Resubmissions
18-11-2022 14:52
221118-r85mhshf55 108-11-2022 14:30
221108-rvcpkscaa3 807-11-2022 15:52
221107-tbh4csefh4 807-11-2022 10:35
221107-mm5m6secgn 106-11-2022 13:08
221106-qdjk5aehgj 905-11-2022 20:23
221105-y589vsbhcj 805-11-2022 16:11
221105-tm8s6aaggj 1005-11-2022 07:34
221105-jd7jmaggal 804-11-2022 20:40
221104-zgabascfgq 8Analysis
-
max time kernel
255s -
max time network
1600s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2022 16:11
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
blacknet
v3.6.0 Public
Bot
http://f0483357.xsph.ru/
BN[PHfunXGI-6235724]
-
antivm
true
-
elevate_uac
false
-
install_name
jusched.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
true
Extracted
darkcomet
Guest16
gameservice.ddns.net:4320
DC_MUTEX-WBUNVXD
-
InstallPath
AudioDriver\taskhost.exe
-
gencode
EWSsWwgyJrUD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
AudioDriver
Signatures
-
BlackNET payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe family_blacknet C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe family_blacknet C:\Users\Admin\Desktop\WinlockerBuilderv5.exe family_blacknet C:\Users\Admin\Desktop\WinlockerBuilderv5.exe family_blacknet -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
upx_compresser.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe" upx_compresser.exe -
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
Processes:
svshost.exejusched.exeWinlockerBuilderv5.exeupx_compresser.exeupx_compresser.exetaskhost.exetaskhost.exesvshost.exeWinlockerBuilderv5.exeupx_compresser.exeupx_compresser.exesvchosts.exesvchosts.exesvchosts.exesvchosts.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exepid process 3516 svshost.exe 3628 jusched.exe 2196 WinlockerBuilderv5.exe 4912 upx_compresser.exe 4360 upx_compresser.exe 4544 taskhost.exe 2980 taskhost.exe 444 svshost.exe 1568 WinlockerBuilderv5.exe 2224 upx_compresser.exe 4792 upx_compresser.exe 3676 svchosts.exe 4092 svchosts.exe 5032 svchosts.exe 3296 svchosts.exe 4500 WinlockerBuilderv5.exe 3044 WinlockerBuilderv5.exe 972 WinlockerBuilderv5.exe 1796 WinlockerBuilderv5.exe 4980 WinlockerBuilderv5.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx behavioral1/memory/2196-153-0x0000000000400000-0x0000000000C89000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe upx behavioral1/memory/1568-171-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/2196-175-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/1568-178-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/1568-179-0x0000000000400000-0x0000000000C89000-memory.dmp upx behavioral1/memory/2196-183-0x0000000000400000-0x0000000000C89000-memory.dmp upx -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svshost.exeupx_compresser.exejusched.exesvshost.exesvchosts.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation svshost.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation upx_compresser.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation jusched.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation svshost.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation svchosts.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
jusched.exeWinlockerBuilderv5.exeupx_compresser.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe" jusched.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\Desktop\\WinlockerBuilderv5.exe" WinlockerBuilderv5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe" WinlockerBuilderv5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe" upx_compresser.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
upx_compresser.exetaskhost.exeupx_compresser.exedescription pid process target process PID 4912 set thread context of 4360 4912 upx_compresser.exe upx_compresser.exe PID 4544 set thread context of 2980 4544 taskhost.exe taskhost.exe PID 2224 set thread context of 4792 2224 upx_compresser.exe upx_compresser.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
upx_compresser.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ upx_compresser.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exechrome.exeWinlockerBuilderv5.exeupx_compresser.exejusched.exepid process 4864 chrome.exe 4864 chrome.exe 2608 chrome.exe 2608 chrome.exe 3476 chrome.exe 3476 chrome.exe 2540 chrome.exe 2540 chrome.exe 4944 chrome.exe 4944 chrome.exe 4288 chrome.exe 4288 chrome.exe 1856 chrome.exe 1856 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe 2576 chrome.exe 2576 chrome.exe 3588 chrome.exe 3588 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 3008 chrome.exe 3008 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 4912 upx_compresser.exe 4912 upx_compresser.exe 3628 jusched.exe 3628 jusched.exe 3628 jusched.exe 3628 jusched.exe 3628 jusched.exe 3628 jusched.exe 3628 jusched.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
upx_compresser.exetaskhost.exeupx_compresser.exepid process 4912 upx_compresser.exe 4544 taskhost.exe 2224 upx_compresser.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskmgr.exeWinlockerBuilderv5.exeupx_compresser.exejusched.exetaskhost.exeupx_compresser.exedescription pid process Token: SeDebugPrivilege 4604 taskmgr.exe Token: SeSystemProfilePrivilege 4604 taskmgr.exe Token: SeCreateGlobalPrivilege 4604 taskmgr.exe Token: 33 4604 taskmgr.exe Token: SeIncBasePriorityPrivilege 4604 taskmgr.exe Token: SeDebugPrivilege 32 WinlockerBuilderv5.exe Token: SeIncreaseQuotaPrivilege 4360 upx_compresser.exe Token: SeSecurityPrivilege 4360 upx_compresser.exe Token: SeTakeOwnershipPrivilege 4360 upx_compresser.exe Token: SeLoadDriverPrivilege 4360 upx_compresser.exe Token: SeSystemProfilePrivilege 4360 upx_compresser.exe Token: SeSystemtimePrivilege 4360 upx_compresser.exe Token: SeProfSingleProcessPrivilege 4360 upx_compresser.exe Token: SeIncBasePriorityPrivilege 4360 upx_compresser.exe Token: SeCreatePagefilePrivilege 4360 upx_compresser.exe Token: SeBackupPrivilege 4360 upx_compresser.exe Token: SeRestorePrivilege 4360 upx_compresser.exe Token: SeShutdownPrivilege 4360 upx_compresser.exe Token: SeDebugPrivilege 4360 upx_compresser.exe Token: SeSystemEnvironmentPrivilege 4360 upx_compresser.exe Token: SeChangeNotifyPrivilege 4360 upx_compresser.exe Token: SeRemoteShutdownPrivilege 4360 upx_compresser.exe Token: SeUndockPrivilege 4360 upx_compresser.exe Token: SeManageVolumePrivilege 4360 upx_compresser.exe Token: SeImpersonatePrivilege 4360 upx_compresser.exe Token: SeCreateGlobalPrivilege 4360 upx_compresser.exe Token: 33 4360 upx_compresser.exe Token: 34 4360 upx_compresser.exe Token: 35 4360 upx_compresser.exe Token: 36 4360 upx_compresser.exe Token: SeDebugPrivilege 3628 jusched.exe Token: SeIncreaseQuotaPrivilege 2980 taskhost.exe Token: SeSecurityPrivilege 2980 taskhost.exe Token: SeTakeOwnershipPrivilege 2980 taskhost.exe Token: SeLoadDriverPrivilege 2980 taskhost.exe Token: SeSystemProfilePrivilege 2980 taskhost.exe Token: SeSystemtimePrivilege 2980 taskhost.exe Token: SeProfSingleProcessPrivilege 2980 taskhost.exe Token: SeIncBasePriorityPrivilege 2980 taskhost.exe Token: SeCreatePagefilePrivilege 2980 taskhost.exe Token: SeBackupPrivilege 2980 taskhost.exe Token: SeRestorePrivilege 2980 taskhost.exe Token: SeShutdownPrivilege 2980 taskhost.exe Token: SeDebugPrivilege 2980 taskhost.exe Token: SeSystemEnvironmentPrivilege 2980 taskhost.exe Token: SeChangeNotifyPrivilege 2980 taskhost.exe Token: SeRemoteShutdownPrivilege 2980 taskhost.exe Token: SeUndockPrivilege 2980 taskhost.exe Token: SeManageVolumePrivilege 2980 taskhost.exe Token: SeImpersonatePrivilege 2980 taskhost.exe Token: SeCreateGlobalPrivilege 2980 taskhost.exe Token: 33 2980 taskhost.exe Token: 34 2980 taskhost.exe Token: 35 2980 taskhost.exe Token: 36 2980 taskhost.exe Token: SeIncreaseQuotaPrivilege 4792 upx_compresser.exe Token: SeSecurityPrivilege 4792 upx_compresser.exe Token: SeTakeOwnershipPrivilege 4792 upx_compresser.exe Token: SeLoadDriverPrivilege 4792 upx_compresser.exe Token: SeSystemProfilePrivilege 4792 upx_compresser.exe Token: SeSystemtimePrivilege 4792 upx_compresser.exe Token: SeProfSingleProcessPrivilege 4792 upx_compresser.exe Token: SeIncBasePriorityPrivilege 4792 upx_compresser.exe Token: SeCreatePagefilePrivilege 4792 upx_compresser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 2608 chrome.exe 4604 taskmgr.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exetaskmgr.exepid process 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 2608 chrome.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 4604 taskmgr.exe 2524 taskmgr.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
WinlockerBuilderv5.exejusched.exeWinlockerBuilderv5.exetaskhost.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exepid process 32 WinlockerBuilderv5.exe 32 WinlockerBuilderv5.exe 3628 jusched.exe 3628 jusched.exe 2196 WinlockerBuilderv5.exe 2980 taskhost.exe 1568 WinlockerBuilderv5.exe 4500 WinlockerBuilderv5.exe 4500 WinlockerBuilderv5.exe 3044 WinlockerBuilderv5.exe 3044 WinlockerBuilderv5.exe 972 WinlockerBuilderv5.exe 972 WinlockerBuilderv5.exe 1796 WinlockerBuilderv5.exe 1796 WinlockerBuilderv5.exe 4980 WinlockerBuilderv5.exe 4980 WinlockerBuilderv5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2608 wrote to memory of 5092 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 5092 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4820 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4864 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4864 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe PID 2608 wrote to memory of 4076 2608 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://github.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc197f4f50,0x7ffc197f4f60,0x7ffc197f4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4372 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5096 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4328 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5284 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5088 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,10006605070948327089,12109127462602537851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exe"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exe"C:\Users\Admin\Documents\AudioDriver\taskhost.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\svchosts.exe"C:\Users\Admin\Desktop\svchosts.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\svchosts.exe"C:\Users\Admin\Desktop\svchosts.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\svchosts.exe"C:\Users\Admin\Desktop\svchosts.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"C:\Users\Admin\Desktop\WinlockerBuilderv5.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 7803⤵
-
C:\Users\Admin\Desktop\svchosts.exe"C:\Users\Admin\Desktop\svchosts.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idxFilesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lockFilesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lockFilesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.valFilesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\WinlockerBuilderv5.exe.logFilesize
866B
MD5d7d09fe4ff702ba9f25d5f48923708b6
SHA185ce2b7a1c9a4c3252fc9f471cf13ad50ad2cf65
SHA256ae5b9b53869ba7b6bf99b07cb09c9ce9ff11d4abbbb626570390f9fba4f6f462
SHA512500a313cc36a23302763d6957516640c981da2fbab691c8b66518f5b0051e25dfb1b09449efff526eab707fa1be36ef9362286869c82b3800e42d2d8287ef1cf
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchosts.exe.logFilesize
594B
MD544e889763d548d09132c31ed548f63f5
SHA1d9829a1b5841338533a0be0509df50172cce73be
SHA256d29f0e5fe1ab31998f200d4441c0e201a2e3bd6e416f638cbee2eb55354d48cc
SHA512a1474aaef1132f459e8139157a618368c7623f4a25a754c6fc2672d92929b9506bfcc272eebf5c69901f4140d36e740f5f6bbfb90e000c6538ab492f5aa48a96
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD503bf640a8ced726f71058ea4f6928ede
SHA16fe78c5c96463ac0821a7237823622bf62956dd7
SHA2560bacec1b0cbd13fc06842a3d8f95c467e175cba4bfbe726da630d736b23c4d14
SHA5128ecd95d303ab3cc4ffc71232eac48c972c04b2647aecacd6b47dd8a1bef4c6995f04f86a9e75fd4bf90128faef1e231a4874002c16e4d52310986b59f187749a
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exeFilesize
3.0MB
MD50df533cb9a581de63e3522954a681603
SHA1be46afa245289e0d9a84bd1fd1faea8d8c96da5e
SHA256e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3
SHA512c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\svshost.exeFilesize
4.0MB
MD52df0daacf8be5126ddbaa7ba9a83be58
SHA10889fcd78f5bf71ca04280fe97b7507b6b114ba3
SHA2560936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a
SHA5120348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\Desktop\WinlockerBuilderv5.exeFilesize
11.0MB
MD55891817266ffedc10d4a84a3bd483239
SHA1b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
SHA25651c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
SHA512517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
C:\Users\Admin\Desktop\svchosts.exeFilesize
17KB
MD589dd6e72358a669b7d6e2348307a7af7
SHA10db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA51293b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b
-
C:\Users\Admin\Desktop\svchosts.exeFilesize
17KB
MD589dd6e72358a669b7d6e2348307a7af7
SHA10db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA51293b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b
-
C:\Users\Admin\Desktop\svchosts.exeFilesize
17KB
MD589dd6e72358a669b7d6e2348307a7af7
SHA10db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA51293b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b
-
C:\Users\Admin\Desktop\svchosts.exeFilesize
17KB
MD589dd6e72358a669b7d6e2348307a7af7
SHA10db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA51293b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b
-
C:\Users\Admin\Desktop\svchosts.exeFilesize
17KB
MD589dd6e72358a669b7d6e2348307a7af7
SHA10db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA51293b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
C:\Users\Admin\Documents\AudioDriver\taskhost.exeFilesize
1.1MB
MD50d833c6509f350e0a15492597df2bda6
SHA11f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f
SHA256d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7
SHA5129e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118
-
\??\pipe\crashpad_2608_TSKZOUHIBLGHTVOJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/32-134-0x000000001D1D0000-0x000000001DC06000-memory.dmpFilesize
10.2MB
-
memory/32-135-0x000000000203A000-0x000000000203F000-memory.dmpFilesize
20KB
-
memory/32-143-0x000000000203A000-0x000000000203F000-memory.dmpFilesize
20KB
-
memory/444-163-0x0000000000000000-mapping.dmp
-
memory/972-206-0x0000000000000000-mapping.dmp
-
memory/972-208-0x000000000196A000-0x000000000196F000-memory.dmpFilesize
20KB
-
memory/972-207-0x000000001CAE0000-0x000000001D516000-memory.dmpFilesize
10.2MB
-
memory/1568-171-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/1568-178-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/1568-166-0x0000000000000000-mapping.dmp
-
memory/1568-179-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/1772-222-0x0000000001EBA000-0x0000000001EBF000-memory.dmpFilesize
20KB
-
memory/1772-220-0x000000001CED0000-0x000000001D906000-memory.dmpFilesize
10.2MB
-
memory/1772-221-0x0000000001EBA000-0x0000000001EBF000-memory.dmpFilesize
20KB
-
memory/1772-219-0x0000000000000000-mapping.dmp
-
memory/1796-209-0x0000000000000000-mapping.dmp
-
memory/1796-210-0x000000001CAD0000-0x000000001D506000-memory.dmpFilesize
10.2MB
-
memory/1796-211-0x000000000158A000-0x000000000158F000-memory.dmpFilesize
20KB
-
memory/2112-228-0x000000001CA40000-0x000000001D476000-memory.dmpFilesize
10.2MB
-
memory/2112-227-0x0000000000000000-mapping.dmp
-
memory/2112-229-0x000000000186A000-0x000000000186F000-memory.dmpFilesize
20KB
-
memory/2112-230-0x000000000186A000-0x000000000186F000-memory.dmpFilesize
20KB
-
memory/2196-183-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/2196-153-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/2196-175-0x0000000000400000-0x0000000000C89000-memory.dmpFilesize
8.5MB
-
memory/2196-144-0x0000000000000000-mapping.dmp
-
memory/2224-168-0x0000000000000000-mapping.dmp
-
memory/2980-177-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2980-160-0x0000000000000000-mapping.dmp
-
memory/2980-162-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2996-217-0x000000001CF90000-0x000000001D9C6000-memory.dmpFilesize
10.2MB
-
memory/2996-216-0x0000000000000000-mapping.dmp
-
memory/2996-218-0x0000000001E5A000-0x0000000001E5F000-memory.dmpFilesize
20KB
-
memory/3044-205-0x0000000001EFA000-0x0000000001EFF000-memory.dmpFilesize
20KB
-
memory/3044-203-0x000000001CE80000-0x000000001D8B6000-memory.dmpFilesize
10.2MB
-
memory/3044-201-0x0000000000000000-mapping.dmp
-
memory/3044-204-0x0000000001EFA000-0x0000000001EFF000-memory.dmpFilesize
20KB
-
memory/3136-225-0x00000000020AA000-0x00000000020AF000-memory.dmpFilesize
20KB
-
memory/3136-226-0x00000000020AA000-0x00000000020AF000-memory.dmpFilesize
20KB
-
memory/3136-224-0x000000001D210000-0x000000001DC46000-memory.dmpFilesize
10.2MB
-
memory/3136-223-0x0000000000000000-mapping.dmp
-
memory/3296-192-0x000000001BB00000-0x000000001C536000-memory.dmpFilesize
10.2MB
-
memory/3364-236-0x0000000000000000-mapping.dmp
-
memory/3464-231-0x0000000000000000-mapping.dmp
-
memory/3464-233-0x000000000161A000-0x000000000161F000-memory.dmpFilesize
20KB
-
memory/3464-232-0x000000001C7C0000-0x000000001D1F6000-memory.dmpFilesize
10.2MB
-
memory/3516-136-0x0000000000000000-mapping.dmp
-
memory/3628-176-0x0000000001C3A000-0x0000000001C3F000-memory.dmpFilesize
20KB
-
memory/3628-237-0x0000000001C3A000-0x0000000001C3F000-memory.dmpFilesize
20KB
-
memory/3628-157-0x0000000001C3A000-0x0000000001C3F000-memory.dmpFilesize
20KB
-
memory/3628-139-0x0000000000000000-mapping.dmp
-
memory/3628-142-0x000000001CB10000-0x000000001D546000-memory.dmpFilesize
10.2MB
-
memory/3676-186-0x000000001BCA0000-0x000000001C6D6000-memory.dmpFilesize
10.2MB
-
memory/4092-188-0x000000001BAB0000-0x000000001C4E6000-memory.dmpFilesize
10.2MB
-
memory/4360-150-0x0000000000000000-mapping.dmp
-
memory/4360-155-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4500-200-0x0000000001B7A000-0x0000000001B7F000-memory.dmpFilesize
20KB
-
memory/4500-195-0x0000000000000000-mapping.dmp
-
memory/4500-198-0x000000001CF10000-0x000000001D946000-memory.dmpFilesize
10.2MB
-
memory/4500-199-0x0000000001B7A000-0x0000000001B7F000-memory.dmpFilesize
20KB
-
memory/4544-156-0x0000000000000000-mapping.dmp
-
memory/4696-235-0x000000001D3A0000-0x000000001DDD6000-memory.dmpFilesize
10.2MB
-
memory/4696-234-0x0000000000000000-mapping.dmp
-
memory/4792-174-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4792-172-0x0000000000000000-mapping.dmp
-
memory/4912-152-0x00000000021D0000-0x00000000021D9000-memory.dmpFilesize
36KB
-
memory/4912-147-0x0000000000000000-mapping.dmp
-
memory/4980-214-0x00000000013FA000-0x00000000013FF000-memory.dmpFilesize
20KB
-
memory/4980-213-0x000000001C510000-0x000000001CF46000-memory.dmpFilesize
10.2MB
-
memory/4980-212-0x0000000000000000-mapping.dmp
-
memory/4980-215-0x00000000013FA000-0x00000000013FF000-memory.dmpFilesize
20KB
-
memory/5032-190-0x000000001B940000-0x000000001C376000-memory.dmpFilesize
10.2MB