Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
23-11-2022 10:41
General
-
Target
24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exe
-
Size
127KB
-
MD5
a1f906cca600c01f6dd03c61b89aafd8
-
SHA1
d1f299a68712dbfcf307384cc8b78a43d6ed11a3
-
SHA256
24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12
-
SHA512
d917bd03d27f2f7a4e9ba0bbcf77efc456271765a1d693cfb9a986ee1b313ca4fe44a576897549eaf26a518581dc8c9e1ee2300c54d816acd298040b35856c89
-
SSDEEP
1536:EnqJu3abBGy3G8V0iuoKTMUYU6U5jUdPQc+n35KZg8/nouy8Iu:EqlMPsgMYjUtQl78vout
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 13 IoCs
-
Modifies system executable filetype association 2 TTPs 15 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 15 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 15 IoCs
-
UAC bypass 3 TTPs 13 IoCs
-
Disables RegEdit via registry modification 13 IoCs
-
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 64 IoCs
-
Sets file execution options in registry 2 TTPs 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 64 IoCs
-
Checks whether UAC is enabled 1 TTPs 13 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 34 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 26 IoCs
-
Modifies registry class 62 IoCs
-
Runs ping.exe 1 TTPs 36 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 11 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exe"C:\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exeC:\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exe2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe3⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe5⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe5⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe7⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe9⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe11⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe12⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe11⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe12⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe11⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe12⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe11⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe12⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe11⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe12⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community11⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen11⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe9⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe10⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe9⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe10⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community7⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen7⤵
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13407⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13407⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13407⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe5⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community5⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13405⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community3⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen3⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13403⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13403⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13403⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe2⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe3⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe5⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe7⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe9⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen10⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen8⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe7⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe9⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community10⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen10⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 134010⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community8⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen8⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community6⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen6⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe5⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe7⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe8⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe9⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community8⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen8⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13408⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe6⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe7⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community6⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen6⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13406⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe4⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community4⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen4⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13404⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13404⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13404⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe2⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe2⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe2⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe3⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityC:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen2⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\ping.exeping www.duniasex.com -n 65500 -l 13402⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.data0.net -n 65500 -l 13402⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeping www.rasasayang.com.my -n 65500 -l 13402⤵
- Runs ping.exe
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\ndsw.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\ndsw.exe" csrss1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe1⤵
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeC:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Winlogon Helper DLL
1Change Default File Association
1Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
9Hidden Files and Directories
2Bypass User Account Control
1Disabling Security Tools
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Users\Admin\AppData\Roaming\Microsoft\ndsw.exeFilesize
76KB
MD5019d02f6ff40b761ca76dcec44331704
SHA1fcf885d795fc726664dc932f7343f1864f2dbfa9
SHA256893c51b00d1962cb3230cbe0d003570cf644e15f28f823bc83ab1e1c544a6540
SHA5126255105f5dd9406fd97056b7a5860db92a0f16eb7c54d07c7d7788f22c6a95d28aabe150e4107eee80e00d61d93a253e378949a76f0f2d2947bb2b9ec82d28f0
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLLFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_CommunityFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\ndsw.exeFilesize
76KB
MD5019d02f6ff40b761ca76dcec44331704
SHA1fcf885d795fc726664dc932f7343f1864f2dbfa9
SHA256893c51b00d1962cb3230cbe0d003570cf644e15f28f823bc83ab1e1c544a6540
SHA5126255105f5dd9406fd97056b7a5860db92a0f16eb7c54d07c7d7788f22c6a95d28aabe150e4107eee80e00d61d93a253e378949a76f0f2d2947bb2b9ec82d28f0
-
\??\c:\windows\SysWOW64\Windows 3D.scrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\??\c:\windows\SysWOW64\maxtrox.txtMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Users\Admin\AppData\Local\Temp\24bc30fbeef7b9c24a4d31d1e77f5050124217e54df058eeadca4d1b56c9ea12.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Users\Admin\AppData\Roaming\Microsoft\ndsw.exeFilesize
76KB
MD5019d02f6ff40b761ca76dcec44331704
SHA1fcf885d795fc726664dc932f7343f1864f2dbfa9
SHA256893c51b00d1962cb3230cbe0d003570cf644e15f28f823bc83ab1e1c544a6540
SHA5126255105f5dd9406fd97056b7a5860db92a0f16eb7c54d07c7d7788f22c6a95d28aabe150e4107eee80e00d61d93a253e378949a76f0f2d2947bb2b9ec82d28f0
-
\Users\Admin\AppData\Roaming\Microsoft\ndsw.exeFilesize
76KB
MD5019d02f6ff40b761ca76dcec44331704
SHA1fcf885d795fc726664dc932f7343f1864f2dbfa9
SHA256893c51b00d1962cb3230cbe0d003570cf644e15f28f823bc83ab1e1c544a6540
SHA5126255105f5dd9406fd97056b7a5860db92a0f16eb7c54d07c7d7788f22c6a95d28aabe150e4107eee80e00d61d93a253e378949a76f0f2d2947bb2b9ec82d28f0
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dllFilesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
127KB
MD575ce518ad5b75d85553f5e0457faec5b
SHA1168b9b100c805741fda5db7748f43cd11699e26b
SHA2561b43a20bb324bb5002dd5ebd20a1c9d74bb389f8c12ef89fe8fcd410f72a4818
SHA5128593a0c4b979040afeef6a93678c9384f9d2d341b689d2c3e6999ae8815031f9ec78c76d8b6266782ca448c9e2969f426b6b5cf89cb38a05edf23324f3981811
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exeFilesize
50KB
MD506784c5378e5d7edd9cdd7312568541e
SHA15352a5f465f8596e2ea78f1f14151fd2cd91f618
SHA2562d6133e00be7ebaf90f41ec8b1fafdaf3bea8c62e612fff99514dbc5a37e14bd
SHA512b6d90ad4e8fd6006e97b6cb41f17997b4095ce3c46d5aec25876231cf5cd1145f7bf731a0172bd8524f9765b82a510516f4ce073cd9a72b8ddf217c11de0eb66
-
memory/240-248-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/240-245-0x0000000000000000-mapping.dmp
-
memory/328-94-0x0000000000000000-mapping.dmp
-
memory/328-99-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/328-277-0x0000000000000000-mapping.dmp
-
memory/332-230-0x0000000000000000-mapping.dmp
-
memory/332-275-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/368-147-0x0000000000000000-mapping.dmp
-
memory/588-191-0x0000000000000000-mapping.dmp
-
memory/656-292-0x0000000000000000-mapping.dmp
-
memory/668-177-0x0000000000000000-mapping.dmp
-
memory/680-155-0x0000000000000000-mapping.dmp
-
memory/680-160-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/736-125-0x0000000000000000-mapping.dmp
-
memory/736-198-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/780-132-0x0000000000000000-mapping.dmp
-
memory/780-236-0x0000000000000000-mapping.dmp
-
memory/796-184-0x0000000000000000-mapping.dmp
-
memory/816-215-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/816-212-0x0000000000000000-mapping.dmp
-
memory/892-340-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/936-297-0x0000000000000000-mapping.dmp
-
memory/940-176-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/940-171-0x0000000000000000-mapping.dmp
-
memory/940-303-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/940-300-0x0000000000000000-mapping.dmp
-
memory/972-196-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/972-117-0x0000000000000000-mapping.dmp
-
memory/1012-288-0x0000000000000000-mapping.dmp
-
memory/1108-111-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1108-58-0x0000000000000000-mapping.dmp
-
memory/1136-330-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1136-327-0x0000000000000000-mapping.dmp
-
memory/1176-223-0x0000000000000000-mapping.dmp
-
memory/1188-219-0x0000000000000000-mapping.dmp
-
memory/1188-222-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1224-187-0x0000000000000000-mapping.dmp
-
memory/1224-311-0x0000000000000000-mapping.dmp
-
memory/1224-190-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1256-200-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1256-168-0x0000000000000000-mapping.dmp
-
memory/1256-372-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1300-263-0x0000000000000000-mapping.dmp
-
memory/1304-304-0x0000000000000000-mapping.dmp
-
memory/1344-256-0x0000000000000000-mapping.dmp
-
memory/1356-350-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1460-255-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1460-252-0x0000000000000000-mapping.dmp
-
memory/1472-278-0x0000000000000000-mapping.dmp
-
memory/1476-345-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1484-174-0x0000000000000000-mapping.dmp
-
memory/1484-175-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1548-281-0x0000000000000000-mapping.dmp
-
memory/1568-139-0x0000000000000000-mapping.dmp
-
memory/1568-144-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1600-216-0x0000000000000000-mapping.dmp
-
memory/1624-285-0x0000000000000000-mapping.dmp
-
memory/1636-209-0x0000000000000000-mapping.dmp
-
memory/1640-266-0x0000000000000000-mapping.dmp
-
memory/1648-249-0x0000000000000000-mapping.dmp
-
memory/1664-242-0x0000000000000000-mapping.dmp
-
memory/1664-294-0x0000000000000000-mapping.dmp
-
memory/1664-366-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1664-351-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1672-287-0x0000000000000000-mapping.dmp
-
memory/1688-324-0x0000000000000000-mapping.dmp
-
memory/1724-208-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-205-0x0000000000000000-mapping.dmp
-
memory/1728-199-0x00000000001C0000-0x00000000001E9000-memory.dmpFilesize
164KB
-
memory/1728-163-0x0000000000000000-mapping.dmp
-
memory/1740-282-0x0000000000000000-mapping.dmp
-
memory/1744-335-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1756-201-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1756-293-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1756-194-0x0000000000000000-mapping.dmp
-
memory/1760-273-0x0000000000000000-mapping.dmp
-
memory/1764-86-0x0000000000000000-mapping.dmp
-
memory/1772-239-0x0000000000000000-mapping.dmp
-
memory/1772-290-0x0000000000000000-mapping.dmp
-
memory/1816-109-0x0000000000390000-0x00000000003B9000-memory.dmpFilesize
164KB
-
memory/1816-110-0x0000000000390000-0x00000000003B9000-memory.dmpFilesize
164KB
-
memory/1832-307-0x0000000000000000-mapping.dmp
-
memory/1832-310-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1848-314-0x0000000000000000-mapping.dmp
-
memory/1848-317-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1876-318-0x0000000000000000-mapping.dmp
-
memory/1904-229-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1904-226-0x0000000000000000-mapping.dmp
-
memory/1988-74-0x0000000000000000-mapping.dmp
-
memory/1988-114-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1988-477-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1992-233-0x0000000000000000-mapping.dmp
-
memory/1992-358-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1992-321-0x0000000000000000-mapping.dmp
-
memory/1992-284-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1992-352-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1992-272-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1992-276-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1996-259-0x0000000000000000-mapping.dmp
-
memory/1996-262-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2024-113-0x0000000000260000-0x0000000000289000-memory.dmpFilesize
164KB
-
memory/2024-112-0x0000000000260000-0x0000000000289000-memory.dmpFilesize
164KB
-
memory/2024-64-0x0000000000000000-mapping.dmp
-
memory/2028-102-0x0000000000000000-mapping.dmp
-
memory/2032-202-0x0000000000000000-mapping.dmp
-
memory/2040-183-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2040-269-0x0000000000000000-mapping.dmp
-
memory/2040-180-0x0000000000000000-mapping.dmp
-
memory/2208-396-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/2296-397-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2384-380-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2444-394-0x0000000000250000-0x0000000000279000-memory.dmpFilesize
164KB
-
memory/2468-395-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2476-393-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2536-404-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2572-409-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2608-419-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2640-421-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2664-484-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2672-423-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2720-431-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2728-452-0x00000000002C0000-0x00000000002E9000-memory.dmpFilesize
164KB
-
memory/2768-436-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2784-453-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2808-451-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/2856-448-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2864-449-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2892-454-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2980-471-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB