Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
04-03-2024 04:47
General
-
Target
07de6b1da0e53803c51e9babbc0b043d328883a56059d659f4e08df98c9fde8a.exe
-
Size
1.8MB
-
MD5
0baddc413a020a4ed2a80a34d29532d5
-
SHA1
4c147c00fd784e203d9f60aebfc45f774f0bf4da
-
SHA256
07de6b1da0e53803c51e9babbc0b043d328883a56059d659f4e08df98c9fde8a
-
SHA512
4691665fa10c988dce3602edb4b5f91999428ae397a4cb2e5b2aeff3a8629454e78f059beeaaceaaaa6686c048ceeeaf985689f8210b0a02f13e4a1932b87205
-
SSDEEP
49152:JJT6bpwZI9v7GYN+CPvwiYYEBPGn5UTSsE+oD8rDyI93x:C+YN+CPvkYEBPU2+sE+oD8rDyY
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
@logscloudyt_bot
185.172.128.33:8970
Extracted
redline
LiveTraffic
20.218.68.91:7690
Extracted
amadey
4.17
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
lumma
https://resergvearyinitiani.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api
https://executivebrakeji.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 8 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 1 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Windows security bypass 2 TTPs 7 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Async RAT payload 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Blocklisted process makes network request 5 IoCs
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 35 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 51 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 7 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 6 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\07de6b1da0e53803c51e9babbc0b043d328883a56059d659f4e08df98c9fde8a.exe"C:\Users\Admin\AppData\Local\Temp\07de6b1da0e53803c51e9babbc0b043d328883a56059d659f4e08df98c9fde8a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe"C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exe"2⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe"C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe"C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe"C:\Users\Admin\AppData\Local\Temp\1000841001\win.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe"C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe"C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000851001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe"C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\nsd6724.tmpC:\Users\Admin\AppData\Local\Temp\nsd6724.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsd6724.tmp" & del "C:\ProgramData\*.dll"" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe"C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newsun.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe"C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000857001\trust12344.exe"C:\Users\Admin\AppData\Local\Temp\1000857001\trust12344.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe"C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000048001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exeC:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exeC:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exeC:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exeC:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Disable or Modify System Firewall
1Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\AEGDBAFHFilesize
92KB
MD5119b9787ac246f93c48fded1fe5b1ee9
SHA10ec0a96f1aa0b0a55bc755df69fdc23f850bfe40
SHA2563b6688ce67b93fbf9bbdc421803e5c0c3089a47b9dfc6a9d4b7286822af830ce
SHA512a94daab8968c1a68177fa1190da2bc49287d7ce373055f022c51c9af6c0100d7e5ca5574ecd9b78770edf279cd5bed734b0b27b8ad48bff2346f48d9822504c7
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\DGHCBAAEHCFIDGDHJEHCBGCGDBFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\ProgramData\PingConfirm.docFilesize
3.3MB
MD5d4b7385026bd4a53b16349c96f9b02d3
SHA11c322473e7212852181a2e20eabdf8598094ed58
SHA256ac2ac99e3992c942a23642b12b472c5d6a4a37af73b4f1b25ec850d9ec41ae03
SHA512126074b78dc5e0e42dea5214d1b2bd387130fdcfb113bfa52e74720ad05f98fea40cee2ad4580a26699eaf30f129e3e065e400d4b409034575ab2437a418b84b
-
C:\ProgramData\freebl3.dllFilesize
669KB
MD5550686c0ee48c386dfcb40199bd076ac
SHA1ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA5120b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\softokn3.dllFilesize
251KB
MD54e52d739c324db8225bd9ab2695f262f
SHA171c3da43dc5a0d2a1941e874a6d015a071783889
SHA25674ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA5122d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
C:\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lumma28282828.exe.logFilesize
42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeFilesize
1.8MB
MD50baddc413a020a4ed2a80a34d29532d5
SHA14c147c00fd784e203d9f60aebfc45f774f0bf4da
SHA25607de6b1da0e53803c51e9babbc0b043d328883a56059d659f4e08df98c9fde8a
SHA5124691665fa10c988dce3602edb4b5f91999428ae397a4cb2e5b2aeff3a8629454e78f059beeaaceaaaa6686c048ceeeaf985689f8210b0a02f13e4a1932b87205
-
C:\Users\Admin\AppData\Local\Temp\1000042001\amert.exeFilesize
1.9MB
MD5fd00648fbf3526a3cc116da353512c52
SHA1af3d9e32ca5d8e1f09da18cbb2f0caecd0423890
SHA25663af40685c4c50f7de5dd1d95f3e6df42d603f1f18f8d935ec9b81fa728dee7c
SHA5128733b316b0c9a66d2b035c3605e85b031d80baa081e2736ab043f67dbe09f4128170a67a640f2aad7dedef0f868f7665bf33a52613f63a4fe000614faaedf6e0
-
C:\Users\Admin\AppData\Local\Temp\1000046001\seratwo.exeFilesize
74KB
MD529f127851fff4d296c91aedc30b1aa4f
SHA16bbf47e4642f83ebe9e40bcffb60925124ca7f43
SHA25628ad6e97a9428581834835d6b18177af24f884aa29b6670b3c8fedd11fc34043
SHA512421f35d9ed1edfe4e331ff9e286584739ce7ba6c88487a890d6a8e325cb3a75baeab4776ac7d2f465bcee38d9e3bcd49b5b9669566fd7f8d7084e07ddcb0ae36
-
C:\Users\Admin\AppData\Local\Temp\1000150001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.1MB
MD56757933c2cbc93d0af6adb6e741ea01b
SHA1e2879a79eef34989c517cdee4dc2902c6395651a
SHA2568d05aaaef3b9667964a2a4b0dddb030b89a0bc126c8226ae32b2a12e9edc3e94
SHA51293833021edc5359181204f2a2548846ee9b123fab447dd23ca3941d39dbdf33900b0b981a9ddf29e719ac2e043d8278e631f0d5d9c5225c75c934d9b413cd2be
-
C:\Users\Admin\AppData\Local\Temp\1000832001\dais.exeFilesize
310KB
MD51f22a7e6656435da34317aa3e7a95f51
SHA18bec84fa7a4a5e4113ea3548eb0c0d95d050f218
SHA25655fbfaaeee07219fa0c1854b2d594a4b334d94fad72e84f9f4b24f367628ca6c
SHA512a263145b00ff21ecaf04214996f1b277db13bdc5013591c3c9cf25e9082fc99bc5e357f56aba4cea4dbcc68f85262fe7bbd7f1cec93cde81c0b30dae77f1b95e
-
C:\Users\Admin\AppData\Local\Temp\1000833001\alex12.exeFilesize
1.7MB
MD5211c3659790c88b15827ec89ffa5898f
SHA1f0ef5847fb9a1db37b3307e3b2b6f90098aa6e65
SHA2560f2f61669d3bc852e0defe69777a70627ae072b167425a64f4c88ac9ca84389c
SHA512a7aa227100c27ba414d53af42c9dbedd3f509fa7b32fc442d2f0ede75292c917e226ec78238a66c6d46531d23856a4d1bcf1ad9567d4c1e75bfdeb975769e708
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exeFilesize
318KB
MD569c8535d268d104e0b48f04617980371
SHA1a835c367b6f9b9e63605c6e8aaa742f9db7dcf40
SHA2563c74e8c9c3694e4036fea99eb08ba0d3502ad3fe2158432d0efdfaacd9763c35
SHA51293f35aa818391d06c4662796bec0dced2dc7a28b666c5c4bf6a6f68898ed52b77fa2ac7dd031b701b1ab8ae396e8941ade4ef0159765419788034742534a0c9e
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exeFilesize
555KB
MD5e8947f50909d3fdd0ab558750e139756
SHA1ea4664eb61ddde1b17e3b05e67d5928703a1b6f1
SHA2560b01a984b362772a49cc7e99af1306a2bb00145b03ea8eca7db616c91f6cf445
SHA5127d7f389af526ee2947693983bf4c1cf61064cfe8c75a9708c6e0780b24f5eb261a907eeb6fedfaefcd08d8cddc9afb04c1701b85992456d793b5236a5a981f58
-
C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exeFilesize
2.4MB
MD5b1fae729d3b06f2306890dc439bf6c23
SHA1bb05675df9aa620eb0e42c8123a1760f680f1e51
SHA2568dcb0aa0e27343476a67b80a0ddf8dbc86c695f8c65c4679da21c425eccecf94
SHA512796ed0386282536c7369de6bad6024f81536ee7bb6c8f337b35a2d28ca3b24a573e56bd819e7762a7ae4629f65c99b83a39951a89ed2d16650987b2ca856ae6d
-
C:\Users\Admin\AppData\Local\Temp\1000838001\juditttt.exeFilesize
2.7MB
MD57381e4b2945e3426c59efe5070ebe7e1
SHA1333250469606d8605ca7e793e4d2dec41c08996a
SHA256c8d7209e5a9386363be4441ecdeb043c41c9eb2c00623c40e954381415efff33
SHA5121c4c5c4e973ba3ed6a6fa98f6c00a721a3de8331d2778e780211844f247729ac67f3bc4a2177a0b11dff2897d9b0b10bcd2d0fc8e140a169cfd2d2cf3d960321
-
C:\Users\Admin\AppData\Local\Temp\1000839001\jokerpos.exeFilesize
171KB
MD50b497342a00fced5eb28c7bfc990d02e
SHA14bd969abbb7eab99364a3322ce23da5a5769e28b
SHA2566431a7a099dd778ec7e9c8152db98624b23ed02a237c2fe0920d53424752316a
SHA512eefeec1139d1bfd3c4c5619a38ffa2c73d71c19ac4a1d2553efb272245ca0d764c306a8cb44d16186d69a49fd2bf84b8cc2e32ea1ce738923e4c30230ff96207
-
C:\Users\Admin\AppData\Local\Temp\1000841001\win.exeFilesize
4.3MB
MD5a263a25d204194fa5e17f07330b9a411
SHA1a1d4f97dd06f2e3bb343a564601a6055e12ebcec
SHA256faea4ccd802391bf9a6d71bc6052f269b6ca370c124bfe4d2faae55b43a5c0c8
SHA512003d70099729511e04ca0104a5315aba1495112bcdd64e3f07d2286a9f0e61b1fa6a8ca78d296220bd835b9c2a741813fa5a57dc9f86650492dc3b228d6e3ac5
-
C:\Users\Admin\AppData\Local\Temp\1000842001\sad182772.exeFilesize
183KB
MD5306449d4b2569bcc22d31039156f5e91
SHA117956bed4ade6ce3c46a9878d9e619ded80a82b8
SHA2561feff340df2746a8272f3a9eb1cb84866fb5ea032a0e783547e009dfae921e8d
SHA512623eefa73f3c61d437a02ab8b406df82aa764ad5f53ffef0c614c225ce07108a21450de49296c60366577eefd310144ce90db2946fd24a79914dc3fdc9c929c8
-
C:\Users\Admin\AppData\Local\Temp\1000843001\swizzy.exeFilesize
338KB
MD5e3da16eac28d7b1897625ee19f4e08b1
SHA16a7655ed2ec4a6b069c0503d2323c9858b3fa5d6
SHA256a9bc1bba81c60816f3473ce4686fc26301f3910d22973437a590d82856e23d00
SHA5125e2787457488875ff3f2cdc42a80f0f9b78e1fc9134a9bfe8eaeef9008eaf1f42fe57e443fd5ce52987732a5fc6841ae95e119e00874389811163b6d9c9b42f0
-
C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exeFilesize
413KB
MD5d467222c3bd563cb72fa49302f80b079
SHA19335e2a36abb8309d8a2075faf78d66b968b2a91
SHA256fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
SHA512484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7
-
C:\Users\Admin\AppData\Local\Temp\1000851001\random.exeFilesize
2.2MB
MD52b7a70034e825daf21013553787d0ae9
SHA1b759f0be931c9ad0c9e889cd6be51ce955a42910
SHA2561f734a58aaf9dd153d6c0e278d0560fed81ee38c99e3e354a47d39e8b3a0882f
SHA5129297eef9fbb45d88daa63f3d73e6a0b83694372166f82b5a339d05a093e1b726354b67e9a2d4fe5f904eda09b510b1564f1eb71b7806035d11ba495d26173a87
-
C:\Users\Admin\AppData\Local\Temp\1000853001\InstallSetup3.exeFilesize
178KB
MD5205fabe9c18f10bdbd1648d17acbeb50
SHA1ea7e85a8ac973da392fa12f2711f69d49b0f657e
SHA2561bc005ce05b22d1b67551f3acbd8b064403d6ea8bf17a976344ece4d08e911b3
SHA512629cf5a807cefdd9d104aefbfccdb6ce91cce6ab0816434f5c633196fcfa0ace825918d5527183e5ff19083a1b5f33a4ca48008252b81870ffb25387e73a394b
-
C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exeFilesize
302KB
MD54fb0c50666fb99a23589819bc8d78808
SHA1a811d242925883f2ef87188a902bc629bd927ca2
SHA2561c326787da30edba895b727214671bda8e439dd0bee3584ffc54307c938c9f28
SHA512f53dcb6b7cf8f08dc22f1372c205b8973b927b583624ab8b55697a1d53c475eefe6f1eb6a4b716999cdc7b8d38a45f8cf6ed04e21f9d5530668bbe88ed29c2d3
-
C:\Users\Admin\AppData\Local\Temp\1000855001\newsun.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000856001\lastrovs.exeFilesize
148KB
MD57789d854c72417f4b49dcae6221348b0
SHA15d4a1f85c12db13735d924d5bee5fd65f88569e2
SHA25667a8db376b3438977898afc7c53a01c041191f7e7631c2f14945d55393286185
SHA51221e27ffed153cd5e70b81cfd69520316d447e91b6a5f33ddc544ed94efe4f3d1724d301335b8045a4e0997d598c02cf849a754a056021fe776893c34367a2cf9
-
C:\Users\Admin\AppData\Local\Temp\1000857001\trust12344.exeFilesize
95KB
MD544b6f48a50be8b19b46773df9b712131
SHA1e0a322b47ec2744abeda531092483f54c038faf9
SHA25638d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a
SHA512095f4a5010c003ac657c075232b920e07400291666237027c472369e766c4a2e72a36b11909f2b701fbb6de511cec00912c2fd5741d0e4d28c42b399874c2526
-
C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zipFilesize
179KB
MD5b67436790451ca5d433e93f68c739200
SHA19803304785e406c76ce1fbc690ab3c63cceb2be6
SHA2561cc467142938f16b330771816b2a87f89ff121b52652df4d2df420656f9efcc3
SHA51274e0f7f56f46d991fd10b1e2add8d7878a03adf5cd4d62674efc28b2bc6ee5b7bd037fdb6b3463b9432277d63586f8390ac143277179473ab8446d838cf9388e
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_asyncio.pydFilesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pydFilesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pydFilesize
4.2MB
MD561b1995050b73c4e36c0be3249ccccde
SHA190e137e7be1c1aecee8b0458423eba9ba2a8fc52
SHA256bb5a6067feff6f6efc4b179b71215fd464ad6467549c9930a8c231d74c11e8d3
SHA51227e69133e54207feb8e1e0d8ea788cd3bad74de67bd1aef856de7fa2353ce9395a9047c2f3450aacc4e5f68053c7e5427343a607899bff9f19849b5d118aea8d
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dllFilesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dllFilesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dllFilesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
C:\Users\Admin\AppData\Local\Temp\_Files_\MountStep.docxFilesize
178KB
MD52d34b42c61222a33beb01c94f83b78fc
SHA1fa2e0fa8a9b83a0d1f0b986f2aabb72a1e75513e
SHA2563e247bd9fd77dc9a0422dec7205b726763645694c1c5acd8d059f3e2da662290
SHA5122239ea5584bb91bf13c97007e2fa711605b6544fb90a5c1a2bf9016bcfe06d6f55a7f6538023023eca8e77106c9651f40d903562889283f92cca80bf93ef02c5
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkreqrqt.5ht.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\nso5C36.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
C:\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\VCRUNTIME140.dllFilesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
C:\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
C:\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\stub.exeFilesize
6.7MB
MD5c34c4c818e23598960bedbc3f35704e3
SHA13937d49d54d5a1c7dda175ebd5f2be2caeb34a6f
SHA256696494a93bd570e18d0d379ec79cfeb8a5628a0e6ef7adcf0ab8e07541599352
SHA51250ccb3358ec6207e81ad6327d9c9f5f0e9a8871b232d3e2ffd973118f937ede03f9c0a933093033224f902dda6ac7babf14b806f734e9306f496c4effb632715
-
C:\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\stub.exeFilesize
4.8MB
MD5ccee34678acbee7395d8a489d4ee6b44
SHA14af445ad53b37499e1565b4323f94bd61ca76693
SHA256a04aa17c2a079fd695ab01a7b0869c23dd8427acae678657f43bb98ccb903d84
SHA5120208470a3f6fbb17c67a2db547eecec63e93f5ab414cc6125acce4d44b5e2ab97a1e9b8c811d182d42874e5a5d330cda9da937a4bfd2e9056059cf1b125d84d2
-
C:\Users\Admin\AppData\Local\Temp\tmp1375.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp8DDC.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
1.2MB
MD592fbdfccf6a63acef2743631d16652a7
SHA1971968b1378dd89d59d7f84bf92f16fc68664506
SHA256b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\fate.exeFilesize
296KB
MD528f30e43da4c45f023b546fc871a12ea
SHA1ab063bbb313b75320f4335a8cd878f7a02e5f91c
SHA2561e246855bc5d7648a3425771faa304d08ce84496a3afa7a023937ac41d381c6b
SHA512559099480bc8518f740249b096c123bc5dfb9dc0126d1c681f4e650329cfb4383754ec8a307057f24b2692c36f4fa8e90b5b5d2debe1061e1ece27a7b26335b4
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exeFilesize
310KB
MD5afbc408680d16aa491e10c002dc9c3d0
SHA1272e07bc68d862f65fc2006d9d714ad03cb09086
SHA2567b32e5045377a79d4f7f552d9971022f6883799eebeffa8f48f3c76e66acb80d
SHA51205601f82bc44aaca332b7357b745a5658199c6bb86d26cbf9a110686351717359a6b64f1c713e278a3517b470cf7bc6db48c647f587999931606a137d0040fbb
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pydFilesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_cffi_backend.pydFilesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pydFilesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pydFilesize
60KB
MD549ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1dcfbee380e7d6c88128a807f381a831b6a752f10
SHA2561be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pydFilesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pydFilesize
47KB
MD57e6bd435c918e7c34336c7434404eedf
SHA1f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA2560606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pydFilesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pydFilesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pydFilesize
3.4MB
MD507988cce5816377d8f3c01ba0d5bf39f
SHA14545e3df5baa7ccb07d58e819dca12bab76dbb01
SHA256ba6ea4cc6b861c58f69e1c4a8287341cd2f6f9c4a77ba4c9d327342e2888b0c3
SHA5121d376de06cb0cddf971c6763f423ed26b0d4a90397f36455d6369935178507efb19d2430d7da4c05877cdf777b2ce14b153ea71df0822e0a559465547b8d68ef
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\multidict\_multidict.pydFilesize
45KB
MD5ddd4c0ae1e0d166c22449e9dcdca20d7
SHA1ff0e3d889b4e8bc43b0f13aa1154776b0df95700
SHA25674ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c
SHA512c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd
-
\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pydFilesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
\Users\Admin\AppData\Local\Temp\onefile_1516_133540013000446459\python3.dllFilesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
memory/196-1034-0x0000000000400000-0x0000000001E09000-memory.dmpFilesize
26.0MB
-
memory/500-63-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/500-71-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/652-69-0x0000000002880000-0x0000000004880000-memory.dmpFilesize
32.0MB
-
memory/652-59-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/652-58-0x00000000003C0000-0x0000000000582000-memory.dmpFilesize
1.8MB
-
memory/652-60-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/652-66-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/664-118-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/664-141-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/664-140-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/664-139-0x00000000031D0000-0x00000000051D0000-memory.dmpFilesize
32.0MB
-
memory/664-138-0x00000000031D0000-0x00000000051D0000-memory.dmpFilesize
32.0MB
-
memory/664-132-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/752-148-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/920-143-0x0000000000260000-0x00000000002F2000-memory.dmpFilesize
584KB
-
memory/920-144-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/920-145-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1152-20-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/1152-23-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/1152-806-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-70-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-19-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-385-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-554-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-21-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/1152-22-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1152-95-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-28-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/1152-27-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/1152-112-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-18-0x0000000000BA0000-0x0000000001041000-memory.dmpFilesize
4.6MB
-
memory/1152-24-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/1152-25-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/1152-26-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/1308-115-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/1308-117-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1308-135-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/1308-137-0x00000000031D0000-0x00000000051D0000-memory.dmpFilesize
32.0MB
-
memory/1308-106-0x0000000000FC0000-0x0000000001016000-memory.dmpFilesize
344KB
-
memory/1516-456-0x00007FF69CC40000-0x00007FF69D717000-memory.dmpFilesize
10.8MB
-
memory/1664-627-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1664-624-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1820-485-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1820-489-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2140-414-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/2140-393-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2140-389-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2212-529-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2212-526-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2440-119-0x000000001BC30000-0x000000001BC40000-memory.dmpFilesize
64KB
-
memory/2440-110-0x00007FFDDDA00000-0x00007FFDDE3EC000-memory.dmpFilesize
9.9MB
-
memory/2440-42-0x0000000000ED0000-0x0000000000F24000-memory.dmpFilesize
336KB
-
memory/2440-43-0x00007FFDDDA00000-0x00007FFDDE3EC000-memory.dmpFilesize
9.9MB
-
memory/2440-44-0x000000001BC30000-0x000000001BC40000-memory.dmpFilesize
64KB
-
memory/2712-103-0x000000001E230000-0x000000001E33A000-memory.dmpFilesize
1.0MB
-
memory/2712-93-0x00007FFDDDA00000-0x00007FFDDE3EC000-memory.dmpFilesize
9.9MB
-
memory/2712-107-0x000000001BBC0000-0x000000001BBD2000-memory.dmpFilesize
72KB
-
memory/2712-109-0x000000001E120000-0x000000001E15E000-memory.dmpFilesize
248KB
-
memory/2712-82-0x0000000000EF0000-0x0000000000F44000-memory.dmpFilesize
336KB
-
memory/2712-98-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/2836-2-0x00000000012B0000-0x0000000001751000-memory.dmpFilesize
4.6MB
-
memory/2836-3-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/2836-4-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/2836-15-0x00000000012B0000-0x0000000001751000-memory.dmpFilesize
4.6MB
-
memory/2836-5-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/2836-0-0x00000000012B0000-0x0000000001751000-memory.dmpFilesize
4.6MB
-
memory/2836-6-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/2836-7-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2836-8-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/2836-11-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2836-1-0x00000000777A4000-0x00000000777A5000-memory.dmpFilesize
4KB
-
memory/2836-10-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/3960-409-0x00007FF6CE840000-0x00007FF6CFA79000-memory.dmpFilesize
18.2MB
-
memory/5112-102-0x0000000006030000-0x0000000006636000-memory.dmpFilesize
6.0MB
-
memory/5112-104-0x0000000005A20000-0x0000000005B2A000-memory.dmpFilesize
1.0MB
-
memory/5112-80-0x00000000729F0000-0x00000000730DE000-memory.dmpFilesize
6.9MB
-
memory/5112-92-0x0000000005520000-0x0000000005A1E000-memory.dmpFilesize
5.0MB
-
memory/5112-113-0x0000000005360000-0x00000000053AB000-memory.dmpFilesize
300KB
-
memory/5112-111-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/5112-108-0x0000000005280000-0x0000000005292000-memory.dmpFilesize
72KB
-
memory/5112-101-0x0000000005040000-0x000000000504A000-memory.dmpFilesize
40KB
-
memory/5112-100-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/5112-94-0x00000000050C0000-0x0000000005152000-memory.dmpFilesize
584KB
-
memory/5112-81-0x0000000000790000-0x00000000007E0000-memory.dmpFilesize
320KB