Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 08:26
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231127-en
General
-
Target
file.exe
-
Size
286KB
-
MD5
f707012619b19b4950a6972cd8cc3414
-
SHA1
0ab819984464dd4002ea4158f61f63db3051b062
-
SHA256
abbc7a5acba146ed9c9d62c148579d3690ef5571a42cd5bdc7771af67c872f36
-
SHA512
089b76321b2cd6857bcc9fbd0a8ea7e5adf9f608af347318c4ad8b536f7b3d0684ca715bf09b0da773ca5d2b22896ea04bfcb7261c24b4d7914fab9862734b6a
-
SSDEEP
3072:PuhqcpLcjWs8dmEa7rMWXAwffRJTTAF7TKx0xZz:rjWNdmT7rPD37O7Gix
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
95.214.26.17:24714
Extracted
smokeloader
summ
Extracted
smokeloader
pub1
Signatures
-
Glupteba payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/556-195-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/556-234-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4664-255-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4664-350-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3432-470-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3432-510-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3432-521-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3432-525-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Raccoon Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-488-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon behavioral2/memory/1672-490-0x0000000000400000-0x0000000000416000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4336-68-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral2/memory/4660-499-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
3FA5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3FA5.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3FA5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3FA5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3FA5.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
611C.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation 611C.exe -
Deletes itself 1 IoCs
Processes:
pid process 3364 -
Executes dropped EXE 14 IoCs
Processes:
3FA5.exe415B.exe4331.exe471A.exe56FA.exe611C.exe288c47bbc1871b439df19ff4df68f076.exeInstallSetup8.exeBroom.exe288c47bbc1871b439df19ff4df68f076.execsrss.exeinjector.exewindefender.exewindefender.exepid process 716 3FA5.exe 4756 415B.exe 4640 4331.exe 2576 471A.exe 3164 56FA.exe 2296 611C.exe 556 288c47bbc1871b439df19ff4df68f076.exe 1008 InstallSetup8.exe 5016 Broom.exe 4664 288c47bbc1871b439df19ff4df68f076.exe 3432 csrss.exe 3876 injector.exe 1812 windefender.exe 4912 windefender.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3360 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\3FA5.exe themida C:\Users\Admin\AppData\Local\Temp\3FA5.exe themida behavioral2/memory/716-46-0x0000000000150000-0x0000000000A1E000-memory.dmp themida behavioral2/memory/716-169-0x0000000000150000-0x0000000000A1E000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx behavioral2/memory/1812-516-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4912-522-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
3FA5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3FA5.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
3FA5.exepid process 716 3FA5.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
4331.exe471A.exeAddInProcess32.exedescription pid process target process PID 4640 set thread context of 4336 4640 4331.exe AppLaunch.exe PID 2576 set thread context of 4668 2576 471A.exe AddInProcess32.exe PID 2576 set thread context of 1672 2576 471A.exe AddInProcess32.exe PID 4668 set thread context of 4660 4668 AddInProcess32.exe InstallUtil.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
288c47bbc1871b439df19ff4df68f076.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe -
Drops file in Windows directory 4 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process File opened for modification C:\Windows\rss 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\rss\csrss.exe 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4276 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2300 3164 WerFault.exe 56FA.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exe415B.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 415B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 415B.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 415B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4404 schtasks.exe 864 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1372 file.exe 1372 file.exe 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3364 -
Suspicious behavior: MapViewOfSection 24 IoCs
Processes:
file.exe415B.exepid process 1372 file.exe 3364 3364 3364 3364 4756 415B.exe 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 -
Suspicious use of AdjustPrivilegeToken 61 IoCs
Processes:
471A.exeAppLaunch.exe3FA5.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exeAddInProcess32.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exeInstallUtil.exesc.exedescription pid process Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 2576 471A.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 4336 AppLaunch.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 716 3FA5.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 2256 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 556 288c47bbc1871b439df19ff4df68f076.exe Token: SeImpersonatePrivilege 556 288c47bbc1871b439df19ff4df68f076.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 4668 AddInProcess32.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 4912 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 4036 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 1772 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 1368 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 5092 powershell.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeSystemEnvironmentPrivilege 3432 csrss.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeDebugPrivilege 4660 InstallUtil.exe Token: SeSecurityPrivilege 4276 sc.exe Token: SeSecurityPrivilege 4276 sc.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 5016 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe4331.exe611C.exeInstallSetup8.exe471A.exe288c47bbc1871b439df19ff4df68f076.exedescription pid process target process PID 3364 wrote to memory of 1724 3364 regsvr32.exe PID 3364 wrote to memory of 1724 3364 regsvr32.exe PID 1724 wrote to memory of 3360 1724 regsvr32.exe regsvr32.exe PID 1724 wrote to memory of 3360 1724 regsvr32.exe regsvr32.exe PID 1724 wrote to memory of 3360 1724 regsvr32.exe regsvr32.exe PID 3364 wrote to memory of 716 3364 3FA5.exe PID 3364 wrote to memory of 716 3364 3FA5.exe PID 3364 wrote to memory of 716 3364 3FA5.exe PID 3364 wrote to memory of 4756 3364 415B.exe PID 3364 wrote to memory of 4756 3364 415B.exe PID 3364 wrote to memory of 4756 3364 415B.exe PID 3364 wrote to memory of 4640 3364 4331.exe PID 3364 wrote to memory of 4640 3364 4331.exe PID 3364 wrote to memory of 4640 3364 4331.exe PID 3364 wrote to memory of 2576 3364 471A.exe PID 3364 wrote to memory of 2576 3364 471A.exe PID 3364 wrote to memory of 2576 3364 471A.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 4640 wrote to memory of 4336 4640 4331.exe AppLaunch.exe PID 3364 wrote to memory of 3164 3364 56FA.exe PID 3364 wrote to memory of 3164 3364 56FA.exe PID 3364 wrote to memory of 3164 3364 56FA.exe PID 3364 wrote to memory of 2296 3364 611C.exe PID 3364 wrote to memory of 2296 3364 611C.exe PID 3364 wrote to memory of 2296 3364 611C.exe PID 3364 wrote to memory of 4412 3364 explorer.exe PID 3364 wrote to memory of 4412 3364 explorer.exe PID 3364 wrote to memory of 4412 3364 explorer.exe PID 3364 wrote to memory of 4412 3364 explorer.exe PID 3364 wrote to memory of 4940 3364 explorer.exe PID 3364 wrote to memory of 4940 3364 explorer.exe PID 3364 wrote to memory of 4940 3364 explorer.exe PID 2296 wrote to memory of 556 2296 611C.exe 288c47bbc1871b439df19ff4df68f076.exe PID 2296 wrote to memory of 556 2296 611C.exe 288c47bbc1871b439df19ff4df68f076.exe PID 2296 wrote to memory of 556 2296 611C.exe 288c47bbc1871b439df19ff4df68f076.exe PID 2296 wrote to memory of 1008 2296 611C.exe InstallSetup8.exe PID 2296 wrote to memory of 1008 2296 611C.exe InstallSetup8.exe PID 2296 wrote to memory of 1008 2296 611C.exe InstallSetup8.exe PID 1008 wrote to memory of 5016 1008 InstallSetup8.exe Broom.exe PID 1008 wrote to memory of 5016 1008 InstallSetup8.exe Broom.exe PID 1008 wrote to memory of 5016 1008 InstallSetup8.exe Broom.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4140 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 2576 wrote to memory of 4668 2576 471A.exe AddInProcess32.exe PID 556 wrote to memory of 2256 556 288c47bbc1871b439df19ff4df68f076.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3A64.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3A64.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3FA5.exeC:\Users\Admin\AppData\Local\Temp\3FA5.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\415B.exeC:\Users\Admin\AppData\Local\Temp\415B.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4331.exeC:\Users\Admin\AppData\Local\Temp\4331.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\471A.exeC:\Users\Admin\AppData\Local\Temp\471A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\56FA.exeC:\Users\Admin\AppData\Local\Temp\56FA.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 4642⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\611C.exeC:\Users\Admin\AppData\Local\Temp\611C.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3164 -ip 31641⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\3A64.dllFilesize
1.6MB
MD56805483db7959c39be29b74d9d69a8b8
SHA1727c095dd6b87c9f8486f37cdca8c7884a2462ce
SHA256dcc81448c6c616163d420628232cff928583f7326cbb2304e02ff236ed16f324
SHA512be15e73da0b7fcd73dbd0a07a9a744f779f2e66b5961efc5b98d6c0182188769440e54d0a6fa31d99a947978379d784630b3cd51d8077a51c9ae0e29ea59660f
-
C:\Users\Admin\AppData\Local\Temp\3A64.dllFilesize
1.6MB
MD56805483db7959c39be29b74d9d69a8b8
SHA1727c095dd6b87c9f8486f37cdca8c7884a2462ce
SHA256dcc81448c6c616163d420628232cff928583f7326cbb2304e02ff236ed16f324
SHA512be15e73da0b7fcd73dbd0a07a9a744f779f2e66b5961efc5b98d6c0182188769440e54d0a6fa31d99a947978379d784630b3cd51d8077a51c9ae0e29ea59660f
-
C:\Users\Admin\AppData\Local\Temp\3FA5.exeFilesize
3.4MB
MD58d4d05a643dbab697faa314703888b3f
SHA17e83439787a7f86015dae18900c29176a4d16064
SHA256a719b6410b2e125322b304e54d98ff5273d5e097aafce82f8acadca572d1c522
SHA512fbae5ef4278394d81cb0b31c82665fa95a4e6f5d51c125418ee81af0edcb3eca4210ec7c00820d5a1f4c54c05586257443a3511f61b486fd490e723f671d5515
-
C:\Users\Admin\AppData\Local\Temp\3FA5.exeFilesize
3.4MB
MD58d4d05a643dbab697faa314703888b3f
SHA17e83439787a7f86015dae18900c29176a4d16064
SHA256a719b6410b2e125322b304e54d98ff5273d5e097aafce82f8acadca572d1c522
SHA512fbae5ef4278394d81cb0b31c82665fa95a4e6f5d51c125418ee81af0edcb3eca4210ec7c00820d5a1f4c54c05586257443a3511f61b486fd490e723f671d5515
-
C:\Users\Admin\AppData\Local\Temp\415B.exeFilesize
257KB
MD5325278bf03baf7920c1735ec09e502a5
SHA1f04f4c8383a4f9aaf587974a68682e0b99834c64
SHA256a081845915e3b8d17cb05016977634939ab726f8965ef6764e07dd7a0fbc0f03
SHA5124f4f5974ae3919bb7fa53b8785673f93b8147619520546900f6b5f5ff812103ac8af84ce1905d8be489a43c74b6be28c04ef110e5ed2d3ee45712ae3e8c3534c
-
C:\Users\Admin\AppData\Local\Temp\415B.exeFilesize
257KB
MD5325278bf03baf7920c1735ec09e502a5
SHA1f04f4c8383a4f9aaf587974a68682e0b99834c64
SHA256a081845915e3b8d17cb05016977634939ab726f8965ef6764e07dd7a0fbc0f03
SHA5124f4f5974ae3919bb7fa53b8785673f93b8147619520546900f6b5f5ff812103ac8af84ce1905d8be489a43c74b6be28c04ef110e5ed2d3ee45712ae3e8c3534c
-
C:\Users\Admin\AppData\Local\Temp\4331.exeFilesize
403KB
MD518cf6fb3dbce88b6884d5884d98d1abf
SHA1191e57948f77f477e63561316b6072b38d2bd388
SHA256ad5e541ca9a78ca6800d6bda0b1153233ceca652d4a23ce6495d60abcc0285c0
SHA5123d72866aeeb8c834d842faf6b5e66b7b787f328c704b14aadbaa4534a290e80c391fda026fe1c998d9d867fe8747fccf23518c262da56a31ef8166389d423683
-
C:\Users\Admin\AppData\Local\Temp\4331.exeFilesize
403KB
MD518cf6fb3dbce88b6884d5884d98d1abf
SHA1191e57948f77f477e63561316b6072b38d2bd388
SHA256ad5e541ca9a78ca6800d6bda0b1153233ceca652d4a23ce6495d60abcc0285c0
SHA5123d72866aeeb8c834d842faf6b5e66b7b787f328c704b14aadbaa4534a290e80c391fda026fe1c998d9d867fe8747fccf23518c262da56a31ef8166389d423683
-
C:\Users\Admin\AppData\Local\Temp\471A.exeFilesize
994KB
MD5ec11419f39a7376980ff9ee7909c9693
SHA1047ceed2b766c9967554dad1452b8d2a09b3bbf1
SHA256b4fc379cbf4b7a0505e37567b1aac25e34fc7996248f485c977b8222a82e3d24
SHA512be286ed314b4577310bffe102f88ce38f4cf4ac49cb0c43f8a407c122603ef114a557988c15a2234fdb8c9bf9c6f72dda512da9dfd117edd94ca5d1a6c3e998e
-
C:\Users\Admin\AppData\Local\Temp\471A.exeFilesize
994KB
MD5ec11419f39a7376980ff9ee7909c9693
SHA1047ceed2b766c9967554dad1452b8d2a09b3bbf1
SHA256b4fc379cbf4b7a0505e37567b1aac25e34fc7996248f485c977b8222a82e3d24
SHA512be286ed314b4577310bffe102f88ce38f4cf4ac49cb0c43f8a407c122603ef114a557988c15a2234fdb8c9bf9c6f72dda512da9dfd117edd94ca5d1a6c3e998e
-
C:\Users\Admin\AppData\Local\Temp\56FA.exeFilesize
286KB
MD5b845c9bdd77e98d8485f63bb02f50a52
SHA1916afd9009a03fba9ff6268625bfc4931eb12a40
SHA2565403f95af408fa9700a1a9a949adba33947f3b1a036941f3dedabe2fb8819662
SHA512f7df998038cb5f0cce25ead5e74e9ee423d55cabc492bef67e2aa5dcdc15a7ea036403648e7d8e00f96525d5ff6242c6a07d5bd41162248adbbfa8a6fd6de560
-
C:\Users\Admin\AppData\Local\Temp\56FA.exeFilesize
286KB
MD5b845c9bdd77e98d8485f63bb02f50a52
SHA1916afd9009a03fba9ff6268625bfc4931eb12a40
SHA2565403f95af408fa9700a1a9a949adba33947f3b1a036941f3dedabe2fb8819662
SHA512f7df998038cb5f0cce25ead5e74e9ee423d55cabc492bef67e2aa5dcdc15a7ea036403648e7d8e00f96525d5ff6242c6a07d5bd41162248adbbfa8a6fd6de560
-
C:\Users\Admin\AppData\Local\Temp\611C.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\611C.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ij2xs0mq.dja.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Roaming\srbwcrvFilesize
257KB
MD5325278bf03baf7920c1735ec09e502a5
SHA1f04f4c8383a4f9aaf587974a68682e0b99834c64
SHA256a081845915e3b8d17cb05016977634939ab726f8965ef6764e07dd7a0fbc0f03
SHA5124f4f5974ae3919bb7fa53b8785673f93b8147619520546900f6b5f5ff812103ac8af84ce1905d8be489a43c74b6be28c04ef110e5ed2d3ee45712ae3e8c3534c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57af1d897bcb356b77eb0129012f199ff
SHA18725f1af4213267f89de91f316889db182973535
SHA2562cce7006e476564f4dfbfeaa6a24cb527baeb237457bdfc1625479805cb92dfd
SHA512d1c476a6c9184c199fc0a810808c1e4c3c43387623dd715057fba6fa00ce329cbe577a4e6704678175fc1f878ceda301f98f236b7993f3c6f931c9c733876ed9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a8c2c5672cfe68010081f8187a23c10f
SHA1c98dec14b5809327bc4ce89a17e677a250014a67
SHA2562a184eb6d238dc282528584965d0121b42d05e25dd3d8717f2a990c661b868a7
SHA5120113e8b1750765a175d182ba821fc4282985c759587fba74f63ffd3751f3748e11dd46cbfb8ffef451e220baa72b8e02efa50723fba2263230f6f5a94a2e9b16
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD536b64b9846080b84a079e8eeb11d3d75
SHA1ce640399565592ccf9433121d4b759cc746090b7
SHA2567336a3005ece37460e5d598570645ad60763973b6233f42a5947a07970d23d55
SHA51299fd2a7a9121dd1f2d9e855e55759703476a0f18c8f8be4901870e5c87c1ab3a79b8368f475356a9a4bcae3fa899496887b09f588faa84a10201f4e8567d5a91
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD515229c5ff50bfb84470816c483fae425
SHA1c4486b91fe8f1fdec7f2f545f30016c2e501ccaa
SHA256146c6fa74d11fae8899b0e68f85d1bf1f8cfaa34bc35bba33ade1b1721e56256
SHA512e23f212af23ff5d6bbe9cdb0b7d7ed5753f1520f68ab562c816294cccfb342f0582cf695c163680d5de35ac2ad204f01d55ca55cd58ed4336464908704de7631
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD555980b59a2ddcae8729b2dac8d9a81ec
SHA1035a9c84e2fa0853a51dcfa5eb0a72893a23d63c
SHA2561bdd8068c937e0f3863cba1ae099ef4206f2d54198550864e19f9a3aa1a25d2c
SHA5128779aab7719849db01434f9ced5bca997cf9d67fe3ff174410239f6f31a7aecb552aea742e32138a165ecf6b2625c5047065cec5ed763258340980824b8cf112
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/556-173-0x0000000002A00000-0x0000000002DFD000-memory.dmpFilesize
4.0MB
-
memory/556-195-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/556-234-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/716-34-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-142-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-65-0x0000000008300000-0x000000000834C000-memory.dmpFilesize
304KB
-
memory/716-63-0x0000000007B40000-0x0000000007B52000-memory.dmpFilesize
72KB
-
memory/716-160-0x0000000009240000-0x0000000009290000-memory.dmpFilesize
320KB
-
memory/716-46-0x0000000000150000-0x0000000000A1E000-memory.dmpFilesize
8.8MB
-
memory/716-161-0x000000000A110000-0x000000000A2D2000-memory.dmpFilesize
1.8MB
-
memory/716-162-0x000000000A810000-0x000000000AD3C000-memory.dmpFilesize
5.2MB
-
memory/716-43-0x0000000077DB4000-0x0000000077DB6000-memory.dmpFilesize
8KB
-
memory/716-37-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-169-0x0000000000150000-0x0000000000A1E000-memory.dmpFilesize
8.8MB
-
memory/716-39-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-170-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-54-0x00000000078A0000-0x0000000007932000-memory.dmpFilesize
584KB
-
memory/716-41-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-152-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-151-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-62-0x0000000007C10000-0x0000000007D1A000-memory.dmpFilesize
1.0MB
-
memory/716-149-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-53-0x0000000007D50000-0x00000000082F4000-memory.dmpFilesize
5.6MB
-
memory/716-27-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-33-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-97-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/716-60-0x0000000008920000-0x0000000008F38000-memory.dmpFilesize
6.1MB
-
memory/716-32-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-120-0x0000000000150000-0x0000000000A1E000-memory.dmpFilesize
8.8MB
-
memory/716-26-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-25-0x0000000000150000-0x0000000000A1E000-memory.dmpFilesize
8.8MB
-
memory/716-135-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-64-0x0000000007BA0000-0x0000000007BDC000-memory.dmpFilesize
240KB
-
memory/716-124-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/716-58-0x0000000007A60000-0x0000000007A6A000-memory.dmpFilesize
40KB
-
memory/716-130-0x0000000076D90000-0x0000000076E80000-memory.dmpFilesize
960KB
-
memory/1164-359-0x00000000005B0000-0x00000000005BF000-memory.dmpFilesize
60KB
-
memory/1372-1-0x0000000002C20000-0x0000000002D20000-memory.dmpFilesize
1024KB
-
memory/1372-8-0x0000000004800000-0x000000000480B000-memory.dmpFilesize
44KB
-
memory/1372-3-0x0000000000400000-0x0000000002ABE000-memory.dmpFilesize
38.7MB
-
memory/1372-2-0x0000000004800000-0x000000000480B000-memory.dmpFilesize
44KB
-
memory/1372-5-0x0000000000400000-0x0000000002ABE000-memory.dmpFilesize
38.7MB
-
memory/1428-362-0x0000000000600000-0x0000000000609000-memory.dmpFilesize
36KB
-
memory/1576-380-0x0000000000520000-0x000000000052B000-memory.dmpFilesize
44KB
-
memory/1672-490-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1672-488-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1812-516-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1884-369-0x0000000000630000-0x0000000000657000-memory.dmpFilesize
156KB
-
memory/2204-365-0x0000000000410000-0x000000000041C000-memory.dmpFilesize
48KB
-
memory/2296-138-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/2296-81-0x0000000000820000-0x0000000000E94000-memory.dmpFilesize
6.5MB
-
memory/2296-82-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/2576-56-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/2576-55-0x00000000055A0000-0x000000000563C000-memory.dmpFilesize
624KB
-
memory/2576-156-0x0000000004CE0000-0x0000000004CE6000-memory.dmpFilesize
24KB
-
memory/2576-155-0x0000000004CC0000-0x0000000004CDA000-memory.dmpFilesize
104KB
-
memory/2576-164-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/2576-91-0x0000000007700000-0x0000000007740000-memory.dmpFilesize
256KB
-
memory/2576-51-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/2576-52-0x0000000000A70000-0x0000000000B6E000-memory.dmpFilesize
1016KB
-
memory/3164-154-0x0000000002D20000-0x0000000002D2B000-memory.dmpFilesize
44KB
-
memory/3164-153-0x0000000002DA0000-0x0000000002EA0000-memory.dmpFilesize
1024KB
-
memory/3164-157-0x0000000000400000-0x0000000002ABE000-memory.dmpFilesize
38.7MB
-
memory/3176-372-0x0000000001240000-0x0000000001249000-memory.dmpFilesize
36KB
-
memory/3360-18-0x0000000000AB0000-0x0000000000AB6000-memory.dmpFilesize
24KB
-
memory/3360-19-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3360-59-0x0000000002A00000-0x0000000002B09000-memory.dmpFilesize
1.0MB
-
memory/3360-70-0x0000000002A00000-0x0000000002B09000-memory.dmpFilesize
1.0MB
-
memory/3360-66-0x0000000002A00000-0x0000000002B09000-memory.dmpFilesize
1.0MB
-
memory/3360-67-0x0000000002A00000-0x0000000002B09000-memory.dmpFilesize
1.0MB
-
memory/3360-57-0x00000000028D0000-0x00000000029F6000-memory.dmpFilesize
1.1MB
-
memory/3364-145-0x0000000007960000-0x0000000007976000-memory.dmpFilesize
88KB
-
memory/3364-4-0x0000000003010000-0x0000000003026000-memory.dmpFilesize
88KB
-
memory/3432-510-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3432-470-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3432-521-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3432-525-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3924-400-0x0000000000B10000-0x0000000000B1D000-memory.dmpFilesize
52KB
-
memory/4336-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4336-69-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/4336-166-0x0000000074E90000-0x0000000075640000-memory.dmpFilesize
7.7MB
-
memory/4336-75-0x0000000007B40000-0x0000000007B50000-memory.dmpFilesize
64KB
-
memory/4412-86-0x00000000010B0000-0x000000000111B000-memory.dmpFilesize
428KB
-
memory/4412-89-0x00000000010B0000-0x000000000111B000-memory.dmpFilesize
428KB
-
memory/4412-90-0x0000000001120000-0x00000000011A0000-memory.dmpFilesize
512KB
-
memory/4412-146-0x00000000010B0000-0x000000000111B000-memory.dmpFilesize
428KB
-
memory/4660-499-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4664-350-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4664-255-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4668-269-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/4668-268-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/4724-357-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/4756-85-0x0000000000990000-0x0000000000A90000-memory.dmpFilesize
1024KB
-
memory/4756-87-0x0000000000930000-0x0000000000939000-memory.dmpFilesize
36KB
-
memory/4756-88-0x0000000000400000-0x00000000007C9000-memory.dmpFilesize
3.8MB
-
memory/4756-148-0x0000000000400000-0x00000000007C9000-memory.dmpFilesize
3.8MB
-
memory/4912-522-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4940-96-0x0000000000B80000-0x0000000000B8C000-memory.dmpFilesize
48KB
-
memory/4940-127-0x0000000000B80000-0x0000000000B8C000-memory.dmpFilesize
48KB
-
memory/5016-235-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/5016-143-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/5016-197-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/5016-172-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB