Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
Resource
win10v2004-20220901-en
General
-
Target
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
-
Size
556KB
-
MD5
55113c969cc06b001416248a5fa292e4
-
SHA1
9046e539b20407a00237f07eab571e21cc1896b8
-
SHA256
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0
-
SHA512
5252afc3886b09d55139de6d298230f4c2c45deddc8824373364947de510ce45cf6e37d0eb9802f3d5c5587a3a4e03730d780c1a0906f98854c77167ca981089
-
SSDEEP
12288:J7Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:J7L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\5116369f\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
NB4wr66jY4.exebiipio.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" biipio.exe -
Executes dropped EXE 11 IoCs
Processes:
NB4wr66jY4.exebiipio.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe3xek.execsrss.exeXpid process 1268 NB4wr66jY4.exe 1504 biipio.exe 1732 2xek.exe 760 2xek.exe 1156 2xek.exe 864 2xek.exe 2012 2xek.exe 1888 2xek.exe 836 3xek.exe 340 csrss.exe 1964 X -
Processes:
resource yara_rule behavioral1/memory/1156-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-92-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1156-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-97-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1156-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-104-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/864-106-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2012-107-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/864-108-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1888-113-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2012-117-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1888-118-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1888-116-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2012-114-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1156-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-124-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1888-126-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/2012-105-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/864-99-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1888-127-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1888-133-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/864-169-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2012-170-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1156-168-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1748 cmd.exe -
Loads dropped DLL 10 IoCs
Processes:
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exeNB4wr66jY4.exe3xek.exepid process 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1268 NB4wr66jY4.exe 1268 NB4wr66jY4.exe 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 836 3xek.exe 836 3xek.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
biipio.exeNB4wr66jY4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /P" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /M" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /p" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /A" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /n" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /c" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /d" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /v" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /N" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /S" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /o" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /w" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /K" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /O" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /D" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /k" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /z" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /C" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /h" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /E" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /Y" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /j" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /G" biipio.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /L" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /V" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /m" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /y" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /F" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /u" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /q" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /I" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /R" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /e" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /X" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /W" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /i" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /Z" biipio.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /H" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /z" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /a" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /t" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /r" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /f" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /l" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /U" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /b" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /g" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /J" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /T" biipio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\biipio = "C:\\Users\\Admin\\biipio.exe /s" biipio.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2xek.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2xek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
2xek.exe3xek.exedescription pid process target process PID 1732 set thread context of 760 1732 2xek.exe 2xek.exe PID 1732 set thread context of 1156 1732 2xek.exe 2xek.exe PID 1732 set thread context of 864 1732 2xek.exe 2xek.exe PID 1732 set thread context of 2012 1732 2xek.exe 2xek.exe PID 1732 set thread context of 1888 1732 2xek.exe 2xek.exe PID 836 set thread context of 1876 836 3xek.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1496 tasklist.exe 764 tasklist.exe -
Modifies registry class 3 IoCs
Processes:
3xek.exedescription ioc process Key created \registry\machine\Software\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e} 3xek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\u = "188" 3xek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\cid = "15087846836022358845" 3xek.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NB4wr66jY4.exe2xek.exebiipio.exe3xek.exeXpid process 1268 NB4wr66jY4.exe 1268 NB4wr66jY4.exe 1156 2xek.exe 1504 biipio.exe 836 3xek.exe 836 3xek.exe 836 3xek.exe 1504 biipio.exe 836 3xek.exe 1964 X 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1156 2xek.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe 1504 biipio.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
tasklist.exe3xek.exetasklist.exedescription pid process Token: SeDebugPrivilege 1496 tasklist.exe Token: SeDebugPrivilege 836 3xek.exe Token: SeDebugPrivilege 836 3xek.exe Token: SeDebugPrivilege 764 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exeNB4wr66jY4.exebiipio.exe2xek.exe2xek.exe2xek.exepid process 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 1268 NB4wr66jY4.exe 1504 biipio.exe 1732 2xek.exe 2012 2xek.exe 1888 2xek.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 340 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exeNB4wr66jY4.execmd.exe2xek.exe3xek.exedescription pid process target process PID 1368 wrote to memory of 1268 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 1368 wrote to memory of 1268 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 1368 wrote to memory of 1268 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 1368 wrote to memory of 1268 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 1268 wrote to memory of 1504 1268 NB4wr66jY4.exe biipio.exe PID 1268 wrote to memory of 1504 1268 NB4wr66jY4.exe biipio.exe PID 1268 wrote to memory of 1504 1268 NB4wr66jY4.exe biipio.exe PID 1268 wrote to memory of 1504 1268 NB4wr66jY4.exe biipio.exe PID 1268 wrote to memory of 336 1268 NB4wr66jY4.exe cmd.exe PID 1268 wrote to memory of 336 1268 NB4wr66jY4.exe cmd.exe PID 1268 wrote to memory of 336 1268 NB4wr66jY4.exe cmd.exe PID 1268 wrote to memory of 336 1268 NB4wr66jY4.exe cmd.exe PID 336 wrote to memory of 1496 336 cmd.exe tasklist.exe PID 336 wrote to memory of 1496 336 cmd.exe tasklist.exe PID 336 wrote to memory of 1496 336 cmd.exe tasklist.exe PID 336 wrote to memory of 1496 336 cmd.exe tasklist.exe PID 1368 wrote to memory of 1732 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 1368 wrote to memory of 1732 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 1368 wrote to memory of 1732 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 1368 wrote to memory of 1732 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 1732 wrote to memory of 760 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 760 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 760 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 760 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 760 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1156 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 864 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 2012 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1732 wrote to memory of 1888 1732 2xek.exe 2xek.exe PID 1368 wrote to memory of 836 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 1368 wrote to memory of 836 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 1368 wrote to memory of 836 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 1368 wrote to memory of 836 1368 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 836 wrote to memory of 1280 836 3xek.exe Explorer.EXE PID 836 wrote to memory of 340 836 3xek.exe csrss.exe PID 836 wrote to memory of 1964 836 3xek.exe X
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe"C:\Users\Admin\AppData\Local\Temp\037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\biipio.exe"C:\Users\Admin\biipio.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\5116369f\X*0*bc*2e9d333d*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe3⤵
- Deletes itself
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
C:\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
C:\Users\Admin\AppData\Local\5116369f\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
C:\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
C:\Users\Admin\biipio.exeFilesize
224KB
MD5f6bf90ebeae67fba2e3f81bbf53e7212
SHA185389bd0e0c017dc0f27b1eaf01fd9f55038ff91
SHA256d5abda5fda78a44fc992b43021b5cfc826cb3822d81df03ce4ae8114ff4687ac
SHA5126581ace31b79903025db6b891a8c63cc4538e6fa7f4aa564297dba038801547d54a550dca0028918133cd7d19a35adb8c64b0d4bc1d0db1f10fd54805ec611ee
-
C:\Users\Admin\biipio.exeFilesize
224KB
MD5f6bf90ebeae67fba2e3f81bbf53e7212
SHA185389bd0e0c017dc0f27b1eaf01fd9f55038ff91
SHA256d5abda5fda78a44fc992b43021b5cfc826cb3822d81df03ce4ae8114ff4687ac
SHA5126581ace31b79903025db6b891a8c63cc4538e6fa7f4aa564297dba038801547d54a550dca0028918133cd7d19a35adb8c64b0d4bc1d0db1f10fd54805ec611ee
-
C:\Windows\system32\consrv.dllFilesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
\Users\Admin\AppData\Local\5116369f\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
\Users\Admin\AppData\Local\5116369f\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
\Users\Admin\biipio.exeFilesize
224KB
MD5f6bf90ebeae67fba2e3f81bbf53e7212
SHA185389bd0e0c017dc0f27b1eaf01fd9f55038ff91
SHA256d5abda5fda78a44fc992b43021b5cfc826cb3822d81df03ce4ae8114ff4687ac
SHA5126581ace31b79903025db6b891a8c63cc4538e6fa7f4aa564297dba038801547d54a550dca0028918133cd7d19a35adb8c64b0d4bc1d0db1f10fd54805ec611ee
-
\Users\Admin\biipio.exeFilesize
224KB
MD5f6bf90ebeae67fba2e3f81bbf53e7212
SHA185389bd0e0c017dc0f27b1eaf01fd9f55038ff91
SHA256d5abda5fda78a44fc992b43021b5cfc826cb3822d81df03ce4ae8114ff4687ac
SHA5126581ace31b79903025db6b891a8c63cc4538e6fa7f4aa564297dba038801547d54a550dca0028918133cd7d19a35adb8c64b0d4bc1d0db1f10fd54805ec611ee
-
\Windows\System32\consrv.dllFilesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}Filesize
2KB
MD56d03845f1d43e10908336ba602894baa
SHA1e804767710e4c25c01705ca8290cbfc8ebe0ca0c
SHA256523ee58ceeed3abcbc59b51f745ebfdf3bff774dd9792e3be0f3aeb63e8ab324
SHA512632a2b6aed9dd21e35db28f131cf1c384eb4c553f3bbe05874ddbe6fa5fa9cbe2548033d420b057cad6d9e93b171c6baa4382194c151164ceb0fb924be29aa2b
-
memory/336-72-0x0000000000000000-mapping.dmp
-
memory/340-165-0x0000000001FC0000-0x0000000001FCB000-memory.dmpFilesize
44KB
-
memory/760-81-0x0000000000000000-mapping.dmp
-
memory/764-179-0x0000000000000000-mapping.dmp
-
memory/836-163-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/836-164-0x000000000072E000-0x0000000000763000-memory.dmpFilesize
212KB
-
memory/836-171-0x000000000072E000-0x0000000000763000-memory.dmpFilesize
212KB
-
memory/836-137-0x0000000000000000-mapping.dmp
-
memory/836-175-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/836-176-0x000000000072E000-0x0000000000763000-memory.dmpFilesize
212KB
-
memory/864-91-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-108-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-100-0x0000000000453B80-mapping.dmp
-
memory/864-97-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-99-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-106-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-92-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-169-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/864-124-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1156-168-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-88-0x00000000004274E0-mapping.dmp
-
memory/1156-87-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-98-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-96-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-86-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-83-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-84-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1268-59-0x0000000000000000-mapping.dmp
-
memory/1280-167-0x0000000002A60000-0x0000000002A6B000-memory.dmpFilesize
44KB
-
memory/1280-172-0x00000000029A0000-0x00000000029A8000-memory.dmpFilesize
32KB
-
memory/1280-162-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/1280-139-0x00000000029A0000-0x00000000029A6000-memory.dmpFilesize
24KB
-
memory/1280-143-0x00000000029A0000-0x00000000029A6000-memory.dmpFilesize
24KB
-
memory/1280-147-0x00000000029A0000-0x00000000029A6000-memory.dmpFilesize
24KB
-
memory/1280-154-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/1280-166-0x00000000029A0000-0x00000000029A8000-memory.dmpFilesize
32KB
-
memory/1280-158-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/1368-177-0x00000000027E0000-0x000000000329A000-memory.dmpFilesize
10.7MB
-
memory/1368-56-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/1496-73-0x0000000000000000-mapping.dmp
-
memory/1504-67-0x0000000000000000-mapping.dmp
-
memory/1732-76-0x0000000000000000-mapping.dmp
-
memory/1748-178-0x0000000000000000-mapping.dmp
-
memory/1876-174-0x0000000000000000-mapping.dmp
-
memory/1888-116-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-118-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-126-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-113-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-112-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-133-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1888-119-0x00000000004084F0-mapping.dmp
-
memory/1888-127-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1964-152-0x0000000000000000-mapping.dmp
-
memory/2012-170-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-105-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-104-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-103-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-109-0x0000000000405790-mapping.dmp
-
memory/2012-114-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-107-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2012-117-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB