Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
14-08-2023 13:50
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v2004-20230703-en
General
-
Target
Fast.exe
-
Size
850KB
-
MD5
f92744c70ebb0649cf37b58519426a33
-
SHA1
789829f5b83e1bdb0d6b00996027dd146668204d
-
SHA256
5c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
-
SHA512
f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
SSDEEP
12288:BMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Kff4ggUj:BnsJ39LyjbJkQFMhmC+6GD984ggE
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta \Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta C:\ProgramData\Synaptics\Synaptics.exe family_neshta C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta \Users\Admin\AppData\Local\Temp\._cache_Fast.exe family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta C:\ProgramData\Synaptics\Synaptics.exe family_neshta behavioral1/memory/2616-100-0x0000000000400000-0x00000000004DA000-memory.dmp family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta C:\ProgramData\Synaptics\Synaptics.exe family_neshta \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_neshta C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_neshta \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_neshta C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_neshta \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_neshta C:\Windows\svchost.com family_neshta C:\Windows\svchost.com family_neshta C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe family_neshta C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe family_neshta behavioral1/memory/2780-131-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE family_neshta C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE family_neshta C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE family_neshta C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE family_neshta C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE family_neshta C:\PROGRA~2\MICROS~1\Office14\OIS.EXE family_neshta C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE family_neshta C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE family_neshta C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta behavioral1/memory/1636-456-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-468-0x0000000000400000-0x00000000004DA000-memory.dmp family_neshta behavioral1/memory/2168-469-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-993-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-1080-0x0000000000400000-0x00000000004DA000-memory.dmp family_neshta behavioral1/memory/2168-1249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-2206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-2344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE family_neshta C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE family_neshta C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta \ProgramData\Synaptics\Synaptics.exe family_neshta C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE family_neshta C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE family_neshta C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE family_neshta behavioral1/memory/1636-3258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-3397-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-4858-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-5169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-7506-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-7807-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-9060-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-9315-0x0000000000400000-0x00000000004DA000-memory.dmp family_neshta behavioral1/memory/2168-9457-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-10450-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-11078-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2516 bcdedit.exe 2876 bcdedit.exe 2240 bcdedit.exe 368 bcdedit.exe -
Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 212 wbadmin.exe 1372 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
Processes:
._cache_Fast.exepid process 1208 ._cache_Fast.exe -
Drops startup file 3 IoCs
Processes:
._cache_Fast.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\._cache_Fast.exe ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ._cache_Fast.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe -
Executes dropped EXE 7 IoCs
Processes:
._cache_Fast.exe._cache_Fast.exe._cache_Fast.exeSynaptics.exe._cache_Synaptics.exesvchost.com_CACHE~2.EXEpid process 1636 ._cache_Fast.exe 1208 ._cache_Fast.exe 1760 ._cache_Fast.exe 2836 Synaptics.exe 2168 ._cache_Synaptics.exe 2780 svchost.com 2804 _CACHE~2.EXE -
Loads dropped DLL 31 IoCs
Processes:
Fast.exe._cache_Fast.exeSynaptics.exe._cache_Synaptics.exesvchost.comMsiExec.exeMsiExec.exepid process 2616 Fast.exe 2616 Fast.exe 1636 ._cache_Fast.exe 1636 ._cache_Fast.exe 1636 ._cache_Fast.exe 2616 Fast.exe 2616 Fast.exe 2836 Synaptics.exe 2836 Synaptics.exe 2836 Synaptics.exe 2168 ._cache_Synaptics.exe 2780 svchost.com 2780 svchost.com 2168 ._cache_Synaptics.exe 1636 ._cache_Fast.exe 2168 ._cache_Synaptics.exe 1636 ._cache_Fast.exe 2168 ._cache_Synaptics.exe 1636 ._cache_Fast.exe 2168 ._cache_Synaptics.exe 2168 ._cache_Synaptics.exe 1636 ._cache_Fast.exe 1636 ._cache_Fast.exe 2668 MsiExec.exe 2668 MsiExec.exe 2668 MsiExec.exe 2668 MsiExec.exe 2668 MsiExec.exe 2668 MsiExec.exe 2668 MsiExec.exe 2516 MsiExec.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
._cache_Fast.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache_Fast.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
._cache_Fast.exeFast.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\._cache_Fast = "C:\\Users\\Admin\\AppData\\Local\\._cache_Fast.exe" ._cache_Fast.exe Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\._cache_Fast = "C:\\Users\\Admin\\AppData\\Local\\._cache_Fast.exe" ._cache_Fast.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" Fast.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
._cache_Fast.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Links\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SC4YZU9D\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUOXOBJ1\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Music\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\N5KY6H72\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XB53WMX1\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DAORQ30F\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Music\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files (x86)\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Documents\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini ._cache_Fast.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ._cache_Fast.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FH0I90TM\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ._cache_Fast.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-722410544-1258951091-1992882075-1000\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZX8XU28O\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini ._cache_Fast.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ._cache_Fast.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
._cache_Fast.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03470_.WMF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll ._cache_Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE.HXS.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll ._cache_Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar ._cache_Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar ._cache_Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar ._cache_Fast.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34B.GIF ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT ._cache_Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll ._cache_Fast.exe File opened for modification C:\Program Files\Windows Media Player\Skins\Revert.wmz ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115841.GIF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME55.CSS ._cache_Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3F.GIF ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47B.GIF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS_DocLib.ico.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0228823.WMF.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL ._cache_Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_COL.HXT.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js ._cache_Fast.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABMASK.BMP.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll ._cache_Fast.exe File created C:\Program Files\7-Zip\Lang\ko.txt.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF ._cache_Fast.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00466_.WMF ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.POC ._cache_Fast.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar ._cache_Fast.exe File opened for modification C:\Program Files\Java\jre7\bin\gstreamer-lite.dll ._cache_Fast.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG ._cache_Fast.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js ._cache_Fast.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LOOKUP.DAT ._cache_Fast.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.id[3EA108D2-2939].[[email protected]].faust ._cache_Fast.exe -
Drops file in Windows directory 18 IoCs
Processes:
svchost.commsiexec.exe._cache_Synaptics.exe._cache_Fast.exedescription ioc process File opened for modification C:\Windows\svchost.com svchost.com File created C:\Windows\Installer\f7772ef.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI79A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8C01.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI93EE.tmp msiexec.exe File opened for modification C:\Windows\Installer\f7772f2.ipi msiexec.exe File opened for modification C:\Windows\Installer\f7772ef.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI82AA.tmp msiexec.exe File created C:\Windows\Installer\f7772f2.ipi msiexec.exe File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\Installer\MSI8B34.tmp msiexec.exe File opened for modification C:\Windows\svchost.com ._cache_Fast.exe File opened for modification C:\Windows\Installer\MSI7DD8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FCC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89EC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B74.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2044 vssadmin.exe 1896 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 21 IoCs
Processes:
msiexec.exe._cache_Fast.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb open \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache_Fast.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler\ = "{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb edit \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon\ = "\"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
._cache_Fast.exepid process 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe 1208 ._cache_Fast.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
._cache_Fast.exevssvc.exeWMIC.exewbengine.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1208 ._cache_Fast.exe Token: SeBackupPrivilege 1568 vssvc.exe Token: SeRestorePrivilege 1568 vssvc.exe Token: SeAuditPrivilege 1568 vssvc.exe Token: SeIncreaseQuotaPrivilege 2736 WMIC.exe Token: SeSecurityPrivilege 2736 WMIC.exe Token: SeTakeOwnershipPrivilege 2736 WMIC.exe Token: SeLoadDriverPrivilege 2736 WMIC.exe Token: SeSystemProfilePrivilege 2736 WMIC.exe Token: SeSystemtimePrivilege 2736 WMIC.exe Token: SeProfSingleProcessPrivilege 2736 WMIC.exe Token: SeIncBasePriorityPrivilege 2736 WMIC.exe Token: SeCreatePagefilePrivilege 2736 WMIC.exe Token: SeBackupPrivilege 2736 WMIC.exe Token: SeRestorePrivilege 2736 WMIC.exe Token: SeShutdownPrivilege 2736 WMIC.exe Token: SeDebugPrivilege 2736 WMIC.exe Token: SeSystemEnvironmentPrivilege 2736 WMIC.exe Token: SeRemoteShutdownPrivilege 2736 WMIC.exe Token: SeUndockPrivilege 2736 WMIC.exe Token: SeManageVolumePrivilege 2736 WMIC.exe Token: 33 2736 WMIC.exe Token: 34 2736 WMIC.exe Token: 35 2736 WMIC.exe Token: SeIncreaseQuotaPrivilege 2736 WMIC.exe Token: SeSecurityPrivilege 2736 WMIC.exe Token: SeTakeOwnershipPrivilege 2736 WMIC.exe Token: SeLoadDriverPrivilege 2736 WMIC.exe Token: SeSystemProfilePrivilege 2736 WMIC.exe Token: SeSystemtimePrivilege 2736 WMIC.exe Token: SeProfSingleProcessPrivilege 2736 WMIC.exe Token: SeIncBasePriorityPrivilege 2736 WMIC.exe Token: SeCreatePagefilePrivilege 2736 WMIC.exe Token: SeBackupPrivilege 2736 WMIC.exe Token: SeRestorePrivilege 2736 WMIC.exe Token: SeShutdownPrivilege 2736 WMIC.exe Token: SeDebugPrivilege 2736 WMIC.exe Token: SeSystemEnvironmentPrivilege 2736 WMIC.exe Token: SeRemoteShutdownPrivilege 2736 WMIC.exe Token: SeUndockPrivilege 2736 WMIC.exe Token: SeManageVolumePrivilege 2736 WMIC.exe Token: 33 2736 WMIC.exe Token: 34 2736 WMIC.exe Token: 35 2736 WMIC.exe Token: SeBackupPrivilege 888 wbengine.exe Token: SeRestorePrivilege 888 wbengine.exe Token: SeSecurityPrivilege 888 wbengine.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeSecurityPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe Token: SeRestorePrivilege 1912 msiexec.exe Token: SeTakeOwnershipPrivilege 1912 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Fast.exe._cache_Fast.exeSynaptics.exe._cache_Synaptics.exesvchost.com._cache_Fast.execmd.execmd.exemsiexec.exedescription pid process target process PID 2616 wrote to memory of 1636 2616 Fast.exe ._cache_Fast.exe PID 2616 wrote to memory of 1636 2616 Fast.exe ._cache_Fast.exe PID 2616 wrote to memory of 1636 2616 Fast.exe ._cache_Fast.exe PID 2616 wrote to memory of 1636 2616 Fast.exe ._cache_Fast.exe PID 1636 wrote to memory of 1208 1636 ._cache_Fast.exe ._cache_Fast.exe PID 1636 wrote to memory of 1208 1636 ._cache_Fast.exe ._cache_Fast.exe PID 1636 wrote to memory of 1208 1636 ._cache_Fast.exe ._cache_Fast.exe PID 1636 wrote to memory of 1208 1636 ._cache_Fast.exe ._cache_Fast.exe PID 2616 wrote to memory of 2836 2616 Fast.exe Synaptics.exe PID 2616 wrote to memory of 2836 2616 Fast.exe Synaptics.exe PID 2616 wrote to memory of 2836 2616 Fast.exe Synaptics.exe PID 2616 wrote to memory of 2836 2616 Fast.exe Synaptics.exe PID 2836 wrote to memory of 2168 2836 Synaptics.exe ._cache_Synaptics.exe PID 2836 wrote to memory of 2168 2836 Synaptics.exe ._cache_Synaptics.exe PID 2836 wrote to memory of 2168 2836 Synaptics.exe ._cache_Synaptics.exe PID 2836 wrote to memory of 2168 2836 Synaptics.exe ._cache_Synaptics.exe PID 2168 wrote to memory of 2780 2168 ._cache_Synaptics.exe svchost.com PID 2168 wrote to memory of 2780 2168 ._cache_Synaptics.exe svchost.com PID 2168 wrote to memory of 2780 2168 ._cache_Synaptics.exe svchost.com PID 2168 wrote to memory of 2780 2168 ._cache_Synaptics.exe svchost.com PID 2780 wrote to memory of 2804 2780 svchost.com _CACHE~2.EXE PID 2780 wrote to memory of 2804 2780 svchost.com _CACHE~2.EXE PID 2780 wrote to memory of 2804 2780 svchost.com _CACHE~2.EXE PID 2780 wrote to memory of 2804 2780 svchost.com _CACHE~2.EXE PID 1208 wrote to memory of 2920 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2920 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2920 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2920 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2952 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2952 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2952 1208 ._cache_Fast.exe cmd.exe PID 1208 wrote to memory of 2952 1208 ._cache_Fast.exe cmd.exe PID 2920 wrote to memory of 1556 2920 cmd.exe netsh.exe PID 2920 wrote to memory of 1556 2920 cmd.exe netsh.exe PID 2920 wrote to memory of 1556 2920 cmd.exe netsh.exe PID 2952 wrote to memory of 2044 2952 cmd.exe vssadmin.exe PID 2952 wrote to memory of 2044 2952 cmd.exe vssadmin.exe PID 2952 wrote to memory of 2044 2952 cmd.exe vssadmin.exe PID 2920 wrote to memory of 2004 2920 cmd.exe netsh.exe PID 2920 wrote to memory of 2004 2920 cmd.exe netsh.exe PID 2920 wrote to memory of 2004 2920 cmd.exe netsh.exe PID 2952 wrote to memory of 2736 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2736 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2736 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2516 2952 cmd.exe MsiExec.exe PID 2952 wrote to memory of 2516 2952 cmd.exe MsiExec.exe PID 2952 wrote to memory of 2516 2952 cmd.exe MsiExec.exe PID 2952 wrote to memory of 2876 2952 cmd.exe bcdedit.exe PID 2952 wrote to memory of 2876 2952 cmd.exe bcdedit.exe PID 2952 wrote to memory of 2876 2952 cmd.exe bcdedit.exe PID 2952 wrote to memory of 212 2952 cmd.exe wbadmin.exe PID 2952 wrote to memory of 212 2952 cmd.exe wbadmin.exe PID 2952 wrote to memory of 212 2952 cmd.exe wbadmin.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2668 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2516 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2516 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2516 1912 msiexec.exe MsiExec.exe PID 1912 wrote to memory of 2516 1912 msiexec.exe MsiExec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fast.exe"C:\Users\Admin\AppData\Local\Temp\Fast.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exe"3⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off5⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate5⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91D0315E8EDB71208903BB5EDC29F8952⤵
- Loads dropped DLL
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 1C7151A12418D9AD18C7A8A7DC81B18C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXEFilesize
859KB
MD502ee6a3424782531461fb2f10713d3c1
SHA1b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA5126c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
-
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exeFilesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exeFilesize
186KB
MD558b58875a50a0d8b5e7be7d6ac685164
SHA11e0b89c1b2585c76e758e9141b846ed4477b0662
SHA2562a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b
-
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exeFilesize
1.1MB
MD5566ed4f62fdc96f175afedd811fa0370
SHA1d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[3EA108D2-2939].[[email protected]].faustFilesize
189.5MB
MD5ca0d0b1975d290f1fd80ca19f0e97550
SHA1874e4c34e89ad3ebbc6296651dee3cb6b54864fa
SHA2567f5ee7c3b46a75d0b699868c8728cd052312331e3bd80bd2ecb053049488a9b2
SHA5125d142daf41d0d71d2e585be50f2669f2a70807e88b190e5d1838db1a542b391ab8c61bbcdf5ad89022a48bffb1c8a5094eaffa00daa0bc42b164c7867aa8d986
-
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXEFilesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXEFilesize
503KB
MD53f67da7e800cd5b4af2283a9d74d2808
SHA1f9288d052b20a9f4527e5a0f87f4249f5e4440f7
SHA25631c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711
SHA5126a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3
-
C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXEFilesize
230KB
MD5e5589ec1e4edb74cc7facdaac2acabfd
SHA19b12220318e848ed87bb7604d6f6f5df5dbc6b3f
SHA2566ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67
SHA512f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a
-
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXEFilesize
439KB
MD5aeabfeadb5daab870181ab5f116ee7f4
SHA1118a78ea4cc974e2dbff3f2d196d6ea7abe6131c
SHA2560d3a6a82ee7544cb90f80b8be53b924d61a8397c2952603a37739e9b9a0abf9a
SHA5125ce1473bd8e62712f10e5d69b7ecd91bec9a2fc18e801ffc0aa66ef7ea089680339c0e8f130ac2a78210d901391a58f86629b279693142f91edde4d6b866a6c3
-
C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXEFilesize
188KB
MD592ee5c55aca684cd07ed37b62348cd4e
SHA16534d1bc8552659f19bcc0faaa273af54a7ae54b
SHA256bee98e2150e02ad6259184a35e02e75df96291960032b3085535fb0f1f282531
SHA512fc9f4569a5f3de81d6a490f0fff4765698cdc891933979a3ce661a6291b606630a0c2b15647fc661109fcea466c7a78552b9cfbca6c5b2079ea1632a9f1b6e22
-
C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXEFilesize
150KB
MD5946b2d8f68ca1c24ed6ee4118c78c17b
SHA1bf60e7c43f7bdab08b6102cf701ae97ad6c09d3f
SHA25665353203a36f2ddb752ba64468fe30b903fa4f2225db835a6e6f92cf52e53d8d
SHA512432d592817d0e16fb35bdd0af9a0e7850c889a654f5faee4703d16b64d754e205cad5cb8d17028e6af164a937a950652944558e563b206bc23bc8917c515964c
-
C:\PROGRA~2\MICROS~1\Office14\OIS.EXEFilesize
308KB
MD54545e2b5fa4062259d5ddd56ecbbd386
SHA1c021dc8488a73bd364cb98758559fe7ba1337263
SHA256318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8
SHA512cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1
-
C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXEFilesize
1.4MB
MD55ae9c0c497949584ffa06f028a6605ab
SHA1eb24dbd3c8952ee20411691326d650f98d24e992
SHA25607dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e
SHA5122e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788
-
C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXEFilesize
674KB
MD597510a7d9bf0811a6ea89fad85a9f3f3
SHA12ac0c49b66a92789be65580a38ae9798237711db
SHA256c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA5122a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
-
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXEFilesize
495KB
MD59597098cfbc45fae685d9480d135ed13
SHA184401f03a7942a7e4fcd26e4414b227edd9b0f09
SHA25645966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
SHA51216afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
C:\Users\ALLUSE~1\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXEFilesize
485KB
MD586749cd13537a694795be5d87ef7106d
SHA1538030845680a8be8219618daee29e368dc1e06c
SHA2568c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
SHA5127b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c
-
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXEFilesize
674KB
MD597510a7d9bf0811a6ea89fad85a9f3f3
SHA12ac0c49b66a92789be65580a38ae9798237711db
SHA256c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA5122a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
-
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXEFilesize
674KB
MD59c10a5ec52c145d340df7eafdb69c478
SHA157f3d99e41d123ad5f185fc21454367a7285db42
SHA256ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
SHA5122704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f
-
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXEFilesize
495KB
MD59597098cfbc45fae685d9480d135ed13
SHA184401f03a7942a7e4fcd26e4414b227edd9b0f09
SHA25645966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
SHA51216afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164
-
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXEFilesize
485KB
MD587f15006aea3b4433e226882a56f188d
SHA1e3ad6beb8229af62b0824151dbf546c0506d4f65
SHA2568d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
SHA512b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1
-
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXEFilesize
495KB
MD507e194ce831b1846111eb6c8b176c86e
SHA1b9c83ec3b0949cb661878fb1a8b43a073e15baf1
SHA256d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
SHA51255f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5
-
C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
C:\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
C:\Windows\Installer\MSI79A3.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
C:\Windows\Installer\MSI7DD8.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI7FCC.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI8C01.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\svchost.comFilesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
C:\Windows\svchost.comFilesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
C:\info.htaFilesize
5KB
MD5ba5a47d09f6154cc7cebbcb9229864fe
SHA1373ffbd8f7ebfd6741b4249b9e822839274edd7d
SHA2561db7c18df8d1d0c8a0eeac2c6c75fdd568569d8dea0d95e24ed185f1ba9be324
SHA5123b87b5f495d4a6db50978ecce77dccfd609f90bda43d43d4cf01c27a1fe46ae216e5e09bee459f96d65dda66991a9fb282c3e542fc4dbe485276c07fca027b1e
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\ProgramData\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\ProgramData\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\ProgramData\Synaptics\Synaptics.exeFilesize
850KB
MD5f92744c70ebb0649cf37b58519426a33
SHA1789829f5b83e1bdb0d6b00996027dd146668204d
SHA2565c14908448ae75ccb33e9094d0b06f238c69a2d3e8aab66e21da91706bc00dc4
SHA512f11be0173f6d4ec930822943b6a696562e7cf583052e92b1ed508e4d66a0088ed0a1b6afd80638aab7287bcb5286c767590f58f2da941545fe1505d71bbeba4e
-
\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\._cache_Fast.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
96KB
MD51242872b9de9fe8b0fa75c19a97aa626
SHA16b6b111d67c4f156b851a2b4a5ba1d578ca2d38b
SHA256e68877f0971799322f31cfb01531d99e303edb981b96767765d5766d75817e0e
SHA512a8ce0cd60f5657567065ab8f569bcb95e6a936f380e7087cf98c37d5e63a71acb79e5cc8e0fc74e8dcca69d1ff34d72761790a9d7260bbff96d2601f3d5b36fc
-
\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Users\Admin\AppData\Local\Temp\3582-490\._cache_Fast.exeFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\_CACHE~1.EXEFilesize
56KB
MD5c0edb05bd1e26666764757e7d6f6f09b
SHA1330139df4594f4070ada6c89ec3d0a16abe14497
SHA256c29630324d768c6e40b814164f6c2c6f33dd741392edc940cc852e67e1667a57
SHA512f172c38d5d169523c56d5c551749c9b8bf6d1452b0c64666651757f46546ffe8bd445935b88faf16dc381a13a6b12a71934fef6c9fa434ee5974d0d3499d1790
-
\Windows\Installer\MSI79A3.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
\Windows\Installer\MSI7DD8.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
memory/1636-12941-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-14056-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-7506-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-14060-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-456-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-4858-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-14034-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-9060-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-3258-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-993-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-10450-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1636-2206-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-2344-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-14036-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-14061-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-5169-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-14058-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-7807-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-469-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-3397-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-9457-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-13302-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-11078-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2168-1249-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2616-100-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2616-54-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2780-131-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2836-1080-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2836-470-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2836-14035-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2836-9315-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2836-101-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2836-468-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB