Analysis
-
max time kernel
72s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe
Resource
win7-20220414-en
General
-
Target
e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe
-
Size
9.1MB
-
MD5
93e23e5bed552c0500856641d19729a8
-
SHA1
7e14cdf808dcd21d766a4054935c87c89c037445
-
SHA256
e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555
-
SHA512
3996d6144bd7dab401df7f95d4623ba91502619446d7c877c2ecb601f23433c9447168e959a90458e0fae3d9d39a03c25642f611dbc3114917cad48aca2594ff
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.znsjis.top/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1664-208-0x0000000003960000-0x000000000427E000-memory.dmp family_glupteba behavioral2/memory/1664-211-0x0000000000400000-0x0000000002FBF000-memory.dmp family_glupteba behavioral2/memory/3332-245-0x0000000000400000-0x0000000002FBF000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 2296 rUNdlL32.eXe -
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 1324 created 1664 1324 svchost.exe Graphics.exe -
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
md9_1sjm.exeFoxSBrowser.exeFolder.exeGraphics.exeUpdbdate.exeInstall.exeFolder.exeFile.exepub2.exeFiles.exeDetails.exeGraphics.exepid process 1604 md9_1sjm.exe 3048 FoxSBrowser.exe 3652 Folder.exe 1664 Graphics.exe 2280 Updbdate.exe 4788 Install.exe 2948 Folder.exe 3116 File.exe 532 pub2.exe 1196 Files.exe 1888 Details.exe 3332 Graphics.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exeFolder.exeFile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Folder.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation File.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 216 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
Processes:
Install.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json Install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 ip-api.com 86 ipinfo.io 87 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in System32 directory 6 IoCs
Processes:
Graphics.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft Graphics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache Graphics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData Graphics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Graphics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content Graphics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Graphics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2416 216 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
pub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 65 Go-http-client/1.1 -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3516 taskkill.exe -
Modifies data under HKEY_USERS 40 IoCs
Processes:
Graphics.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Graphics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Graphics.exe -
Processes:
Graphics.exeInstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Graphics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d601030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Graphics.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c137e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Graphics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Install.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53 Install.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02405c0000000100000004000000800100001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb Install.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pub2.exepid process 532 pub2.exe 532 pub2.exe 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 3140 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
pub2.exepid process 532 pub2.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
Install.exeFoxSBrowser.exeGraphics.exesvchost.exetaskkill.exemd9_1sjm.exeGraphics.exedescription pid process Token: SeCreateTokenPrivilege 4788 Install.exe Token: SeAssignPrimaryTokenPrivilege 4788 Install.exe Token: SeLockMemoryPrivilege 4788 Install.exe Token: SeIncreaseQuotaPrivilege 4788 Install.exe Token: SeMachineAccountPrivilege 4788 Install.exe Token: SeTcbPrivilege 4788 Install.exe Token: SeSecurityPrivilege 4788 Install.exe Token: SeTakeOwnershipPrivilege 4788 Install.exe Token: SeLoadDriverPrivilege 4788 Install.exe Token: SeSystemProfilePrivilege 4788 Install.exe Token: SeSystemtimePrivilege 4788 Install.exe Token: SeProfSingleProcessPrivilege 4788 Install.exe Token: SeIncBasePriorityPrivilege 4788 Install.exe Token: SeCreatePagefilePrivilege 4788 Install.exe Token: SeCreatePermanentPrivilege 4788 Install.exe Token: SeBackupPrivilege 4788 Install.exe Token: SeRestorePrivilege 4788 Install.exe Token: SeShutdownPrivilege 4788 Install.exe Token: SeDebugPrivilege 4788 Install.exe Token: SeAuditPrivilege 4788 Install.exe Token: SeSystemEnvironmentPrivilege 4788 Install.exe Token: SeChangeNotifyPrivilege 4788 Install.exe Token: SeRemoteShutdownPrivilege 4788 Install.exe Token: SeUndockPrivilege 4788 Install.exe Token: SeSyncAgentPrivilege 4788 Install.exe Token: SeEnableDelegationPrivilege 4788 Install.exe Token: SeManageVolumePrivilege 4788 Install.exe Token: SeImpersonatePrivilege 4788 Install.exe Token: SeCreateGlobalPrivilege 4788 Install.exe Token: 31 4788 Install.exe Token: 32 4788 Install.exe Token: 33 4788 Install.exe Token: 34 4788 Install.exe Token: 35 4788 Install.exe Token: SeDebugPrivilege 3048 FoxSBrowser.exe Token: SeShutdownPrivilege 3140 Token: SeCreatePagefilePrivilege 3140 Token: SeShutdownPrivilege 3140 Token: SeCreatePagefilePrivilege 3140 Token: SeDebugPrivilege 1664 Graphics.exe Token: SeImpersonatePrivilege 1664 Graphics.exe Token: SeTcbPrivilege 1324 svchost.exe Token: SeTcbPrivilege 1324 svchost.exe Token: SeDebugPrivilege 3516 taskkill.exe Token: SeManageVolumePrivilege 1604 md9_1sjm.exe Token: SeShutdownPrivilege 3140 Token: SeCreatePagefilePrivilege 3140 Token: SeShutdownPrivilege 3140 Token: SeCreatePagefilePrivilege 3140 Token: SeSystemEnvironmentPrivilege 3332 Graphics.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exeFolder.exerUNdlL32.eXeInstall.execmd.exesvchost.exeGraphics.execmd.exedescription pid process target process PID 1872 wrote to memory of 1604 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe md9_1sjm.exe PID 1872 wrote to memory of 1604 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe md9_1sjm.exe PID 1872 wrote to memory of 1604 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe md9_1sjm.exe PID 1872 wrote to memory of 3048 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe FoxSBrowser.exe PID 1872 wrote to memory of 3048 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe FoxSBrowser.exe PID 1872 wrote to memory of 3652 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Folder.exe PID 1872 wrote to memory of 3652 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Folder.exe PID 1872 wrote to memory of 3652 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Folder.exe PID 1872 wrote to memory of 1664 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Graphics.exe PID 1872 wrote to memory of 1664 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Graphics.exe PID 1872 wrote to memory of 1664 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Graphics.exe PID 1872 wrote to memory of 2280 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Updbdate.exe PID 1872 wrote to memory of 2280 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Updbdate.exe PID 1872 wrote to memory of 2280 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Updbdate.exe PID 1872 wrote to memory of 4788 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Install.exe PID 1872 wrote to memory of 4788 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Install.exe PID 1872 wrote to memory of 4788 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Install.exe PID 1872 wrote to memory of 3116 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe File.exe PID 1872 wrote to memory of 3116 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe File.exe PID 1872 wrote to memory of 3116 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe File.exe PID 3652 wrote to memory of 2948 3652 Folder.exe Folder.exe PID 3652 wrote to memory of 2948 3652 Folder.exe Folder.exe PID 3652 wrote to memory of 2948 3652 Folder.exe Folder.exe PID 1872 wrote to memory of 532 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe pub2.exe PID 1872 wrote to memory of 532 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe pub2.exe PID 1872 wrote to memory of 532 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe pub2.exe PID 1872 wrote to memory of 1196 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Files.exe PID 1872 wrote to memory of 1196 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Files.exe PID 1872 wrote to memory of 1888 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Details.exe PID 1872 wrote to memory of 1888 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Details.exe PID 1872 wrote to memory of 1888 1872 e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe Details.exe PID 5060 wrote to memory of 216 5060 rUNdlL32.eXe rundll32.exe PID 5060 wrote to memory of 216 5060 rUNdlL32.eXe rundll32.exe PID 5060 wrote to memory of 216 5060 rUNdlL32.eXe rundll32.exe PID 4788 wrote to memory of 816 4788 Install.exe cmd.exe PID 4788 wrote to memory of 816 4788 Install.exe cmd.exe PID 4788 wrote to memory of 816 4788 Install.exe cmd.exe PID 816 wrote to memory of 3516 816 cmd.exe taskkill.exe PID 816 wrote to memory of 3516 816 cmd.exe taskkill.exe PID 816 wrote to memory of 3516 816 cmd.exe taskkill.exe PID 1324 wrote to memory of 3332 1324 svchost.exe Graphics.exe PID 1324 wrote to memory of 3332 1324 svchost.exe Graphics.exe PID 1324 wrote to memory of 3332 1324 svchost.exe Graphics.exe PID 4788 wrote to memory of 928 4788 Install.exe xcopy.exe PID 4788 wrote to memory of 928 4788 Install.exe xcopy.exe PID 4788 wrote to memory of 928 4788 Install.exe xcopy.exe PID 3332 wrote to memory of 1620 3332 Graphics.exe cmd.exe PID 3332 wrote to memory of 1620 3332 Graphics.exe cmd.exe PID 1620 wrote to memory of 2600 1620 cmd.exe netsh.exe PID 1620 wrote to memory of 2600 1620 cmd.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe"C:\Users\Admin\AppData\Local\Temp\e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe"C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exe"C:\Users\Admin\AppData\Local\Temp\Graphics.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exe"C:\Users\Admin\AppData\Local\Temp\Graphics.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /202-2024⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Drops Chrome extension
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y3⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\rrmix.exe.exe"C:\Users\Admin\Pictures\Adobe Films\rrmix.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\Offscum.exe.exe"C:\Users\Admin\Pictures\Adobe Films\Offscum.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\SetupMEXX.exe.exe"C:\Users\Admin\Pictures\Adobe Films\SetupMEXX.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\Service.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\Service.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\file2.exe.exe"C:\Users\Admin\Pictures\Adobe Films\file2.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\fxdd.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\fxdd.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\olympteam_build_crypted_2.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\olympteam_build_crypted_2.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\pen4ik_v0.7b__windows_64.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\pen4ik_v0.7b__windows_64.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\FJEfRXZ.exe.exe"C:\Users\Admin\Pictures\Adobe Films\FJEfRXZ.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\test33.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\test33.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\Fenix_6.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\Fenix_6.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\real1801.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\real1801.bmp.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\6523.exe.exe"C:\Users\Admin\Pictures\Adobe Films\6523.exe.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\file1.exe.exe"C:\Users\Admin\Pictures\Adobe Films\file1.exe.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Details.exe"C:\Users\Admin\AppData\Local\Temp\Details.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 216 -ip 2161⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD554e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5fcd0997e80cc66f0e7ef08cdc11e2b76
SHA19c5d8710a02beeee15fc65ee6fb1ce8f51b33214
SHA256f395085adc7cdf49e7b27cc254a2da59c98fcd848e3c21dad8e241e87a8e12f3
SHA5123b1c8561be9d3a30b3426a62961e0eacf00d301adc2d1518524202897793dd162b2b46ca6d905740247f1b0f1c2c7caac3a69d53c58cf598c177c6369b3ea70d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
31KB
MD59293625eada67902da47fbf28c0091e8
SHA178dad17ace9ea7775d287be2a000adab2318590c
SHA2568d92dfd0e456806d8bc92766403284f80a2ab995b252683dfa8c6f8af76ceab6
SHA5121b99d35acdf9f494a2a49b1659009ecc47728925419ee2ec8a959e4eaa3abd38cf76e47891534609569b6cc3d6769ad19fcb0788a4164aabedeb2e73eff47353
-
C:\Users\Admin\AppData\Local\Temp\Details.exeFilesize
224KB
MD5913fcca8aa37351d548fcb1ef3af9f10
SHA18955832408079abc33723d48135f792c9930b598
SHA2562f59e661904f9a4c62123f024eb7968cdc234f826bab077914ad8896ebf001c9
SHA5120283e875dfbc7b04eb5ce5a82e66fb99e945626ed7e2ed4f2bc90e54e4ef99c065e2f98464f0aec24c921bae020ff3a6f1b3a01bfd8bdcea8459113670519c2b
-
C:\Users\Admin\AppData\Local\Temp\Details.exeFilesize
224KB
MD5913fcca8aa37351d548fcb1ef3af9f10
SHA18955832408079abc33723d48135f792c9930b598
SHA2562f59e661904f9a4c62123f024eb7968cdc234f826bab077914ad8896ebf001c9
SHA5120283e875dfbc7b04eb5ce5a82e66fb99e945626ed7e2ed4f2bc90e54e4ef99c065e2f98464f0aec24c921bae020ff3a6f1b3a01bfd8bdcea8459113670519c2b
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
426KB
MD5ece476206e52016ed4e0553d05b05160
SHA1baa0dc4ed3e9d63384961ad9a1e7b43e8681a3c5
SHA256ebc2784e2648e4ff72f48a6251ff28eee69003c8bd4ab604f5b43553a4140f4b
SHA5122b51d406c684a21ad4d53d8f6c18cbc774cf4eacae94f48868e7ac64db1878792840fc3eea9bb27f47849b85382604492400e60b0f9536cf93ca78d7be7c3b3a
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
426KB
MD5ece476206e52016ed4e0553d05b05160
SHA1baa0dc4ed3e9d63384961ad9a1e7b43e8681a3c5
SHA256ebc2784e2648e4ff72f48a6251ff28eee69003c8bd4ab604f5b43553a4140f4b
SHA5122b51d406c684a21ad4d53d8f6c18cbc774cf4eacae94f48868e7ac64db1878792840fc3eea9bb27f47849b85382604492400e60b0f9536cf93ca78d7be7c3b3a
-
C:\Users\Admin\AppData\Local\Temp\Files.exeFilesize
1.3MB
MD537db6db82813ddc8eeb42c58553da2de
SHA19425c1937873bb86beb57021ed5e315f516a2bed
SHA25665302460bbdccb8268bc6c23434bcd7d710d0e800fe11d87a1597fdedfc2a9c7
SHA5120658f3b15a4084ae292a6c0640f4e88fe095a2b2471633ca97c78998ee664631156e9cea1bee3d5ac5428ca600c52495437468770fbda6143e11651e797298c9
-
C:\Users\Admin\AppData\Local\Temp\Files.exeFilesize
1.3MB
MD537db6db82813ddc8eeb42c58553da2de
SHA19425c1937873bb86beb57021ed5e315f516a2bed
SHA25665302460bbdccb8268bc6c23434bcd7d710d0e800fe11d87a1597fdedfc2a9c7
SHA5120658f3b15a4084ae292a6c0640f4e88fe095a2b2471633ca97c78998ee664631156e9cea1bee3d5ac5428ca600c52495437468770fbda6143e11651e797298c9
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeFilesize
712KB
MD5b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeFilesize
712KB
MD5b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeFilesize
712KB
MD5b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exeFilesize
153KB
MD5849b899acdc4478c116340b86683a493
SHA1e43f78a9b9b884e4230d009fafceb46711125534
SHA2565f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631
SHA512bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c
-
C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exeFilesize
153KB
MD5849b899acdc4478c116340b86683a493
SHA1e43f78a9b9b884e4230d009fafceb46711125534
SHA2565f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631
SHA512bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeFilesize
4.5MB
MD57c20b40b1abca9c0c50111529f4a06fa
SHA15a367dbc0473e6f9f412fe52d219525a5ff0d8d2
SHA2565caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36
SHA512f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeFilesize
4.5MB
MD57c20b40b1abca9c0c50111529f4a06fa
SHA15a367dbc0473e6f9f412fe52d219525a5ff0d8d2
SHA2565caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36
SHA512f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeFilesize
4.5MB
MD57c20b40b1abca9c0c50111529f4a06fa
SHA15a367dbc0473e6f9f412fe52d219525a5ff0d8d2
SHA2565caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36
SHA512f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473
-
C:\Users\Admin\AppData\Local\Temp\Install.exeFilesize
1.4MB
MD5deeb8730435a83cb41ca5679429cb235
SHA1c4eb99a6c3310e9b36c31b9572d57a210985b67d
SHA256002f4696f089281a8c82f3156063cee84249d1715055e721a47618f2efecf150
SHA5124235fa18fcc183ef02a1832790af466f7fdeda69435ebc561cb11209e049e890917b2c72be38fa8e1039493ae20fdbbe93776895b27a021d498f81d3e00c7379
-
C:\Users\Admin\AppData\Local\Temp\Install.exeFilesize
1.4MB
MD5deeb8730435a83cb41ca5679429cb235
SHA1c4eb99a6c3310e9b36c31b9572d57a210985b67d
SHA256002f4696f089281a8c82f3156063cee84249d1715055e721a47618f2efecf150
SHA5124235fa18fcc183ef02a1832790af466f7fdeda69435ebc561cb11209e049e890917b2c72be38fa8e1039493ae20fdbbe93776895b27a021d498f81d3e00c7379
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeFilesize
359KB
MD53d09b651baa310515bb5df3c04506961
SHA1e1e1cff9e8a5d4093dbdabb0b83c886601141575
SHA2562599fed90469c6c2250883f90d1c9d20fe41755b9da670a306a884797dbd7df6
SHA5128f8499c73297be7c1743361dfcb352a3ce93aca4e81c0355f1814f9eedf92d22b40104d32eb4dbd776ccc9051613eee9b8ff57178c6240a787815e0dc8dc6889
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeFilesize
359KB
MD53d09b651baa310515bb5df3c04506961
SHA1e1e1cff9e8a5d4093dbdabb0b83c886601141575
SHA2562599fed90469c6c2250883f90d1c9d20fe41755b9da670a306a884797dbd7df6
SHA5128f8499c73297be7c1743361dfcb352a3ce93aca4e81c0355f1814f9eedf92d22b40104d32eb4dbd776ccc9051613eee9b8ff57178c6240a787815e0dc8dc6889
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD55fd2eba6df44d23c9e662763009d7f84
SHA143530574f8ac455ae263c70cc99550bc60bfa4f1
SHA2562991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f
SHA512321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeFilesize
2.1MB
MD53b3d48102a0d45a941f98d8aabe2dc43
SHA10dae4fd9d74f24452b2544e0f166bf7db2365240
SHA256f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0
SHA51265ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeFilesize
2.1MB
MD53b3d48102a0d45a941f98d8aabe2dc43
SHA10dae4fd9d74f24452b2544e0f166bf7db2365240
SHA256f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0
SHA51265ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeFilesize
285KB
MD5f9d940ab072678a0226ea5e6bd98ebfa
SHA1853c784c330cbf88ab4f5f21d23fa259027c2079
SHA2560be77f05a9c4d30f2ec4f5636179f0e2f85e3f5441f5854a0872de4f63aceffd
SHA5126766488893d9975ce44e1cdba427f0e65adba47dec26f6d16708be4efeb7f431da9a76647e8ec2ecd00bfb8d5d7e37c5a168b9de3cca45cc8c9b144bc650a1ef
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeFilesize
285KB
MD5f9d940ab072678a0226ea5e6bd98ebfa
SHA1853c784c330cbf88ab4f5f21d23fa259027c2079
SHA2560be77f05a9c4d30f2ec4f5636179f0e2f85e3f5441f5854a0872de4f63aceffd
SHA5126766488893d9975ce44e1cdba427f0e65adba47dec26f6d16708be4efeb7f431da9a76647e8ec2ecd00bfb8d5d7e37c5a168b9de3cca45cc8c9b144bc650a1ef
-
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exeFilesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exeFilesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\Offscum.exe.exeFilesize
384KB
MD543e800701f22f016821dac724aafc5db
SHA186a33ba8fb36657178ff13ebfa7ce3a0b9c0eca0
SHA256d3cb46076b5c81e8b4478ac44dee8508656ef8a1844b8c0601c7bcee34b76a5f
SHA512344f78bfc56e533465631c486298dc6318fec14ce89362e463e6530511c75374814abc998b3fecdd86daabb6179d3abd489fe033cea38a157680c0ae79069368
-
C:\Users\Admin\Pictures\Adobe Films\Offscum.exe.exeFilesize
384KB
MD543e800701f22f016821dac724aafc5db
SHA186a33ba8fb36657178ff13ebfa7ce3a0b9c0eca0
SHA256d3cb46076b5c81e8b4478ac44dee8508656ef8a1844b8c0601c7bcee34b76a5f
SHA512344f78bfc56e533465631c486298dc6318fec14ce89362e463e6530511c75374814abc998b3fecdd86daabb6179d3abd489fe033cea38a157680c0ae79069368
-
C:\Users\Admin\Pictures\Adobe Films\rrmix.exe.exeFilesize
393KB
MD5dd2d48c4f9266f9d8e466910fccf104e
SHA1498469726fc4f7bedcaa04bc5d401992a5e14838
SHA2566a1628771731ecb4307adde305886c618a47856c201cb109ebcec05909c6a8fe
SHA5126afaf922c299343cde5cca89b2e68117d941ddb9c3a157c8610d0a8bb1666e4f9ed196373efbc266c0db1abaa0d386d7fe14531ce3aed0104f3b2c7b613c079e
-
C:\Windows\rss\csrss.exeFilesize
4.5MB
MD57c20b40b1abca9c0c50111529f4a06fa
SHA15a367dbc0473e6f9f412fe52d219525a5ff0d8d2
SHA2565caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36
SHA512f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473
-
C:\Windows\rss\csrss.exeFilesize
4.5MB
MD57c20b40b1abca9c0c50111529f4a06fa
SHA15a367dbc0473e6f9f412fe52d219525a5ff0d8d2
SHA2565caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36
SHA512f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473
-
memory/116-267-0x0000000000000000-mapping.dmp
-
memory/208-266-0x0000000000000000-mapping.dmp
-
memory/216-166-0x0000000000000000-mapping.dmp
-
memory/532-172-0x0000000002D67000-0x0000000002D77000-memory.dmpFilesize
64KB
-
memory/532-173-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/532-174-0x0000000000400000-0x0000000002B8F000-memory.dmpFilesize
39.6MB
-
memory/532-154-0x0000000000000000-mapping.dmp
-
memory/816-191-0x0000000000000000-mapping.dmp
-
memory/928-219-0x0000000000000000-mapping.dmp
-
memory/988-246-0x0000000000000000-mapping.dmp
-
memory/1196-157-0x0000000000000000-mapping.dmp
-
memory/1604-221-0x0000000004C40000-0x0000000004C48000-memory.dmpFilesize
32KB
-
memory/1604-217-0x00000000055E0000-0x00000000055E8000-memory.dmpFilesize
32KB
-
memory/1604-228-0x0000000000790000-0x0000000000798000-memory.dmpFilesize
32KB
-
memory/1604-226-0x0000000004D70000-0x0000000004D78000-memory.dmpFilesize
32KB
-
memory/1604-223-0x00000000048E0000-0x00000000048E8000-memory.dmpFilesize
32KB
-
memory/1604-222-0x0000000004D70000-0x0000000004D78000-memory.dmpFilesize
32KB
-
memory/1604-130-0x0000000000000000-mapping.dmp
-
memory/1604-220-0x00000000048E0000-0x00000000048E8000-memory.dmpFilesize
32KB
-
memory/1604-218-0x0000000004C40000-0x0000000004C48000-memory.dmpFilesize
32KB
-
memory/1604-216-0x0000000005370000-0x0000000005378000-memory.dmpFilesize
32KB
-
memory/1604-215-0x0000000004ED0000-0x0000000004ED8000-memory.dmpFilesize
32KB
-
memory/1604-214-0x0000000004AF0000-0x0000000004AF8000-memory.dmpFilesize
32KB
-
memory/1604-213-0x0000000004AD0000-0x0000000004AD8000-memory.dmpFilesize
32KB
-
memory/1604-212-0x0000000004AD0000-0x0000000004AD8000-memory.dmpFilesize
32KB
-
memory/1604-210-0x00000000048E0000-0x00000000048E8000-memory.dmpFilesize
32KB
-
memory/1604-209-0x00000000048C0000-0x00000000048C8000-memory.dmpFilesize
32KB
-
memory/1604-192-0x0000000003C90000-0x0000000003CA0000-memory.dmpFilesize
64KB
-
memory/1604-198-0x0000000003DF0000-0x0000000003E00000-memory.dmpFilesize
64KB
-
memory/1620-224-0x0000000000000000-mapping.dmp
-
memory/1664-211-0x0000000000400000-0x0000000002FBF000-memory.dmpFilesize
43.7MB
-
memory/1664-138-0x0000000000000000-mapping.dmp
-
memory/1664-207-0x0000000003519000-0x0000000003954000-memory.dmpFilesize
4.2MB
-
memory/1664-208-0x0000000003960000-0x000000000427E000-memory.dmpFilesize
9.1MB
-
memory/1888-160-0x0000000000000000-mapping.dmp
-
memory/2280-161-0x0000000007210000-0x00000000077B4000-memory.dmpFilesize
5.6MB
-
memory/2280-142-0x0000000000000000-mapping.dmp
-
memory/2280-165-0x00000000077C0000-0x0000000007DD8000-memory.dmpFilesize
6.1MB
-
memory/2280-168-0x0000000007DE0000-0x0000000007EEA000-memory.dmpFilesize
1.0MB
-
memory/2280-171-0x0000000007EF0000-0x0000000007F2C000-memory.dmpFilesize
240KB
-
memory/2280-167-0x00000000071C0000-0x00000000071D2000-memory.dmpFilesize
72KB
-
memory/2520-261-0x0000000000000000-mapping.dmp
-
memory/2600-225-0x0000000000000000-mapping.dmp
-
memory/2948-149-0x0000000000000000-mapping.dmp
-
memory/3048-141-0x0000000000040000-0x000000000006E000-memory.dmpFilesize
184KB
-
memory/3048-133-0x0000000000000000-mapping.dmp
-
memory/3116-151-0x0000000000000000-mapping.dmp
-
memory/3140-185-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-180-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-181-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-182-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-179-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-183-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-178-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-268-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-184-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-176-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-177-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-186-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-190-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-175-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-187-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-188-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3140-189-0x0000000007850000-0x0000000007860000-memory.dmpFilesize
64KB
-
memory/3332-205-0x0000000000000000-mapping.dmp
-
memory/3332-245-0x0000000000400000-0x0000000002FBF000-memory.dmpFilesize
43.7MB
-
memory/3332-244-0x00000000034DB000-0x0000000003916000-memory.dmpFilesize
4.2MB
-
memory/3516-204-0x0000000000000000-mapping.dmp
-
memory/3652-136-0x0000000000000000-mapping.dmp
-
memory/4656-241-0x0000000000000000-mapping.dmp
-
memory/4788-145-0x0000000000000000-mapping.dmp
-
memory/4796-269-0x0000000000000000-mapping.dmp
-
memory/4812-273-0x0000000000000000-mapping.dmp
-
memory/5104-270-0x0000000000000000-mapping.dmp