Analysis
-
max time kernel
125s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 00:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
271KB
-
MD5
54fa8ae6671f98d704489ab97e7d47a6
-
SHA1
420336123e74288f1675ce3d9b490b2f4a1e6b81
-
SHA256
014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb
-
SHA512
9a4f7357a2c0b728f62bb1eca0d01f97464a0dc129f920ea75ffaeb7e62ce3e183dbdd3dda98ee6620cc9f0314f513ba79fc29451b87ed50c54d981c773c826a
-
SSDEEP
6144:03a28LjlPXli/8LnzAAyGRllMS79+yRSQS01ZA:03a/PlPXoAMGR4I+7U
Malware Config
Extracted
amadey
3.66
193.233.20.2/Bn89hku/index.php
Extracted
redline
france
193.233.20.5:4136
-
auth_value
827023aa27bcc1cc2382e4d111feec6f
Extracted
redline
new1
176.113.115.16:4122
-
auth_value
ac44cbde6633acc9d67419c7278d5c70
Signatures
-
Detect rhadamanthys stealer shellcode 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1952-187-0x0000000000580000-0x000000000059D000-memory.dmp family_rhadamanthys behavioral2/memory/3600-189-0x0000000002030000-0x000000000204D000-memory.dmp family_rhadamanthys behavioral2/memory/484-191-0x0000000002030000-0x000000000204D000-memory.dmp family_rhadamanthys behavioral2/memory/2140-204-0x00000000004D0000-0x00000000004ED000-memory.dmp family_rhadamanthys behavioral2/memory/2100-207-0x00000000005A0000-0x00000000005BD000-memory.dmp family_rhadamanthys behavioral2/memory/3600-209-0x0000000002030000-0x000000000204D000-memory.dmp family_rhadamanthys behavioral2/memory/4712-211-0x0000000000470000-0x000000000048D000-memory.dmp family_rhadamanthys behavioral2/memory/4712-214-0x0000000000470000-0x000000000048D000-memory.dmp family_rhadamanthys -
Processes:
nika.exenika1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
mnolyk.exenika.exefranc.exefranc.exemixo.exenika1.exetrebo1.exetrebo1.exetrebo1.exetrebo1.exemnolyk.exetrebo1.exetrebo1.exemnolyk.exepid process 208 mnolyk.exe 3568 nika.exe 3796 franc.exe 3552 franc.exe 2552 mixo.exe 828 nika1.exe 3600 trebo1.exe 1952 trebo1.exe 484 trebo1.exe 2140 trebo1.exe 1524 mnolyk.exe 2100 trebo1.exe 4712 trebo1.exe 704 mnolyk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
nika.exenika1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika1.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mnolyk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\franc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003051\\franc.exe" mnolyk.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
trebo1.exetrebo1.exepid process 3600 trebo1.exe 3600 trebo1.exe 3600 trebo1.exe 4712 trebo1.exe 4712 trebo1.exe 4712 trebo1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 47 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 628 2016 WerFault.exe file.exe 1072 2016 WerFault.exe file.exe 5004 2016 WerFault.exe file.exe 2068 2016 WerFault.exe file.exe 2960 2016 WerFault.exe file.exe 2604 2016 WerFault.exe file.exe 5076 2016 WerFault.exe file.exe 1112 208 WerFault.exe mnolyk.exe 3768 208 WerFault.exe mnolyk.exe 4596 208 WerFault.exe mnolyk.exe 1612 208 WerFault.exe mnolyk.exe 1164 208 WerFault.exe mnolyk.exe 3060 208 WerFault.exe mnolyk.exe 3036 208 WerFault.exe mnolyk.exe 516 208 WerFault.exe mnolyk.exe 2356 208 WerFault.exe mnolyk.exe 3724 208 WerFault.exe mnolyk.exe 2180 208 WerFault.exe mnolyk.exe 1500 208 WerFault.exe mnolyk.exe 5000 208 WerFault.exe mnolyk.exe 4412 208 WerFault.exe mnolyk.exe 4716 208 WerFault.exe mnolyk.exe 2960 208 WerFault.exe mnolyk.exe 3000 208 WerFault.exe mnolyk.exe 3076 208 WerFault.exe mnolyk.exe 5076 208 WerFault.exe mnolyk.exe 3016 208 WerFault.exe mnolyk.exe 1112 208 WerFault.exe mnolyk.exe 2200 208 WerFault.exe mnolyk.exe 2076 208 WerFault.exe mnolyk.exe 2216 208 WerFault.exe mnolyk.exe 2444 208 WerFault.exe mnolyk.exe 4224 208 WerFault.exe mnolyk.exe 4732 208 WerFault.exe mnolyk.exe 3724 208 WerFault.exe mnolyk.exe 4752 208 WerFault.exe mnolyk.exe 1904 208 WerFault.exe mnolyk.exe 4936 208 WerFault.exe mnolyk.exe 1076 208 WerFault.exe mnolyk.exe 5072 208 WerFault.exe mnolyk.exe 2964 208 WerFault.exe mnolyk.exe 3472 208 WerFault.exe mnolyk.exe 668 208 WerFault.exe mnolyk.exe 3116 1524 WerFault.exe mnolyk.exe 3980 208 WerFault.exe mnolyk.exe 4624 208 WerFault.exe mnolyk.exe 2224 704 WerFault.exe mnolyk.exe -
Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
trebo1.exetrebo1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 trebo1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID trebo1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 trebo1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID trebo1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI trebo1.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
nika.exenika1.exefranc.exefranc.exemixo.exepid process 3568 nika.exe 3568 nika.exe 828 nika1.exe 828 nika1.exe 3796 franc.exe 3552 franc.exe 2552 mixo.exe 3552 franc.exe 3796 franc.exe 2552 mixo.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
nika.exenika1.exefranc.exefranc.exemixo.exetrebo1.exetrebo1.exedescription pid process Token: SeDebugPrivilege 3568 nika.exe Token: SeDebugPrivilege 828 nika1.exe Token: SeDebugPrivilege 3796 franc.exe Token: SeDebugPrivilege 3552 franc.exe Token: SeDebugPrivilege 2552 mixo.exe Token: SeShutdownPrivilege 3600 trebo1.exe Token: SeCreatePagefilePrivilege 3600 trebo1.exe Token: SeShutdownPrivilege 4712 trebo1.exe Token: SeCreatePagefilePrivilege 4712 trebo1.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
file.exemnolyk.execmd.exedescription pid process target process PID 2016 wrote to memory of 208 2016 file.exe mnolyk.exe PID 2016 wrote to memory of 208 2016 file.exe mnolyk.exe PID 2016 wrote to memory of 208 2016 file.exe mnolyk.exe PID 208 wrote to memory of 4496 208 mnolyk.exe schtasks.exe PID 208 wrote to memory of 4496 208 mnolyk.exe schtasks.exe PID 208 wrote to memory of 4496 208 mnolyk.exe schtasks.exe PID 208 wrote to memory of 4356 208 mnolyk.exe cmd.exe PID 208 wrote to memory of 4356 208 mnolyk.exe cmd.exe PID 208 wrote to memory of 4356 208 mnolyk.exe cmd.exe PID 4356 wrote to memory of 3136 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 3136 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 3136 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 2720 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 2720 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 2720 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4676 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4676 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4676 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4084 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 4084 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 4084 4356 cmd.exe cmd.exe PID 4356 wrote to memory of 4608 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4608 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4608 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4536 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4536 4356 cmd.exe cacls.exe PID 4356 wrote to memory of 4536 4356 cmd.exe cacls.exe PID 208 wrote to memory of 3568 208 mnolyk.exe nika.exe PID 208 wrote to memory of 3568 208 mnolyk.exe nika.exe PID 208 wrote to memory of 3796 208 mnolyk.exe franc.exe PID 208 wrote to memory of 3796 208 mnolyk.exe franc.exe PID 208 wrote to memory of 3796 208 mnolyk.exe franc.exe PID 208 wrote to memory of 3552 208 mnolyk.exe franc.exe PID 208 wrote to memory of 3552 208 mnolyk.exe franc.exe PID 208 wrote to memory of 3552 208 mnolyk.exe franc.exe PID 208 wrote to memory of 2552 208 mnolyk.exe mixo.exe PID 208 wrote to memory of 2552 208 mnolyk.exe mixo.exe PID 208 wrote to memory of 2552 208 mnolyk.exe mixo.exe PID 208 wrote to memory of 828 208 mnolyk.exe nika1.exe PID 208 wrote to memory of 828 208 mnolyk.exe nika1.exe PID 208 wrote to memory of 3600 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 3600 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 3600 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 1952 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 1952 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 1952 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 484 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 484 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 484 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2140 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2140 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2140 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2100 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2100 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 2100 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 4712 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 4712 208 mnolyk.exe trebo1.exe PID 208 wrote to memory of 4712 208 mnolyk.exe trebo1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 8362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 9562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 10762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 10762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 9562⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 5843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 8003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 10203⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 6443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 12083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 7483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 11923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 14603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 15843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 12763⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exe"C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exe"C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 12763⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000005001\mixo.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\mixo.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 15843⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16403⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16723⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16683⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 14923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17563⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 17243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 16403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 9923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 9042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2016 -ip 20161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 208 -ip 2081⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 2362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1524 -ip 15241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 208 -ip 2081⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 704 -ip 7041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\franc.exe.logFilesize
2KB
MD51f5b2fb087be05026a47d87b0471c411
SHA19f012480d0402c7200ff48576daaf6adf63125cc
SHA2563a12e1bfa36873489b21ac589cb27792a417eb2e55f4622c53c224934ff05527
SHA512003aeb76f6e1be9b201f7ba83d27609e59433596b3dab7afe15790b422cc9cd8a10ea5e36d96dea0cf01a86928dedd1d06d42489e9ae60c460f55aa93d9f5c51
-
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000001001\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exeFilesize
175KB
MD56991818e08082c4c140db502d2aff79f
SHA1020ee1da61473dcd090805343601c1ae3d265032
SHA256aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0
SHA5123f02448363aabe7515f1225a3291fb1fa0185ca78a302d70dd611b7f73b1b317a486eef61c2a7489a0d4e43301fa20c5fa48cb62d26f3e20d87aaeceb8a82d3e
-
C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exeFilesize
175KB
MD56991818e08082c4c140db502d2aff79f
SHA1020ee1da61473dcd090805343601c1ae3d265032
SHA256aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0
SHA5123f02448363aabe7515f1225a3291fb1fa0185ca78a302d70dd611b7f73b1b317a486eef61c2a7489a0d4e43301fa20c5fa48cb62d26f3e20d87aaeceb8a82d3e
-
C:\Users\Admin\AppData\Local\Temp\1000003051\franc.exeFilesize
175KB
MD56991818e08082c4c140db502d2aff79f
SHA1020ee1da61473dcd090805343601c1ae3d265032
SHA256aa0a99779ffa4aa30aa23c9dc9db17b250457c5902e7d06aa785be97d764c3d0
SHA5123f02448363aabe7515f1225a3291fb1fa0185ca78a302d70dd611b7f73b1b317a486eef61c2a7489a0d4e43301fa20c5fa48cb62d26f3e20d87aaeceb8a82d3e
-
C:\Users\Admin\AppData\Local\Temp\1000005001\mixo.exeFilesize
175KB
MD51f2c3b82599a2c08b71927d14161a891
SHA1bb2cd9f22ff5f4125602eae38fe738df4efdfd08
SHA256898f61de806302b411cb94d53aa9493a599038a8e1dd8ccc03801835e018cca1
SHA51268a8b8e7b64babe0f73e92ca2ab3c933c23d1ac77c7b4de835ca42c24205b3202a4211c979bbba0a5e045f51a175307dd1caa7256cf02b47a5f0ea3456ee2106
-
C:\Users\Admin\AppData\Local\Temp\1000005001\mixo.exeFilesize
175KB
MD51f2c3b82599a2c08b71927d14161a891
SHA1bb2cd9f22ff5f4125602eae38fe738df4efdfd08
SHA256898f61de806302b411cb94d53aa9493a599038a8e1dd8ccc03801835e018cca1
SHA51268a8b8e7b64babe0f73e92ca2ab3c933c23d1ac77c7b4de835ca42c24205b3202a4211c979bbba0a5e045f51a175307dd1caa7256cf02b47a5f0ea3456ee2106
-
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000006001\nika1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\1000011001\trebo1.exeFilesize
220KB
MD54b304313bfc0ce7e21da7ae0d3c82c39
SHA160745879faa3544b3a884843e368e668acbb6fa9
SHA256623839847e3aa9ceda27ced8b2b29b2d4545384bc3a322eaeedd04d5d04b65bd
SHA5122da2ec584ccde77ec35cab398272e60ec69eda24491030119110f0e389067d322cd08a04a3bdbbbeff85f43c0d739ae10a6a549e2d7a14854d1109db8d313001
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
271KB
MD554fa8ae6671f98d704489ab97e7d47a6
SHA1420336123e74288f1675ce3d9b490b2f4a1e6b81
SHA256014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb
SHA5129a4f7357a2c0b728f62bb1eca0d01f97464a0dc129f920ea75ffaeb7e62ce3e183dbdd3dda98ee6620cc9f0314f513ba79fc29451b87ed50c54d981c773c826a
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
271KB
MD554fa8ae6671f98d704489ab97e7d47a6
SHA1420336123e74288f1675ce3d9b490b2f4a1e6b81
SHA256014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb
SHA5129a4f7357a2c0b728f62bb1eca0d01f97464a0dc129f920ea75ffaeb7e62ce3e183dbdd3dda98ee6620cc9f0314f513ba79fc29451b87ed50c54d981c773c826a
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
271KB
MD554fa8ae6671f98d704489ab97e7d47a6
SHA1420336123e74288f1675ce3d9b490b2f4a1e6b81
SHA256014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb
SHA5129a4f7357a2c0b728f62bb1eca0d01f97464a0dc129f920ea75ffaeb7e62ce3e183dbdd3dda98ee6620cc9f0314f513ba79fc29451b87ed50c54d981c773c826a
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
271KB
MD554fa8ae6671f98d704489ab97e7d47a6
SHA1420336123e74288f1675ce3d9b490b2f4a1e6b81
SHA256014cbe5bdcde3da162378765e82975509eb964079627c95eeb975eba9f8828bb
SHA5129a4f7357a2c0b728f62bb1eca0d01f97464a0dc129f920ea75ffaeb7e62ce3e183dbdd3dda98ee6620cc9f0314f513ba79fc29451b87ed50c54d981c773c826a
-
memory/208-135-0x0000000000000000-mapping.dmp
-
memory/208-142-0x0000000002CA8000-0x0000000002CC7000-memory.dmpFilesize
124KB
-
memory/208-141-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/208-140-0x0000000002CA8000-0x0000000002CC7000-memory.dmpFilesize
124KB
-
memory/484-191-0x0000000002030000-0x000000000204D000-memory.dmpFilesize
116KB
-
memory/484-188-0x00000000004D5000-0x00000000004D8000-memory.dmpFilesize
12KB
-
memory/484-185-0x0000000000000000-mapping.dmp
-
memory/704-217-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/704-216-0x0000000002D4C000-0x0000000002D6A000-memory.dmpFilesize
120KB
-
memory/704-218-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/828-173-0x00007FFF1C2E0000-0x00007FFF1CDA1000-memory.dmpFilesize
10.8MB
-
memory/828-170-0x0000000000000000-mapping.dmp
-
memory/828-181-0x00007FFF1C2E0000-0x00007FFF1CDA1000-memory.dmpFilesize
10.8MB
-
memory/1524-213-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/1524-210-0x0000000002D9C000-0x0000000002DBA000-memory.dmpFilesize
120KB
-
memory/1952-184-0x0000000000714000-0x0000000000717000-memory.dmpFilesize
12KB
-
memory/1952-182-0x0000000000000000-mapping.dmp
-
memory/1952-187-0x0000000000580000-0x000000000059D000-memory.dmpFilesize
116KB
-
memory/2016-134-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/2016-132-0x0000000002D9A000-0x0000000002DB8000-memory.dmpFilesize
120KB
-
memory/2016-133-0x0000000002D40000-0x0000000002D7C000-memory.dmpFilesize
240KB
-
memory/2016-138-0x0000000002D9A000-0x0000000002DB8000-memory.dmpFilesize
120KB
-
memory/2016-139-0x0000000000400000-0x0000000002BAD000-memory.dmpFilesize
39.7MB
-
memory/2100-203-0x0000000000654000-0x0000000000657000-memory.dmpFilesize
12KB
-
memory/2100-200-0x0000000000000000-mapping.dmp
-
memory/2100-207-0x00000000005A0000-0x00000000005BD000-memory.dmpFilesize
116KB
-
memory/2140-202-0x0000000000514000-0x0000000000517000-memory.dmpFilesize
12KB
-
memory/2140-194-0x0000000000000000-mapping.dmp
-
memory/2140-204-0x00000000004D0000-0x00000000004ED000-memory.dmpFilesize
116KB
-
memory/2552-176-0x0000000005AD0000-0x0000000006074000-memory.dmpFilesize
5.6MB
-
memory/2552-169-0x0000000000130000-0x0000000000162000-memory.dmpFilesize
200KB
-
memory/2552-166-0x0000000000000000-mapping.dmp
-
memory/2720-146-0x0000000000000000-mapping.dmp
-
memory/3136-145-0x0000000000000000-mapping.dmp
-
memory/3552-177-0x0000000005620000-0x0000000005686000-memory.dmpFilesize
408KB
-
memory/3552-193-0x0000000007220000-0x000000000774C000-memory.dmpFilesize
5.2MB
-
memory/3552-198-0x0000000006F20000-0x0000000006F70000-memory.dmpFilesize
320KB
-
memory/3552-175-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/3552-160-0x0000000000000000-mapping.dmp
-
memory/3552-192-0x0000000006B20000-0x0000000006CE2000-memory.dmpFilesize
1.8MB
-
memory/3568-155-0x00007FFF1C2E0000-0x00007FFF1CDA1000-memory.dmpFilesize
10.8MB
-
memory/3568-151-0x0000000000000000-mapping.dmp
-
memory/3568-174-0x00007FFF1C2E0000-0x00007FFF1CDA1000-memory.dmpFilesize
10.8MB
-
memory/3568-154-0x0000000000390000-0x000000000039A000-memory.dmpFilesize
40KB
-
memory/3600-190-0x0000000002390000-0x0000000003390000-memory.dmpFilesize
16.0MB
-
memory/3600-209-0x0000000002030000-0x000000000204D000-memory.dmpFilesize
116KB
-
memory/3600-178-0x0000000000000000-mapping.dmp
-
memory/3600-189-0x0000000002030000-0x000000000204D000-memory.dmpFilesize
116KB
-
memory/3796-165-0x00000000059C0000-0x00000000059FC000-memory.dmpFilesize
240KB
-
memory/3796-164-0x0000000005930000-0x0000000005942000-memory.dmpFilesize
72KB
-
memory/3796-197-0x0000000007660000-0x00000000076D6000-memory.dmpFilesize
472KB
-
memory/3796-156-0x0000000000000000-mapping.dmp
-
memory/3796-159-0x0000000000F70000-0x0000000000FA2000-memory.dmpFilesize
200KB
-
memory/3796-162-0x0000000005EA0000-0x00000000064B8000-memory.dmpFilesize
6.1MB
-
memory/3796-163-0x0000000005A00000-0x0000000005B0A000-memory.dmpFilesize
1.0MB
-
memory/4084-148-0x0000000000000000-mapping.dmp
-
memory/4356-144-0x0000000000000000-mapping.dmp
-
memory/4496-143-0x0000000000000000-mapping.dmp
-
memory/4536-150-0x0000000000000000-mapping.dmp
-
memory/4608-149-0x0000000000000000-mapping.dmp
-
memory/4676-147-0x0000000000000000-mapping.dmp
-
memory/4712-208-0x00000000004A4000-0x00000000004A7000-memory.dmpFilesize
12KB
-
memory/4712-205-0x0000000000000000-mapping.dmp
-
memory/4712-211-0x0000000000470000-0x000000000048D000-memory.dmpFilesize
116KB
-
memory/4712-212-0x0000000002390000-0x0000000003390000-memory.dmpFilesize
16.0MB
-
memory/4712-214-0x0000000000470000-0x000000000048D000-memory.dmpFilesize
116KB