Resubmissions
18-11-2020 14:18
201118-dj27sn3f52 1018-11-2020 13:42
201118-1arz86e7w6 1018-11-2020 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
1801s -
max time network
1804s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 13:42
General
-
Target
1.bin.exe
Score
10/10
Malware Config
Extracted
Family
formbook
Version
4.0
C2
http://www.worstig.com/w9z/
Decoy
crazzysex.com
hanferd.com
gteesrd.com
bayfrontbabyplace.com
jicuiquan.net
relationshiplink.net
ohchacyberphoto.com
kauegimenes.com
powerful-seldom.com
ketotoken.com
make-money-online-success.com
redgoldcollection.com
hannan-football.com
hamptondc.com
vllii.com
aa8520.com
platform35markethall.com
larozeimmo.com
oligopoly.net
llhak.info
Extracted
Family
gozi_rm3
Attributes
-
exe_type
loader
Extracted
Family
gozi_rm3
Botnet
86920224
C2
https://sibelikinciel.xyz
Attributes
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Extracted
Family
formbook
Version
4.1
C2
http://www.norjax.com/app/
http://www.joomlas123.com/i0qi/
Decoy
niresandcard.com
bonusscommesseonline.com
mezhyhirya.com
paklfz.com
bespokewomensuits.com
smarteralarm.info
munespansiyon.com
pmtradehouse.com
hotmobile-uk.com
ntdao.com
zohariaz.com
www145123.com
oceanstateofstyle.com
palermofelicissima.info
yourkinas.com
pthwheel.net
vfmagent.com
xn--3v0bw66b.com
comsystematrisk.win
on9.party
Extracted
Family
danabot
C2
92.204.160.54
2.56.213.179
45.153.186.47
93.115.21.29
185.45.193.50
193.34.166.247
rsa_pubkey.plain
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Ransom Note
YOUR FILES ARE ENCRYPTED
Don't worry,you can return all your files!
If you want to restore them, follow this link: email Bit_decrypt@protonmail.com YOUR ID
If you have not been answered via the link within 12 hours, write to us by e-mail: Bit_decrypt@protonmail.com
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails
Bit_decrypt@protonmail.com
Extracted
Family
qakbot
Version
324.141
Botnet
spx129
Campaign
1590734339
C2
94.10.81.239:443
94.52.160.116:443
67.0.74.119:443
175.137.136.79:443
73.232.165.200:995
79.119.67.149:443
62.38.111.70:2222
108.58.9.238:993
216.110.249.252:2222
67.209.195.198:3389
84.247.55.190:443
96.37.137.42:443
94.176.220.76:2222
173.245.152.231:443
96.227.122.123:443
188.192.75.8:995
24.229.245.124:995
71.163.225.75:443
75.71.77.59:443
104.36.135.227:443
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Danabot x86 payload 6 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Gozi RM3
A heavily modified version of Gozi using RM3 loader.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Windows security bypass 2 TTPs
-
AgentTesla Payload 30 IoCs
-
CryptOne packer 12 IoCs
Detects CryptOne packer defined in NCC blogpost.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Formbook Payload 22 IoCs
-
Guloader Payload 14 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Adds policy Run key to start application 2 TTPs 6 IoCs
-
Blocklisted process makes network request 64 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 55 IoCs
-
Looks for VMWare Tools registry key 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks QEMU agent file 2 TTPs 15 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Drops startup file 6 IoCs
-
Loads dropped DLL 8 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Suspicious use of SetThreadContext 60 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.bin.exe"C:\Users\Admin\AppData\Local\Temp\1.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\72D4.tmp\72E5.tmp\72E6.bat C:\Users\Admin\AppData\Local\Temp\1.bin.exe"3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@23925⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f06⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile7⤵
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1ABC.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8E6.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"6⤵
- Executes dropped EXE
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"7⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\21.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"5⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp828A.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe5⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe /C6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe" /W7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn {443ECB41-6BF9-43C7-8A29-80B91C594C83} /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe\"" /sc HOURLY /mo 5 /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nznjchi /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I nznjchi" /SC ONCE /Z /ST 14:50 /ET 15:025⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@51165⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f06⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 15366⤵
- Drops file in Windows directory
- Program crash
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\11.exe"3⤵
-
C:\Program Files (x86)\Dedud\IconCachelvh.exe"C:\Program Files (x86)\Dedud\IconCachelvh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Dedud\IconCachelvh.exe"C:\Program Files (x86)\Dedud\IconCachelvh.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
-
C:\Program Files (x86)\Bkx4lor5\vtxppxhq.exe"C:\Program Files (x86)\Bkx4lor5\vtxppxhq.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Gathers network information
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /I nznjchi1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq" /d "0"2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Roaming\27.exe"2⤵
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN nznjchi2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:82945 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5912 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5912 CREDAT:82947 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3608 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3584 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4564 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5260 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5268 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6064 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6032 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5504 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6048 CREDAT:82945 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:744 CREDAT:82945 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5740 CREDAT:82945 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4412 CREDAT:82945 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:752 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Disabling Security Tools
2Modify Registry
7File Deletion
2Virtualization/Sandbox Evasion
2Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Bkx4lor5\vtxppxhq.exe
-
C:\Program Files (x86)\Bkx4lor5\vtxppxhq.exe
-
C:\Program Files (x86)\Dedud\IconCachelvh.exe
-
C:\Program Files (x86)\Dedud\IconCachelvh.exe
-
C:\Program Files (x86)\Dedud\IconCachelvh.exe
-
C:\Program Files (x86)\Sob8\ulrl2k.exe
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\11.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\21.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\18.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\24.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{79CE517A-29AD-11EB-B59A-E6CA00F544D8}.dat
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.id-2FD39CE9.[Bit_decrypt@protonmail.com].BOMBO
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\71M03WAJ.cookie
-
C:\Users\Admin\AppData\Local\Temp\72D4.tmp\72E5.tmp\72E6.bat
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp1ABC.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmp828A.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmpB8E6.tmp
-
C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logim.jpeg
-
C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logri.ini
-
C:\Users\Admin\AppData\Roaming\-L3O44A9\-L3logrv.ini
-
C:\Users\Admin\AppData\Roaming\1.jar
-
C:\Users\Admin\AppData\Roaming\10.exe
-
C:\Users\Admin\AppData\Roaming\10.exe
-
C:\Users\Admin\AppData\Roaming\11.exe
-
C:\Users\Admin\AppData\Roaming\11.exe
-
C:\Users\Admin\AppData\Roaming\11.exe
-
C:\Users\Admin\AppData\Roaming\12.exe
-
C:\Users\Admin\AppData\Roaming\12.exe
-
C:\Users\Admin\AppData\Roaming\13.exe
-
C:\Users\Admin\AppData\Roaming\13.exe
-
C:\Users\Admin\AppData\Roaming\13.exe
-
C:\Users\Admin\AppData\Roaming\14.exe
-
C:\Users\Admin\AppData\Roaming\14.exe
-
C:\Users\Admin\AppData\Roaming\15.exe
-
C:\Users\Admin\AppData\Roaming\15.exe
-
C:\Users\Admin\AppData\Roaming\16.exe
-
C:\Users\Admin\AppData\Roaming\16.exe
-
C:\Users\Admin\AppData\Roaming\17.exe
-
C:\Users\Admin\AppData\Roaming\17.exe
-
C:\Users\Admin\AppData\Roaming\18.exe
-
C:\Users\Admin\AppData\Roaming\18.exe
-
C:\Users\Admin\AppData\Roaming\19.exe
-
C:\Users\Admin\AppData\Roaming\19.exe
-
C:\Users\Admin\AppData\Roaming\2.exe
-
C:\Users\Admin\AppData\Roaming\2.exe
-
C:\Users\Admin\AppData\Roaming\2.exe
-
C:\Users\Admin\AppData\Roaming\20.exe
-
C:\Users\Admin\AppData\Roaming\20.exe
-
C:\Users\Admin\AppData\Roaming\20.exe
-
C:\Users\Admin\AppData\Roaming\21.exe
-
C:\Users\Admin\AppData\Roaming\21.exe
-
C:\Users\Admin\AppData\Roaming\21.exe
-
C:\Users\Admin\AppData\Roaming\22.exe
-
C:\Users\Admin\AppData\Roaming\22.exe
-
C:\Users\Admin\AppData\Roaming\23.exe
-
C:\Users\Admin\AppData\Roaming\23.exe
-
C:\Users\Admin\AppData\Roaming\24.exe
-
C:\Users\Admin\AppData\Roaming\24.exe
-
C:\Users\Admin\AppData\Roaming\24.exe
-
C:\Users\Admin\AppData\Roaming\25.exe
-
C:\Users\Admin\AppData\Roaming\25.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\26.exe
-
C:\Users\Admin\AppData\Roaming\27.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\27.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\27.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\27.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\28.exe
-
C:\Users\Admin\AppData\Roaming\28.exe
-
C:\Users\Admin\AppData\Roaming\29.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
C:\Users\Admin\AppData\Roaming\29.exe
-
C:\Users\Admin\AppData\Roaming\29.exe
-
C:\Users\Admin\AppData\Roaming\3.exe
-
C:\Users\Admin\AppData\Roaming\3.exe
-
C:\Users\Admin\AppData\Roaming\3.exe
-
C:\Users\Admin\AppData\Roaming\30.exe
-
C:\Users\Admin\AppData\Roaming\30.exe
-
C:\Users\Admin\AppData\Roaming\31.exe
-
C:\Users\Admin\AppData\Roaming\31.exe
-
C:\Users\Admin\AppData\Roaming\4.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
C:\Users\Admin\AppData\Roaming\4.exe
-
C:\Users\Admin\AppData\Roaming\4.exe
-
C:\Users\Admin\AppData\Roaming\5.exe
-
C:\Users\Admin\AppData\Roaming\5.exe
-
C:\Users\Admin\AppData\Roaming\6.exeMD5
cf04c482d91c7174616fb8e83288065a
SHA16444eb10ec9092826d712c1efad73e74c2adae14
SHA2567b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA5123eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6
-
C:\Users\Admin\AppData\Roaming\6.exeMD5
cf04c482d91c7174616fb8e83288065a
SHA16444eb10ec9092826d712c1efad73e74c2adae14
SHA2567b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf
SHA5123eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6
-
C:\Users\Admin\AppData\Roaming\7.exe
-
C:\Users\Admin\AppData\Roaming\7.exe
-
C:\Users\Admin\AppData\Roaming\8.exeMD5
dea5598aaf3e9dcc3073ba73d972ab17
SHA151da8356e81c5acff3c876dffbf52195fe87d97f
SHA2568ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e
-
C:\Users\Admin\AppData\Roaming\8.exeMD5
dea5598aaf3e9dcc3073ba73d972ab17
SHA151da8356e81c5acff3c876dffbf52195fe87d97f
SHA2568ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e
-
C:\Users\Admin\AppData\Roaming\9.exe
-
C:\Users\Admin\AppData\Roaming\9.exe
-
C:\Users\Admin\AppData\Roaming\9.exe
-
C:\Users\Admin\AppData\Roaming\9.exe
-
C:\Users\Admin\AppData\Roaming\9.exe
-
C:\Users\Admin\AppData\Roaming\AnLKhBlJfQ.exe
-
C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logim.jpeg
-
C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logri.ini
-
C:\Users\Admin\AppData\Roaming\J-96T9R9\J-9logrv.ini
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.dat
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Iovtkgq\kicwd.exeMD5
3d2c6861b6d0899004f8abe7362f45b7
SHA133855b9a9a52f9183788b169cc5d57e6ad9da994
SHA256dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064
SHA51219b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupCMD28.lnk
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
07eb1b537ea912c425ec19e173f27e9f
SHA1345fcbbac23df9c9b39385cee5ea260b82a7ed66
SHA25633def3d0a7fb776829bf37216238436f16e3fb6e3efc519da2524de2069cb87c
SHA512d5908b5207caaeea62ebe2d89b1442766a39a53a358f8064c9d24b2570397d3508f495bcaa4866fe3b07973436b00a0d8bf98e42ebd3128d40f39c2a0e1fe88b
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogim.jpeg
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogri.ini
-
C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogrv.ini
-
C:\Users\Admin\AppData\Roaming\feeed.exeMD5
dea5598aaf3e9dcc3073ba73d972ab17
SHA151da8356e81c5acff3c876dffbf52195fe87d97f
SHA2568ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e
-
C:\Users\Admin\AppData\Roaming\feeed.exeMD5
dea5598aaf3e9dcc3073ba73d972ab17
SHA151da8356e81c5acff3c876dffbf52195fe87d97f
SHA2568ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c
SHA512a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e
-
C:\Users\Admin\AppData\Roaming\wWTxgR.exe
-
C:\Users\Admin\Favorites\Bing.url.id-2FD39CE9.[Bit_decrypt@protonmail.com].BOMBO
-
C:\Windows\system32\drivers\etc\hosts
-
\Users\Admin\AppData\Roaming\29.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
\Users\Admin\AppData\Roaming\29.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
\Users\Admin\AppData\Roaming\4.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
\Users\Admin\AppData\Roaming\4.dllMD5
986d769a639a877a9b8f4fb3c8616911
SHA1ba1cc29d845d958bd60c989eaa36fdaf9db7ea41
SHA256c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457
SHA5123a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187
-
memory/208-3-0x0000000000000000-mapping.dmp
-
memory/252-435-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/252-433-0x000000000044A49E-mapping.dmp
-
memory/252-432-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/396-541-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/396-526-0x0000000000000000-mapping.dmp
-
memory/416-379-0x0000000000000000-mapping.dmp
-
memory/612-204-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/612-207-0x0000000000449E3E-mapping.dmp
-
memory/652-344-0x0000000000000000-mapping.dmp
-
memory/720-382-0x00000000004015B4-mapping.dmp
-
memory/724-650-0x0000000000000000-mapping.dmp
-
memory/724-654-0x00000000000000E0-mapping.dmp
-
memory/860-384-0x0000000000000000-mapping.dmp
-
memory/860-414-0x0000000002900000-0x000000000293A000-memory.dmpFilesize
232KB
-
memory/940-5-0x0000000000000000-mapping.dmp
-
memory/940-4-0x0000000000000000-mapping.dmp
-
memory/956-186-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/956-83-0x0000000000000000-mapping.dmp
-
memory/956-174-0x0000000003003000-0x0000000003004000-memory.dmpFilesize
4KB
-
memory/956-84-0x0000000000000000-mapping.dmp
-
memory/1036-275-0x0000000000000000-mapping.dmp
-
memory/1036-274-0x0000000000000000-mapping.dmp
-
memory/1040-95-0x0000000000000000-mapping.dmp
-
memory/1040-94-0x0000000000000000-mapping.dmp
-
memory/1172-19-0x0000000000000000-mapping.dmp
-
memory/1172-50-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1172-18-0x0000000000000000-mapping.dmp
-
memory/1280-507-0x0000000000000000-mapping.dmp
-
memory/1308-9-0x0000000000000000-mapping.dmp
-
memory/1308-8-0x0000000000000000-mapping.dmp
-
memory/1700-647-0x0000000000000000-mapping.dmp
-
memory/1836-691-0x00000000000000E0-mapping.dmp
-
memory/1836-688-0x0000000000000000-mapping.dmp
-
memory/1844-293-0x0000000000401594-mapping.dmp
-
memory/1860-509-0x0000000000000000-mapping.dmp
-
memory/1908-408-0x0000000000000000-mapping.dmp
-
memory/1908-411-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/1976-388-0x0000000000000000-mapping.dmp
-
memory/2008-643-0x0000000000000000-mapping.dmp
-
memory/2064-511-0x0000000000000000-mapping.dmp
-
memory/2064-508-0x0000000000000000-mapping.dmp
-
memory/2080-608-0x0000000000000000-mapping.dmp
-
memory/2080-614-0x00000000000000E0-mapping.dmp
-
memory/2116-22-0x0000000000000000-mapping.dmp
-
memory/2116-23-0x0000000000000000-mapping.dmp
-
memory/2180-240-0x0000000000000000-mapping.dmp
-
memory/2212-539-0x0000000000000000-mapping.dmp
-
memory/2212-543-0x00000000000000E0-mapping.dmp
-
memory/2252-51-0x0000000000000000-mapping.dmp
-
memory/2252-52-0x0000000000000000-mapping.dmp
-
memory/2284-40-0x0000000000000000-mapping.dmp
-
memory/2284-89-0x0000000007C80000-0x0000000007C81000-memory.dmpFilesize
4KB
-
memory/2284-66-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/2284-78-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/2284-41-0x0000000000000000-mapping.dmp
-
memory/2284-56-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2284-82-0x0000000004E90000-0x0000000004E92000-memory.dmpFilesize
8KB
-
memory/2284-87-0x00000000069B0000-0x0000000006A03000-memory.dmpFilesize
332KB
-
memory/2284-49-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/2284-60-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2300-62-0x0000000000000000-mapping.dmp
-
memory/2300-61-0x0000000000000000-mapping.dmp
-
memory/2372-45-0x0000000000000000-mapping.dmp
-
memory/2372-44-0x0000000000000000-mapping.dmp
-
memory/2372-105-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/2372-103-0x0000000003013000-0x0000000003014000-memory.dmpFilesize
4KB
-
memory/2392-12-0x0000000000000000-mapping.dmp
-
memory/2392-114-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/2392-13-0x0000000000000000-mapping.dmp
-
memory/2680-682-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-493-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-633-0x0000000002BE0000-0x0000000002CDC000-memory.dmpFilesize
1008KB
-
memory/2680-69-0x00000000008F0000-0x0000000000917000-memory.dmpFilesize
156KB
-
memory/2680-613-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-461-0x0000000002BE0000-0x0000000002CDC000-memory.dmpFilesize
1008KB
-
memory/2680-491-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-442-0x0000000005BD0000-0x0000000005D47000-memory.dmpFilesize
1.5MB
-
memory/2680-689-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-680-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-123-0x00000000059A0000-0x0000000005A50000-memory.dmpFilesize
704KB
-
memory/2680-610-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-67-0x0000000000000000-mapping.dmp
-
memory/2680-591-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-670-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-510-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2680-68-0x00000000008F0000-0x0000000000917000-memory.dmpFilesize
156KB
-
memory/2680-553-0x0000000005BA0000-0x0000000005D06000-memory.dmpFilesize
1.4MB
-
memory/2908-555-0x00000000000000E0-mapping.dmp
-
memory/2908-552-0x0000000000000000-mapping.dmp
-
memory/2940-81-0x0000000000000000-mapping.dmp
-
memory/3012-378-0x0000000002A10000-0x0000000002A11000-memory.dmpFilesize
4KB
-
memory/3012-320-0x0000000000000000-mapping.dmp
-
memory/3060-513-0x0000000000000000-mapping.dmp
-
memory/3148-396-0x0000000000000000-mapping.dmp
-
memory/3172-0-0x0000000000000000-mapping.dmp
-
memory/3176-538-0x00000000000000E0-mapping.dmp
-
memory/3176-535-0x0000000000000000-mapping.dmp
-
memory/3508-523-0x0000000000000000-mapping.dmp
-
memory/3656-15-0x0000000000000000-mapping.dmp
-
memory/3656-16-0x0000000000000000-mapping.dmp
-
memory/3672-92-0x0000000000000000-mapping.dmp
-
memory/3732-391-0x0000000000000000-mapping.dmp
-
memory/3808-635-0x00000000000000E0-mapping.dmp
-
memory/3808-628-0x0000000000000000-mapping.dmp
-
memory/3828-88-0x00000000055A0000-0x00000000055A2000-memory.dmpFilesize
8KB
-
memory/3828-48-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/3828-55-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/3828-28-0x0000000000000000-mapping.dmp
-
memory/3828-27-0x0000000000000000-mapping.dmp
-
memory/3828-91-0x00000000055B0000-0x00000000055B2000-memory.dmpFilesize
8KB
-
memory/3828-72-0x0000000001350000-0x0000000001352000-memory.dmpFilesize
8KB
-
memory/3828-90-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/3828-70-0x0000000001330000-0x000000000133F000-memory.dmpFilesize
60KB
-
memory/3900-258-0x00000000004015B4-mapping.dmp
-
memory/3964-364-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/3964-281-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/3964-279-0x000000000044C82E-mapping.dmp
-
memory/3964-278-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3984-30-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3984-32-0x000000000041E2D0-mapping.dmp
-
memory/4080-73-0x0000000000000000-mapping.dmp
-
memory/4080-75-0x0000000000000000-mapping.dmp
-
memory/4116-193-0x0000000000000000-mapping.dmp
-
memory/4116-447-0x0000000006030000-0x000000000617C000-memory.dmpFilesize
1.3MB
-
memory/4116-200-0x00000000008F0000-0x0000000000917000-memory.dmpFilesize
156KB
-
memory/4116-197-0x00000000008F0000-0x0000000000917000-memory.dmpFilesize
156KB
-
memory/4116-295-0x0000000005FD0000-0x00000000060E7000-memory.dmpFilesize
1.1MB
-
memory/4120-403-0x0000000000000000-mapping.dmp
-
memory/4120-412-0x00000000026B0000-0x00000000026B1000-memory.dmpFilesize
4KB
-
memory/4132-339-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/4132-190-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4132-185-0x0000000000000000-mapping.dmp
-
memory/4172-361-0x0000000000000000-mapping.dmp
-
memory/4176-108-0x0000000000000000-mapping.dmp
-
memory/4176-106-0x0000000000000000-mapping.dmp
-
memory/4212-367-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4212-365-0x000000000044CF8E-mapping.dmp
-
memory/4212-363-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4224-111-0x0000000000000000-mapping.dmp
-
memory/4380-458-0x0000000000000000-mapping.dmp
-
memory/4384-323-0x0000000000000000-mapping.dmp
-
memory/4384-322-0x0000000000000000-mapping.dmp
-
memory/4388-113-0x0000000000000000-mapping.dmp
-
memory/4408-452-0x0000000000000000-mapping.dmp
-
memory/4440-672-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-579-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-618-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-611-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-607-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-631-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-632-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-636-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-640-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-641-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-583-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-416-0x0000000000000000-mapping.dmp
-
memory/4440-678-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-642-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-646-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-648-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-649-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-655-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-656-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-657-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-677-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-658-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-676-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-659-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-660-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-582-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-443-0x0000000000000000-mapping.dmp
-
memory/4440-581-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-580-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-675-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-448-0x00000000E0800000-mapping.dmp
-
memory/4440-449-0x00000000E0800000-mapping.dmp
-
memory/4440-663-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-674-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-673-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-669-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-664-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-668-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-578-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-667-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-574-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-570-0x0000000007E00000-0x0000000007E01000-memory.dmpFilesize
4KB
-
memory/4440-565-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4440-563-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4440-562-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4440-561-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4440-560-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4456-235-0x0000000002F73000-0x0000000002F74000-memory.dmpFilesize
4KB
-
memory/4456-117-0x0000000000000000-mapping.dmp
-
memory/4456-120-0x0000000000000000-mapping.dmp
-
memory/4456-241-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/4472-118-0x0000000000000000-mapping.dmp
-
memory/4492-283-0x0000000000000000-mapping.dmp
-
memory/4492-282-0x0000000000000000-mapping.dmp
-
memory/4508-345-0x000000000041E2D0-mapping.dmp
-
memory/4532-125-0x0000000000000000-mapping.dmp
-
memory/4532-132-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4532-126-0x0000000000000000-mapping.dmp
-
memory/4532-138-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/4532-151-0x00000000049F0000-0x0000000004A3D000-memory.dmpFilesize
308KB
-
memory/4532-152-0x0000000004A40000-0x0000000004A7A000-memory.dmpFilesize
232KB
-
memory/4552-226-0x0000000000000000-mapping.dmp
-
memory/4556-131-0x0000000000000000-mapping.dmp
-
memory/4556-129-0x0000000000000000-mapping.dmp
-
memory/4568-208-0x0000000000000000-mapping.dmp
-
memory/4568-205-0x0000000000000000-mapping.dmp
-
memory/4588-358-0x0000000001300000-0x000000000130C000-memory.dmpFilesize
48KB
-
memory/4588-359-0x0000000001300000-0x000000000130C000-memory.dmpFilesize
48KB
-
memory/4588-357-0x0000000000000000-mapping.dmp
-
memory/4600-454-0x0000000000000000-mapping.dmp
-
memory/4616-340-0x0000000000000000-mapping.dmp
-
memory/4624-548-0x0000000000000000-mapping.dmp
-
memory/4624-551-0x00000000000000EC-mapping.dmp
-
memory/4640-139-0x00000000004015B0-mapping.dmp
-
memory/4660-385-0x0000000000000000-mapping.dmp
-
memory/4668-332-0x000000000044CCFE-mapping.dmp
-
memory/4668-331-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4668-334-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4700-215-0x0000000000000000-mapping.dmp
-
memory/4712-144-0x0000000000000000-mapping.dmp
-
memory/4712-146-0x0000000000000000-mapping.dmp
-
memory/4724-220-0x0000000000000000-mapping.dmp
-
memory/4736-464-0x000000000044CB3E-mapping.dmp
-
memory/4736-468-0x000000000044CB3E-mapping.dmp
-
memory/4736-394-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4736-395-0x000000000044CB3E-mapping.dmp
-
memory/4736-397-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4736-398-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/4736-472-0x000000000044CB3E-mapping.dmp
-
memory/4736-465-0x000000000044CB3E-mapping.dmp
-
memory/4736-466-0x000000000044CB3E-mapping.dmp
-
memory/4736-473-0x000000000044CB3E-mapping.dmp
-
memory/4736-467-0x000000000044CB3E-mapping.dmp
-
memory/4736-469-0x000000000044CB3E-mapping.dmp
-
memory/4736-475-0x000000000044CB3E-mapping.dmp
-
memory/4736-477-0x000000000044CB3E-mapping.dmp
-
memory/4736-476-0x000000000044CB3E-mapping.dmp
-
memory/4736-474-0x000000000044CB3E-mapping.dmp
-
memory/4736-470-0x000000000044CB3E-mapping.dmp
-
memory/4736-471-0x000000000044CB3E-mapping.dmp
-
memory/4748-149-0x0000000000000000-mapping.dmp
-
memory/4796-231-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/4796-224-0x0000000000000000-mapping.dmp
-
memory/4796-227-0x0000000000000000-mapping.dmp
-
memory/4796-237-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/4796-265-0x0000000007CB0000-0x0000000007D03000-memory.dmpFilesize
332KB
-
memory/4816-374-0x0000000000000000-mapping.dmp
-
memory/4836-159-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4836-161-0x000000000041E270-mapping.dmp
-
memory/4864-249-0x0000000000000000-mapping.dmp
-
memory/4864-250-0x0000000000000000-mapping.dmp
-
memory/4888-164-0x0000000000000000-mapping.dmp
-
memory/4888-165-0x0000000000000000-mapping.dmp
-
memory/4892-310-0x0000000000000000-mapping.dmp
-
memory/4892-308-0x0000000000000000-mapping.dmp
-
memory/4940-390-0x0000000000000000-mapping.dmp
-
memory/4968-247-0x0000000000000000-mapping.dmp
-
memory/4992-184-0x0000000000170000-0x000000000018F000-memory.dmpFilesize
124KB
-
memory/4992-291-0x00000000054D0000-0x0000000005632000-memory.dmpFilesize
1.4MB
-
memory/4992-179-0x0000000000170000-0x000000000018F000-memory.dmpFilesize
124KB
-
memory/4992-175-0x0000000000000000-mapping.dmp
-
memory/5028-173-0x0000000000000000-mapping.dmp
-
memory/5032-368-0x0000000000000000-mapping.dmp
-
memory/5064-262-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/5064-251-0x000000000D960000-0x000000000DAF2000-memory.dmpFilesize
1.6MB
-
memory/5064-199-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/5064-183-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/5064-264-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/5064-191-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/5064-178-0x0000000000000000-mapping.dmp
-
memory/5064-177-0x0000000000000000-mapping.dmp
-
memory/5104-441-0x0000000000000000-mapping.dmp
-
memory/5104-444-0x0000000000C00000-0x0000000000C0B000-memory.dmpFilesize
44KB
-
memory/5104-445-0x0000000000C00000-0x0000000000C0B000-memory.dmpFilesize
44KB
-
memory/5108-271-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/5108-305-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/5108-296-0x00000000052D0000-0x000000000532D000-memory.dmpFilesize
372KB
-
memory/5108-313-0x0000000008B60000-0x0000000008BB1000-memory.dmpFilesize
324KB
-
memory/5108-272-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/5108-267-0x0000000000000000-mapping.dmp
-
memory/5108-268-0x0000000000000000-mapping.dmp
-
memory/5116-355-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/5116-297-0x0000000000000000-mapping.dmp
-
memory/5116-300-0x0000000000000000-mapping.dmp
-
memory/5148-459-0x0000000000000000-mapping.dmp
-
memory/5184-497-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/5184-498-0x00000000729A0000-0x000000007308E000-memory.dmpFilesize
6.9MB
-
memory/5184-495-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/5184-496-0x0000000000445D5E-mapping.dmp
-
memory/5224-462-0x0000000000000000-mapping.dmp
-
memory/5224-460-0x0000000000000000-mapping.dmp
-
memory/5236-556-0x0000000000000000-mapping.dmp
-
memory/5236-559-0x00000000000000E0-mapping.dmp
-
memory/5256-687-0x00000000000000E0-mapping.dmp
-
memory/5256-684-0x0000000000000000-mapping.dmp
-
memory/5280-683-0x00000000000000E0-mapping.dmp
-
memory/5280-679-0x0000000000000000-mapping.dmp
-
memory/5292-499-0x0000000000000000-mapping.dmp
-
memory/5424-478-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/5424-463-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/5524-506-0x0000000000000000-mapping.dmp
-
memory/5680-516-0x0000000000000000-mapping.dmp
-
memory/5740-681-0x000001FA632D9000-0x000001FA632DC000-memory.dmpFilesize
12KB
-
memory/5780-524-0x0000000000000000-mapping.dmp
-
memory/5800-487-0x0000000000000000-mapping.dmp
-
memory/5872-488-0x0000000000000000-mapping.dmp
-
memory/5888-544-0x0000000000000000-mapping.dmp
-
memory/5888-547-0x00000000000000E0-mapping.dmp
-
memory/5912-521-0x000001DFF3ED0000-0x000001DFF3ED4000-memory.dmpFilesize
16KB
-
memory/5912-514-0x000001DFF3ED0000-0x000001DFF3ED4000-memory.dmpFilesize
16KB
-
memory/5940-665-0x0000000000000000-mapping.dmp
-
memory/5940-671-0x00000000000000E0-mapping.dmp
-
memory/5944-525-0x0000000000000000-mapping.dmp
-
memory/5980-489-0x0000000000000000-mapping.dmp
-
memory/6024-490-0x0000000000000000-mapping.dmp
-
memory/6024-494-0x00000000000000E0-mapping.dmp
-
memory/6048-652-0x0000025307613000-0x0000025307618000-memory.dmpFilesize
20KB
-
memory/6080-577-0x00000000000000E0-mapping.dmp
-
memory/6080-571-0x0000000000000000-mapping.dmp
-
memory/6112-588-0x0000000000000000-mapping.dmp
-
memory/6112-594-0x00000000000000E0-mapping.dmp
-
memory/6136-492-0x0000000000000000-mapping.dmp
