Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
17-02-2023 20:22
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
704KB
-
MD5
cf9062024ce65bc24107008c66f9b937
-
SHA1
26557dbd46abab82bef24400ff4a7d984f10dda8
-
SHA256
dc9d065d44fcfcecd44374624fd7f1823d3355ca0a20f19c094fec43087a7d48
-
SHA512
2d62c1ff5b15d10ec5ce3696d5096ba7824904f48187dd75a44b97a3dad8dcfda2a73d97d9cebbc951dad95e0b0dc9840ba6d2020d3bd87ae927f9e8f61dd779
-
SSDEEP
12288:VMrryy90e1QnB5H1ZkuJYUZpBTuct/UHxHNZaPHyEjkSwHQc5LWfsBpn+AjkruL1:Hy9QnBnG+XfGxWvyEeLKORwKVP40n
Malware Config
Extracted
redline
furka
193.233.20.17:4139
-
auth_value
46dae41be0c00464bf56eddcc93e1bec
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
Extracted
amadey
3.66
62.204.41.88/9vdVVVjsw/index.php
Extracted
redline
dubik
193.233.20.17:4139
-
auth_value
05136deb26ad700ca57d43b1de454f46
Extracted
asyncrat
0.5.7B
Default
100.42.65.218:8080
100.42.65.218:6606
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
winsyd.exe
-
install_folder
%AppData%
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/560-222-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1880-241-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/560-243-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
Processes:
dpj59xq.exeiKe81OG.exerrR8313.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dpj59xq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dpj59xq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rrR8313.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dpj59xq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rrR8313.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rrR8313.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rrR8313.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dpj59xq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dpj59xq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rrR8313.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-86-0x0000000000BB0000-0x0000000000BF6000-memory.dmp family_redline behavioral1/memory/1852-87-0x0000000000C00000-0x0000000000C44000-memory.dmp family_redline behavioral1/memory/1748-209-0x00000000025B0000-0x00000000025F6000-memory.dmp family_redline behavioral1/memory/884-228-0x0000000000600000-0x0000000000646000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-296-0x000000000040C71E-mapping.dmp asyncrat behavioral1/memory/1584-303-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 26 IoCs
Processes:
sZq20oQ.exestD76lr.exeiKe81OG.exeknN22Vx.exelLC28Bv.exenYV32pK.exemnolyk.exevZJ2641.exerrR8313.exenYh19Ge99.exedpj59xq.exemnolyk.exenbveek.exevrqiwirvqw.exePS.exetFS91zJ.exeeIF02Wh.exefresh.exeF981.exeuaG51Mi.exermTvK0wbpjLd5KM.exeagent.exeflk37au.exevrqiwirvqw.exenbveek.exemnolyk.exepid process 1200 sZq20oQ.exe 1196 stD76lr.exe 1268 iKe81OG.exe 572 knN22Vx.exe 1852 lLC28Bv.exe 2036 nYV32pK.exe 1044 mnolyk.exe 528 vZJ2641.exe 1308 rrR8313.exe 1892 nYh19Ge99.exe 1852 dpj59xq.exe 2004 mnolyk.exe 1628 nbveek.exe 980 vrqiwirvqw.exe 2016 PS.exe 2012 tFS91zJ.exe 1748 eIF02Wh.exe 2040 fresh.exe 560 F981.exe 884 uaG51Mi.exe 1388 rmTvK0wbpjLd5KM.exe 1880 agent.exe 1572 flk37au.exe 856 vrqiwirvqw.exe 1884 nbveek.exe 1704 mnolyk.exe -
Loads dropped DLL 64 IoCs
Processes:
file.exesZq20oQ.exestD76lr.exeknN22Vx.exelLC28Bv.exenYV32pK.exemnolyk.exenotru.exevZJ2641.exetruno.exenYh19Ge99.exelebro.exenbveek.exevrqiwirvqw.exePS.exeWerFault.exetFS91zJ.exeeIF02Wh.exefresh.exeF981.exeuaG51Mi.exermTvK0wbpjLd5KM.exeagent.exeWerFault.exeflk37au.exevrqiwirvqw.exerundll32.exepid process 1272 file.exe 1200 sZq20oQ.exe 1200 sZq20oQ.exe 1196 stD76lr.exe 1196 stD76lr.exe 1196 stD76lr.exe 572 knN22Vx.exe 1200 sZq20oQ.exe 1200 sZq20oQ.exe 1852 lLC28Bv.exe 1272 file.exe 2036 nYV32pK.exe 2036 nYV32pK.exe 1044 mnolyk.exe 580 notru.exe 528 vZJ2641.exe 528 vZJ2641.exe 1976 truno.exe 1892 nYh19Ge99.exe 1892 nYh19Ge99.exe 2040 lebro.exe 1628 nbveek.exe 1628 nbveek.exe 980 vrqiwirvqw.exe 1628 nbveek.exe 1628 nbveek.exe 2016 PS.exe 1492 WerFault.exe 1492 WerFault.exe 1492 WerFault.exe 528 vZJ2641.exe 2012 tFS91zJ.exe 1892 nYh19Ge99.exe 1892 nYh19Ge99.exe 1748 eIF02Wh.exe 1628 nbveek.exe 2040 fresh.exe 1628 nbveek.exe 1628 nbveek.exe 560 F981.exe 580 notru.exe 580 notru.exe 884 uaG51Mi.exe 1628 nbveek.exe 1628 nbveek.exe 1388 rmTvK0wbpjLd5KM.exe 1628 nbveek.exe 1628 nbveek.exe 1880 agent.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1976 truno.exe 1572 flk37au.exe 980 vrqiwirvqw.exe 856 vrqiwirvqw.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Processes:
iKe81OG.exerrR8313.exedpj59xq.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iKe81OG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rrR8313.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dpj59xq.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
file.exevZJ2641.exemnolyk.exenYh19Ge99.exesZq20oQ.exestD76lr.exetruno.exenotru.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vZJ2641.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\notru.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002051\\notru.exe" mnolyk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce nYh19Ge99.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce file.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce sZq20oQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" stD76lr.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce truno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" truno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sZq20oQ.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce stD76lr.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce notru.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce vZJ2641.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" notru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" nYh19Ge99.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\truno.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003051\\truno.exe" mnolyk.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
PS.exevrqiwirvqw.exermTvK0wbpjLd5KM.exedescription pid process target process PID 2016 set thread context of 1724 2016 PS.exe vbc.exe PID 980 set thread context of 856 980 vrqiwirvqw.exe vrqiwirvqw.exe PID 1388 set thread context of 1584 1388 rmTvK0wbpjLd5KM.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1492 2016 WerFault.exe PS.exe 1308 2040 WerFault.exe fresh.exe 1576 972 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
F981.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F981.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F981.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F981.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1812 schtasks.exe 1252 schtasks.exe 1428 schtasks.exe -
Processes:
nbveek.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 nbveek.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 nbveek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 nbveek.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 nbveek.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 nbveek.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 nbveek.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
iKe81OG.exeknN22Vx.exelLC28Bv.exerrR8313.exedpj59xq.exevbc.exetFS91zJ.exefresh.exeF981.exeeIF02Wh.exepowershell.exeuaG51Mi.exeflk37au.exevrqiwirvqw.exepid process 1268 iKe81OG.exe 1268 iKe81OG.exe 572 knN22Vx.exe 572 knN22Vx.exe 1852 lLC28Bv.exe 1852 lLC28Bv.exe 1308 rrR8313.exe 1308 rrR8313.exe 1852 dpj59xq.exe 1852 dpj59xq.exe 1724 vbc.exe 1724 vbc.exe 2012 tFS91zJ.exe 2012 tFS91zJ.exe 2040 fresh.exe 560 F981.exe 560 F981.exe 1748 eIF02Wh.exe 1748 eIF02Wh.exe 1868 powershell.exe 1204 1204 1204 1204 1204 884 uaG51Mi.exe 884 uaG51Mi.exe 1204 1204 1204 1204 1204 1204 1204 1204 1572 flk37au.exe 1572 flk37au.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 856 vrqiwirvqw.exe 856 vrqiwirvqw.exe 1204 1204 1204 1204 1204 1204 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
F981.exepid process 560 F981.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
iKe81OG.exeknN22Vx.exelLC28Bv.exerrR8313.exedpj59xq.exevbc.exeeIF02Wh.exetFS91zJ.exeuaG51Mi.exepowershell.exeflk37au.exevrqiwirvqw.exepowershell.exedescription pid process Token: SeDebugPrivilege 1268 iKe81OG.exe Token: SeDebugPrivilege 572 knN22Vx.exe Token: SeDebugPrivilege 1852 lLC28Bv.exe Token: SeDebugPrivilege 1308 rrR8313.exe Token: SeDebugPrivilege 1852 dpj59xq.exe Token: SeDebugPrivilege 1724 vbc.exe Token: SeDebugPrivilege 1748 eIF02Wh.exe Token: SeDebugPrivilege 2012 tFS91zJ.exe Token: SeDebugPrivilege 884 uaG51Mi.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeShutdownPrivilege 1204 Token: SeDebugPrivilege 1572 flk37au.exe Token: SeDebugPrivilege 856 vrqiwirvqw.exe Token: SeShutdownPrivilege 1204 Token: SeDebugPrivilege 1960 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exesZq20oQ.exestD76lr.exenYV32pK.execmd.exedescription pid process target process PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1272 wrote to memory of 1200 1272 file.exe sZq20oQ.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1200 wrote to memory of 1196 1200 sZq20oQ.exe stD76lr.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 1268 1196 stD76lr.exe iKe81OG.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1196 wrote to memory of 572 1196 stD76lr.exe knN22Vx.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1200 wrote to memory of 1852 1200 sZq20oQ.exe lLC28Bv.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 1272 wrote to memory of 2036 1272 file.exe nYV32pK.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 2036 wrote to memory of 1044 2036 nYV32pK.exe mnolyk.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1252 856 cmd.exe cmd.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 1748 856 cmd.exe cacls.exe PID 856 wrote to memory of 560 856 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000002051\notru.exe"C:\Users\Admin\AppData\Local\Temp\1000002051\notru.exe"4⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rrR8313.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rrR8313.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uaG51Mi.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uaG51Mi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000003051\truno.exe"C:\Users\Admin\AppData\Local\Temp\1000003051\truno.exe"4⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dpj59xq.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dpj59xq.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\eIF02Wh.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\eIF02Wh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\flk37au.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\flk37au.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000004001\lebro.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\lebro.exe"4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\9e0894bcc4" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\9e0894bcc4" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exe"C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exe"C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000234001\PS.exe"C:\Users\Admin\AppData\Local\Temp\1000234001\PS.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 367⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000236001\fresh.exe"C:\Users\Admin\AppData\Local\Temp\1000236001\fresh.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2040 -s 9007⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000237001\F981.exe"C:\Users\Admin\AppData\Local\Temp\1000237001\F981.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1000238001\rmTvK0wbpjLd5KM.exe"C:\Users\Admin\AppData\Local\Temp\1000238001\rmTvK0wbpjLd5KM.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LGlGutVnWHPDKx.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGlGutVnWHPDKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BF8.tmp"7⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1000239000\agent.exe"C:\Users\Admin\AppData\Roaming\1000239000\agent.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 972 -s 3448⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {26E57221-67F7-49E0-AA32-3D167198BCCB} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
4Disabling Security Tools
2Scripting
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exeFilesize
1.2MB
MD5c0c373e97dc60b98fd654d94592145b0
SHA19d9617cc0c16a46042e4ec2389765ee2363ae903
SHA25692bc7a014d1317e41e0f981bab59e42971e3c562d1f5a53ea18850d9604631ae
SHA512cdc72f3917f9c38bc334ecca55fed14d2c9a37d26d23eca2ef677fb8e1b60e3b2453036b4ea2a347316b2430039c66e690761d23cdb29b830f66abcd12adc6ba
-
C:\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exeFilesize
1.2MB
MD5c0c373e97dc60b98fd654d94592145b0
SHA19d9617cc0c16a46042e4ec2389765ee2363ae903
SHA25692bc7a014d1317e41e0f981bab59e42971e3c562d1f5a53ea18850d9604631ae
SHA512cdc72f3917f9c38bc334ecca55fed14d2c9a37d26d23eca2ef677fb8e1b60e3b2453036b4ea2a347316b2430039c66e690761d23cdb29b830f66abcd12adc6ba
-
C:\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
C:\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exeFilesize
235KB
MD5ebd584e9c1a400cd5d4bafa0e7936468
SHA1d263c62902326425ed17855d49d35003abcd797b
SHA256ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010
-
C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exeFilesize
235KB
MD5ebd584e9c1a400cd5d4bafa0e7936468
SHA1d263c62902326425ed17855d49d35003abcd797b
SHA256ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exeFilesize
516KB
MD521b3b14ce919ed630d24d39fd861e053
SHA15e185a0c2754fef6119f9770616e98db74031961
SHA256566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a
SHA512e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exeFilesize
516KB
MD521b3b14ce919ed630d24d39fd861e053
SHA15e185a0c2754fef6119f9770616e98db74031961
SHA256566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a
SHA512e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exeFilesize
202KB
MD5089817b9d2c9741d28592d50e380e6b2
SHA1a487f9325f0319c05b844b751d5cc6a571bf8d77
SHA25612578df8196fefd6f5f62a01df8682c5f26df767e68f7cbd8e07459c39ee2eb3
SHA5120bb70f03ed8b7fb96e46721b27835233f4a6a8f8e71ffc20d9327d1edfc0d00d308a11a02dcd725c458b67559db0781a5710e97fa2da077af5862eb5210fe1eb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exeFilesize
202KB
MD5089817b9d2c9741d28592d50e380e6b2
SHA1a487f9325f0319c05b844b751d5cc6a571bf8d77
SHA25612578df8196fefd6f5f62a01df8682c5f26df767e68f7cbd8e07459c39ee2eb3
SHA5120bb70f03ed8b7fb96e46721b27835233f4a6a8f8e71ffc20d9327d1edfc0d00d308a11a02dcd725c458b67559db0781a5710e97fa2da077af5862eb5210fe1eb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rrR8313.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rrR8313.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exeFilesize
202KB
MD558633c4a144d0bd5b9ff590628c487ea
SHA1dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737
SHA256ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3
SHA5127f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exeFilesize
202KB
MD558633c4a144d0bd5b9ff590628c487ea
SHA1dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737
SHA256ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3
SHA5127f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exeFilesize
175KB
MD5cddbd387c5c8bb5e8a8ad341f7d05475
SHA11ae74b1a19a38a736b5321b41de10a48ab72eddc
SHA256c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d
SHA512ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exeFilesize
175KB
MD5cddbd387c5c8bb5e8a8ad341f7d05475
SHA11ae74b1a19a38a736b5321b41de10a48ab72eddc
SHA256c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d
SHA512ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exeFilesize
175KB
MD5c9c03ec2426c8416841fd7e93bb9dc3d
SHA1fd9430cc92842d29f76a7b3169eee466f67273db
SHA25635bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be
SHA51275d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exeFilesize
175KB
MD5c9c03ec2426c8416841fd7e93bb9dc3d
SHA1fd9430cc92842d29f76a7b3169eee466f67273db
SHA25635bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be
SHA51275d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exeFilesize
372KB
MD55f5287f481c9d7361af0cd50801bed68
SHA1bfdef96de5a87584e39f2d73cc2a0445fd58fc54
SHA256d08a543b1e492dc743a2e96656108f51463e38be1de0316ab41fb6bee0cfe939
SHA512adf7e78ee9355c345e87f0a548b960956981413c02e8e3e276989d7200236bc6b1a9352f5182c735897ff7130cdf8a50b6c7f0b4b6988e58c3dc87cf6c2a9f67
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exeFilesize
372KB
MD55f5287f481c9d7361af0cd50801bed68
SHA1bfdef96de5a87584e39f2d73cc2a0445fd58fc54
SHA256d08a543b1e492dc743a2e96656108f51463e38be1de0316ab41fb6bee0cfe939
SHA512adf7e78ee9355c345e87f0a548b960956981413c02e8e3e276989d7200236bc6b1a9352f5182c735897ff7130cdf8a50b6c7f0b4b6988e58c3dc87cf6c2a9f67
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dpj59xq.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dpj59xq.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exeFilesize
1.2MB
MD5c0c373e97dc60b98fd654d94592145b0
SHA19d9617cc0c16a46042e4ec2389765ee2363ae903
SHA25692bc7a014d1317e41e0f981bab59e42971e3c562d1f5a53ea18850d9604631ae
SHA512cdc72f3917f9c38bc334ecca55fed14d2c9a37d26d23eca2ef677fb8e1b60e3b2453036b4ea2a347316b2430039c66e690761d23cdb29b830f66abcd12adc6ba
-
\Users\Admin\AppData\Local\Temp\1000233001\vrqiwirvqw.exeFilesize
1.2MB
MD5c0c373e97dc60b98fd654d94592145b0
SHA19d9617cc0c16a46042e4ec2389765ee2363ae903
SHA25692bc7a014d1317e41e0f981bab59e42971e3c562d1f5a53ea18850d9604631ae
SHA512cdc72f3917f9c38bc334ecca55fed14d2c9a37d26d23eca2ef677fb8e1b60e3b2453036b4ea2a347316b2430039c66e690761d23cdb29b830f66abcd12adc6ba
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\1000234001\PS.exeFilesize
1.2MB
MD5150ba458801a2d18480af100a61cdccc
SHA107bc99e5946f368f8f1eb3f7b360219c942fb6c9
SHA25648e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
SHA51261735c47048546d0cb4a2d51f9435cd98721b6d2f13bf9ca02df04e1b04e740eb750b294d2679734ebf6e662e213c6dc9b9819c0332beac8c01fa69f997d2ed1
-
\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exeFilesize
235KB
MD5ebd584e9c1a400cd5d4bafa0e7936468
SHA1d263c62902326425ed17855d49d35003abcd797b
SHA256ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010
-
\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exeFilesize
235KB
MD5ebd584e9c1a400cd5d4bafa0e7936468
SHA1d263c62902326425ed17855d49d35003abcd797b
SHA256ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b
SHA512e94b7bca0258e2f2fd374898c87196587311af4aa20f1197ef8d0fddcdc098fdd0096152d27b49cbe21a3527624339fe0c806c7aa4ea6c80b76764ee2245a010
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYV32pK.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exeFilesize
516KB
MD521b3b14ce919ed630d24d39fd861e053
SHA15e185a0c2754fef6119f9770616e98db74031961
SHA256566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a
SHA512e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\sZq20oQ.exeFilesize
516KB
MD521b3b14ce919ed630d24d39fd861e053
SHA15e185a0c2754fef6119f9770616e98db74031961
SHA256566b37f26d27039f83b0f379f84ba96f035d56b4e49f6366b5bca1281fefd77a
SHA512e7c40462aa5ba555dcd22ea5c772bfb7fd2abe89fe3ce8b6bd50a9c46fb290199ad449e2214b715aa59736b814f58d88c556fe4de612a4a3e531e1950bdbc190
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exeFilesize
202KB
MD5089817b9d2c9741d28592d50e380e6b2
SHA1a487f9325f0319c05b844b751d5cc6a571bf8d77
SHA25612578df8196fefd6f5f62a01df8682c5f26df767e68f7cbd8e07459c39ee2eb3
SHA5120bb70f03ed8b7fb96e46721b27835233f4a6a8f8e71ffc20d9327d1edfc0d00d308a11a02dcd725c458b67559db0781a5710e97fa2da077af5862eb5210fe1eb
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\vZJ2641.exeFilesize
202KB
MD5089817b9d2c9741d28592d50e380e6b2
SHA1a487f9325f0319c05b844b751d5cc6a571bf8d77
SHA25612578df8196fefd6f5f62a01df8682c5f26df767e68f7cbd8e07459c39ee2eb3
SHA5120bb70f03ed8b7fb96e46721b27835233f4a6a8f8e71ffc20d9327d1edfc0d00d308a11a02dcd725c458b67559db0781a5710e97fa2da077af5862eb5210fe1eb
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\lLC28Bv.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rrR8313.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exeFilesize
202KB
MD558633c4a144d0bd5b9ff590628c487ea
SHA1dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737
SHA256ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3
SHA5127f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\stD76lr.exeFilesize
202KB
MD558633c4a144d0bd5b9ff590628c487ea
SHA1dd1a1ddc9e883d1b0201aaa6c1e5bac9fbfc8737
SHA256ddb6db71a66e52519af72e9bbbe92b0ecf3ab91130c476c571f35fdc39f13ad3
SHA5127f4e6a1eb02542c492c5c2eefc0df49ae5e8438e197898ee0cd8628f297d56e1b14cc2f3c3796e4f5e9e0b2a97536146461d22a55a5c9cd8035768399da7cbc0
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exeFilesize
175KB
MD5cddbd387c5c8bb5e8a8ad341f7d05475
SHA11ae74b1a19a38a736b5321b41de10a48ab72eddc
SHA256c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d
SHA512ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\tFS91zJ.exeFilesize
175KB
MD5cddbd387c5c8bb5e8a8ad341f7d05475
SHA11ae74b1a19a38a736b5321b41de10a48ab72eddc
SHA256c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d
SHA512ce5ad725decbc063176ef313413112618506ca5863ced90beb5f59ef844d3c0b77bda05be04d1e0337731d2f2eca58f4ad98070d1aa55315879528f9be0f6a0e
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\iKe81OG.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exeFilesize
175KB
MD5c9c03ec2426c8416841fd7e93bb9dc3d
SHA1fd9430cc92842d29f76a7b3169eee466f67273db
SHA25635bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be
SHA51275d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\knN22Vx.exeFilesize
175KB
MD5c9c03ec2426c8416841fd7e93bb9dc3d
SHA1fd9430cc92842d29f76a7b3169eee466f67273db
SHA25635bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be
SHA51275d4a52cf4dcf4f43b3537344588393fbb96f9ed0173ff2981a497bd359ffba9b7fed2ba7eb2ff04341d7fa2969cc2068edee009df6e8292938e408be41d7e5a
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exeFilesize
372KB
MD55f5287f481c9d7361af0cd50801bed68
SHA1bfdef96de5a87584e39f2d73cc2a0445fd58fc54
SHA256d08a543b1e492dc743a2e96656108f51463e38be1de0316ab41fb6bee0cfe939
SHA512adf7e78ee9355c345e87f0a548b960956981413c02e8e3e276989d7200236bc6b1a9352f5182c735897ff7130cdf8a50b6c7f0b4b6988e58c3dc87cf6c2a9f67
-
\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYh19Ge99.exeFilesize
372KB
MD55f5287f481c9d7361af0cd50801bed68
SHA1bfdef96de5a87584e39f2d73cc2a0445fd58fc54
SHA256d08a543b1e492dc743a2e96656108f51463e38be1de0316ab41fb6bee0cfe939
SHA512adf7e78ee9355c345e87f0a548b960956981413c02e8e3e276989d7200236bc6b1a9352f5182c735897ff7130cdf8a50b6c7f0b4b6988e58c3dc87cf6c2a9f67
-
\Users\Admin\AppData\Local\Temp\IXP003.TMP\dpj59xq.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
\Users\Admin\AppData\Local\Temp\IXP003.TMP\eIF02Wh.exeFilesize
259KB
MD533a52fc0c3eb218fde1b039334e5f850
SHA1875b45e528e1c682257ba199db7f235f185a71a1
SHA256b652cde92a34f384214d605514ce2977fcaa8d7a336bf7c605e78fdfc023b2f6
SHA5121bcfc1c633d391d2c42910bee142291d654f6dcb48b337e123085db05f7f5f34dd85def657293af10f64853106681f8d51d38090c92ce41ac3a307c58bec68b1
-
memory/528-120-0x0000000000000000-mapping.dmp
-
memory/548-163-0x0000000000000000-mapping.dmp
-
memory/560-243-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/560-222-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/560-217-0x0000000000000000-mapping.dmp
-
memory/560-110-0x0000000000000000-mapping.dmp
-
memory/572-73-0x0000000000000000-mapping.dmp
-
memory/572-78-0x0000000000B80000-0x0000000000BB2000-memory.dmpFilesize
200KB
-
memory/856-264-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/856-266-0x0000000000417162-mapping.dmp
-
memory/856-262-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/856-272-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/856-265-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/856-259-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/856-260-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/884-233-0x0000000000700000-0x000000000072E000-memory.dmpFilesize
184KB
-
memory/884-252-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/884-224-0x0000000000000000-mapping.dmp
-
memory/884-228-0x0000000000600000-0x0000000000646000-memory.dmpFilesize
280KB
-
memory/884-234-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/884-251-0x0000000000700000-0x000000000072E000-memory.dmpFilesize
184KB
-
memory/928-116-0x0000000000000000-mapping.dmp
-
memory/972-275-0x0000000000000000-mapping.dmp
-
memory/980-256-0x00000000005A0000-0x00000000005AC000-memory.dmpFilesize
48KB
-
memory/980-169-0x0000000000000000-mapping.dmp
-
memory/980-258-0x0000000000AC0000-0x0000000000AFA000-memory.dmpFilesize
232KB
-
memory/980-174-0x0000000000CC0000-0x0000000000DFA000-memory.dmpFilesize
1.2MB
-
memory/980-175-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB
-
memory/980-257-0x0000000005470000-0x00000000054EE000-memory.dmpFilesize
504KB
-
memory/1044-100-0x0000000000000000-mapping.dmp
-
memory/1152-156-0x0000000000000000-mapping.dmp
-
memory/1152-114-0x0000000000000000-mapping.dmp
-
memory/1196-62-0x0000000000000000-mapping.dmp
-
memory/1200-56-0x0000000000000000-mapping.dmp
-
memory/1252-152-0x0000000000000000-mapping.dmp
-
memory/1252-105-0x0000000000000000-mapping.dmp
-
memory/1264-276-0x0000000000000000-mapping.dmp
-
memory/1268-68-0x0000000000000000-mapping.dmp
-
memory/1268-71-0x0000000000A60000-0x0000000000A6A000-memory.dmpFilesize
40KB
-
memory/1272-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1288-273-0x0000000000000000-mapping.dmp
-
memory/1308-242-0x0000000000000000-mapping.dmp
-
memory/1308-126-0x0000000000000000-mapping.dmp
-
memory/1308-129-0x0000000001280000-0x000000000128A000-memory.dmpFilesize
40KB
-
memory/1388-229-0x0000000000000000-mapping.dmp
-
memory/1388-255-0x0000000000A80000-0x0000000000A98000-memory.dmpFilesize
96KB
-
memory/1388-231-0x0000000000B10000-0x0000000000BA8000-memory.dmpFilesize
608KB
-
memory/1388-283-0x00000000045A0000-0x000000000460E000-memory.dmpFilesize
440KB
-
memory/1388-299-0x0000000005035000-0x0000000005046000-memory.dmpFilesize
68KB
-
memory/1388-288-0x0000000005035000-0x0000000005046000-memory.dmpFilesize
68KB
-
memory/1388-289-0x0000000004F20000-0x0000000004F34000-memory.dmpFilesize
80KB
-
memory/1428-285-0x0000000000000000-mapping.dmp
-
memory/1428-153-0x0000000000000000-mapping.dmp
-
memory/1492-195-0x0000000000000000-mapping.dmp
-
memory/1572-112-0x0000000000000000-mapping.dmp
-
memory/1572-250-0x0000000000210000-0x0000000000242000-memory.dmpFilesize
200KB
-
memory/1572-248-0x0000000000000000-mapping.dmp
-
memory/1576-278-0x0000000000000000-mapping.dmp
-
memory/1584-296-0x000000000040C71E-mapping.dmp
-
memory/1584-303-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-160-0x0000000000000000-mapping.dmp
-
memory/1628-147-0x0000000000000000-mapping.dmp
-
memory/1628-220-0x0000000000CD0000-0x0000000000CD9000-memory.dmpFilesize
36KB
-
memory/1628-244-0x0000000000CD0000-0x0000000000CD9000-memory.dmpFilesize
36KB
-
memory/1628-245-0x0000000000CD0000-0x0000000000CD9000-memory.dmpFilesize
36KB
-
memory/1628-221-0x0000000000CD0000-0x0000000000CD9000-memory.dmpFilesize
36KB
-
memory/1648-158-0x0000000000000000-mapping.dmp
-
memory/1672-166-0x0000000000000000-mapping.dmp
-
memory/1704-280-0x0000000000000000-mapping.dmp
-
memory/1724-191-0x00000000000A7F1E-mapping.dmp
-
memory/1724-192-0x0000000000090000-0x00000000000D4000-memory.dmpFilesize
272KB
-
memory/1724-193-0x0000000000090000-0x00000000000D4000-memory.dmpFilesize
272KB
-
memory/1724-183-0x0000000000090000-0x00000000000D4000-memory.dmpFilesize
272KB
-
memory/1724-186-0x0000000000090000-0x00000000000D4000-memory.dmpFilesize
272KB
-
memory/1748-107-0x0000000000000000-mapping.dmp
-
memory/1748-211-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/1748-209-0x00000000025B0000-0x00000000025F6000-memory.dmpFilesize
280KB
-
memory/1748-207-0x0000000000000000-mapping.dmp
-
memory/1748-247-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/1748-246-0x0000000000780000-0x00000000007AE000-memory.dmpFilesize
184KB
-
memory/1748-210-0x0000000000780000-0x00000000007AE000-memory.dmpFilesize
184KB
-
memory/1852-138-0x0000000000000000-mapping.dmp
-
memory/1852-88-0x0000000000690000-0x00000000006BE000-memory.dmpFilesize
184KB
-
memory/1852-81-0x0000000000000000-mapping.dmp
-
memory/1852-86-0x0000000000BB0000-0x0000000000BF6000-memory.dmpFilesize
280KB
-
memory/1852-92-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/1852-90-0x0000000000400000-0x0000000000571000-memory.dmpFilesize
1.4MB
-
memory/1852-87-0x0000000000C00000-0x0000000000C44000-memory.dmpFilesize
272KB
-
memory/1852-89-0x0000000000350000-0x000000000039B000-memory.dmpFilesize
300KB
-
memory/1852-91-0x0000000000690000-0x00000000006BE000-memory.dmpFilesize
184KB
-
memory/1852-141-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/1868-232-0x000007FEF2CD0000-0x000007FEF382D000-memory.dmpFilesize
11.4MB
-
memory/1868-236-0x000000001B740000-0x000000001BA3F000-memory.dmpFilesize
3.0MB
-
memory/1868-237-0x0000000002744000-0x0000000002747000-memory.dmpFilesize
12KB
-
memory/1868-238-0x000000000274B000-0x000000000276A000-memory.dmpFilesize
124KB
-
memory/1868-235-0x0000000002744000-0x0000000002747000-memory.dmpFilesize
12KB
-
memory/1868-227-0x000007FEF38F0000-0x000007FEF4313000-memory.dmpFilesize
10.1MB
-
memory/1868-226-0x000007FEFB621000-0x000007FEFB623000-memory.dmpFilesize
8KB
-
memory/1868-223-0x0000000000000000-mapping.dmp
-
memory/1880-239-0x0000000000000000-mapping.dmp
-
memory/1880-241-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1884-279-0x0000000000000000-mapping.dmp
-
memory/1892-132-0x0000000000000000-mapping.dmp
-
memory/1944-162-0x0000000000000000-mapping.dmp
-
memory/1960-305-0x0000000072DE0000-0x000000007338B000-memory.dmpFilesize
5.7MB
-
memory/1960-284-0x0000000000000000-mapping.dmp
-
memory/1960-304-0x0000000072DE0000-0x000000007338B000-memory.dmpFilesize
5.7MB
-
memory/2004-142-0x0000000000000000-mapping.dmp
-
memory/2012-200-0x0000000000000000-mapping.dmp
-
memory/2012-205-0x0000000000850000-0x0000000000882000-memory.dmpFilesize
200KB
-
memory/2016-178-0x0000000000000000-mapping.dmp
-
memory/2016-185-0x0000000000070000-0x00000000001A1000-memory.dmpFilesize
1.2MB
-
memory/2036-94-0x0000000000000000-mapping.dmp
-
memory/2040-213-0x000000013F650000-0x00000001403AF000-memory.dmpFilesize
13.4MB
-
memory/2040-219-0x000000013F650000-0x00000001403AF000-memory.dmpFilesize
13.4MB
-
memory/2040-253-0x000000013F650000-0x00000001403AF000-memory.dmpFilesize
13.4MB
-
memory/2040-212-0x0000000000000000-mapping.dmp