivilege	4908	WMIC.exe
Token: SeBackupPrivilege	4908	WMIC.exe
Token: SeRestorePrivilege	4908	WMIC.exe
Token: SeShutdownPrivilege	4908	WMIC.exe
Token: SeDebugPrivilege	4908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4908	WMIC.exe
Token: SeRemoteShutdownPrivilege	4908	WMIC.exe
Token: SeUndockPrivilege	4908	WMIC.exe
Token: SeManageVolumePrivilege	4908	WMIC.exe
Token: 33	4908	WMIC.exe
Token: 34	4908	WMIC.exe
Token: 35	4908	WMIC.exe
Token: 36	4908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4908	WMIC.exe
Token: SeSecurityPrivilege	4908	WMIC.exe
Token: SeTakeOwnershipPrivilege	4908	WMIC.exe
Token: SeLoadDriverPrivilege	4908	WMIC.exe
Token: SeSystemProfilePrivilege	4908	WMIC.exe
Token: SeSystemtimePrivilege	4908	WMIC.exe
Token: SeProfSingleProcessPrivilege	4908	WMIC.exe
Token: SeIncBasePriorityPrivilege	4908	WMIC.exe
Token: SeCreatePagefilePrivilege	4908	WMIC.exe
Token: SeBackupPrivilege	4908	WMIC.exe
Token: SeRestorePrivilege	4908	WMIC.exe
Token: SeShutdownPrivilege	4908	WMIC.exe
Token: SeDebugPrivilege	4908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4908	WMIC.exe
Token: SeRemoteShutdownPrivilege	4908	WMIC.exe
Token: SeUndockPrivilege	4908	WMIC.exe
Token: SeManageVolumePrivilege	4908	WMIC.exe
Token: 33	4908	WMIC.exe
Token: 34	4908	WMIC.exe
Token: 35	4908	WMIC.exe
Token: 36	4908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4940	WMIC.exe
Token: SeSecurityPrivilege	4940	WMIC.exe
Token: SeTakeOwnershipPrivilege	4940	WMIC.exe
Token: SeLoadDriverPrivilege	4940	WMIC.exe
Token: SeSystemProfilePrivilege	4940	WMIC.exe
Token: SeSystemtimePrivilege	4940	WMIC.exe
Token: SeProfSingleProcessPrivilege	4940	WMIC.exe
Token: SeIncBasePriorityPrivilege	4940	WMIC.exe
Token: SeCreatePagefilePrivilege	4940	WMIC.exe
Token: SeBackupPrivilege	4940	WMIC.exe
Token: SeRestorePrivilege	4940	WMIC.exe
Token: SeShutdownPrivilege	4940	WMIC.exe
Token: SeDebugPrivilege	4940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4940	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
456	LogonUI.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4504	3792	Abantes.exe	85
PID 4504 wrote to memory of 1704	4504	cmd.exe	87
PID 4504 wrote to memory of 3848	4504	cmd.exe	88
PID 4504 wrote to memory of 4288	4504	cmd.exe	89
PID 4504 wrote to memory of 2084	4504	cmd.exe	92
PID 4504 wrote to memory of 2296	4504	cmd.exe	93
PID 4504 wrote to memory of 3576	4504	cmd.exe	94
PID 4504 wrote to memory of 3460	4504	cmd.exe	97
PID 4504 wrote to memory of 1504	4504	cmd.exe	98
PID 4504 wrote to memory of 4512	4504	cmd.exe	99
PID 4504 wrote to memory of 1908	4504	cmd.exe	100
PID 4504 wrote to memory of 4344	4504	cmd.exe	101
PID 4504 wrote to memory of 4928	4504	cmd.exe	102
PID 4504 wrote to memory of 2980	4504	cmd.exe	103
PID 4504 wrote to memory of 3428	4504	cmd.exe	104
PID 4504 wrote to memory of 4908	4504	cmd.exe	105
PID 4504 wrote to memory of 4940	4504	cmd.exe	107
PID 4504 wrote to memory of 4008	4504	cmd.exe	108
PID 4504 wrote to memory of 4040	4504	cmd.exe	110
PID 4504 wrote to memory of 228	4504	cmd.exe	111
PID 4504 wrote to memory of 3912	4504	cmd.exe	112
PID 3792 wrote to memory of 3064	3792	Abantes.exe	118

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Welcome To Hell"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "This Computer has been Infected by the Abantes Trojan. Hope You Enjoy."	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	Abantes.exe

C:\Users\Admin\AppData\Local\Temp\Abantes.exe
"C:\Users\Admin\AppData\Local\Temp\Abantes.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Defender\Action.bat""
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f logonui.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\SysWOW64\icacls.exe
    icacls logonui.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3848
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\System32\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\System32\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2084
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f explorer.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f regedit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f HelpPane.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\Temp" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1504
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\Temp" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1908
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\SysWOW64\icacls.exe
    icacls regedit.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Windows\SysWOW64\icacls.exe
    icacls explorer.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\icacls.exe
    icacls HelpPane.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='Abantes Was Here'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'Abantes Was Here'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\SysWOW64\netsh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4040
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:228
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3912
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /l /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064

C:\Windows\Defender\Abantes.exe
C:\Windows\Defender\Abantes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bf855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Abantes.exe

Path C:\Windows\Defender\Abantes.exe
Size 2.7MB
SHA256 dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419
MD5 cd2e58136d3049e9be40ae29f9250c93
SHA1 e97beb8b87d130e5c5745981e3614ed6aa3caae3
SHA512 3ad23ad35d23acfa9edc187f443f28c4bb11279472632726f450b10cc09a653e10f4832f9cca44d063ad1259de6c7017ca6ca8f64ed07d302c3b2d06628f0ba7
SSDEEP 49152:yi98eUDa7+tCg3e+zNWZjUDa7+tCg3e+zNWyUDa7+tCg3e+zNWR9Bh:yAC+7+p3ej2+7+p3ejh+7+p3ejDBh
TLSH
T140D5E113A6D0C521E5FA3B709B7289E90B367E18ACA0E5AF11153D8F3F716438C3576A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Action.bat

Path C:\Windows\Defender\Action.bat
Size 1KB
SHA256 d06d5f8501501af5677b133ff7aa531ccf1bf9b2673a1f26117f0420532b599e
MD5 8b3585b4f84496c306b6c082ea6e52ef
SHA1 04bf1cf0f68a571e746fb7c863f71fa70e0e79d3
SHA512 733bb98473fc8b3c8f0f96ff5ccec9212c36f7162742ee124d6a0edd0186e171ec61de97a3268663812802c90d29cd1e5077af72e02f550d94d67ebe106c0591
TLSH
T13C1186F381AE00A6C0336F88418F82979146F17BE25809305DA9230CEFC040ADC666DB
MD5 SHA1 SHA512 TLSH

Submit Download

authui.dll.mui

Path C:\Windows\Defender\authui.dll.mui
Size 21KB
SHA256 6baf83c2c45f0e3a1a1dedc799cce6adb766dabe25baa847f9dd308aae0218eb
MD5 a3a8fb6325f2f4fd31039775be19a9a4
SHA1 dba1acba938c8720b23b992ef77f130b6dbe7428
SHA512 9a03528d3b1a6a0bc3fbce6149d1cf6e21fe629c53d1b93954e6147cdfbf95eb272e75dbf906e38a1981706e71f679fda680cdf8601491ba792576c9b54d043e
SSDEEP 384:4jd/Dd/CGw488rk1aptWcAqTT3kSW6liW:udd/dw488X
TLSH
T177A2CB6263F80624F9F73F745AB946A54A37BCA6BC79C21D0254909E5AB5F20CC30B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe.mui

Path C:\Windows\Defender\explorer.exe.mui
Size 15KB
SHA256 b69b61675531060d350a795a53568ccf19a146060cebb659ebc658a0e8b27fc9
MD5 39f1a6a8b713fcf30afc03ea3c936f85
SHA1 9209b25730c7896e047e5a4fc1da73c294e55c0e
SHA512 82b402b1c94fb8444e9d32f10becad994715667fc36d427faf6ae4f433c8e7025c3ca387e6cae7fb4e14f2e9f36446354c1c2585445fd79e7673b78419232780
SSDEEP 192:WQRGfF2cccc3cccccccccccccccccccccccccccvcccvc/ccccPvvPccccPPcfck:HRGfFMWMQhW
TLSH
T16562A87253D04B11ECB36F314AF187DA9A137CA8BC7A852E4568318D5EAAF20DD31F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-25-0x00000000055B0000-0x00000000055C0000-memory.dmp

Download

memory/3792-0-0x0000000000A30000-0x0000000000CE8000-memory.dmp

Download

memory/3792-1-0x0000000005E10000-0x00000000063B4000-memory.dmp

Download

memory/3792-2-0x0000000005770000-0x0000000005802000-memory.dmp

Download

memory/3792-3-0x0000000005850000-0x0000000005860000-memory.dmp

Download

memory/3792-4-0x0000000003200000-0x0000000003254000-memory.dmp

Download

memory/3792-5-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/3792-31-0x0000000005850000-0x0000000005860000-memory.dmp

Download