Analysis
-
max time kernel
83s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe
Resource
win10v2004-20240319-en
General
-
Target
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe
-
Size
1.8MB
-
MD5
aea36596333fda13e77b376fd103ad9a
-
SHA1
98dccd9fafc42d5cc2b421c2258aecb1274207e9
-
SHA256
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66
-
SHA512
dfd72bbab8ec945c0afd1a754b47e2a392bd02f37cc0e27788610851107b424a6fb22cbafa1fe4c3b3c812a3a42d988c33e345c5cefb46a42285e4f8094fa68b
-
SSDEEP
49152:YkkjupevR393YouchgoMApfevTX0THGbRFGYeVLUNb:UVlYo3JWkTHCRFfeaN
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
LiveTraffic
4.185.137.132:1632
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.17
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Signatures
-
Detect ZGRat V1 29 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe family_zgrat_v1 behavioral1/memory/4624-63-0x0000000000510000-0x000000000058A000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe family_zgrat_v1 behavioral1/memory/3676-101-0x00000000005F0000-0x00000000007AC000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_zgrat_v1 behavioral1/memory/4912-745-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-746-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-749-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-752-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-756-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-761-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-760-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-758-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-764-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-765-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-768-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-769-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-773-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-772-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-777-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-776-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-781-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-784-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/4912-785-0x00000000052D0000-0x00000000054EE000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-780-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 behavioral1/memory/2448-790-0x0000000005B70000-0x0000000005DC4000-memory.dmp family_zgrat_v1 -
Glupteba payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/5504-441-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3992-521-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3992-542-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/5036-618-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/5036-685-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe family_purelog_stealer C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe family_purelog_stealer C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe family_purelog_stealer C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe family_purelog_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/4520-68-0x0000000000400000-0x0000000000450000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline behavioral1/memory/5292-141-0x00000000001B0000-0x0000000000202000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral1/memory/5308-173-0x0000000000550000-0x00000000005DC000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe family_redline C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_redline C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exeexplorgu.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorgu.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 164 5552 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 6056 netsh.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exeexplorgu.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorgu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorgu.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explorgu.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation explorgu.exe Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 7 IoCs
Processes:
explorgu.exegoldprimeldlldf.exealex1234.exeTraffic.exepropro.exe987123.exechckik.exepid process 3140 explorgu.exe 4624 goldprimeldlldf.exe 3676 alex1234.exe 5308 Traffic.exe 5292 propro.exe 5840 987123.exe 5240 chckik.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exeexplorgu.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Wine 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe Key opened \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Wine explorgu.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 5528 rundll32.exe 5552 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exeexplorgu.exepid process 824 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe 3140 explorgu.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
goldprimeldlldf.exealex1234.exedescription pid process target process PID 4624 set thread context of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 3676 set thread context of 3176 3676 alex1234.exe RegAsm.exe -
Drops file in Windows directory 2 IoCs
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exechckik.exedescription ioc process File created C:\Windows\Tasks\explorgu.job 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe File created C:\Windows\Tasks\chrosha.job chckik.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 6056 5840 WerFault.exe 987123.exe 5020 5992 WerFault.exe toolspub1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
987123.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 987123.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 987123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 987123.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4496 schtasks.exe 5832 schtasks.exe 6008 schtasks.exe -
Processes:
propro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 propro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 propro.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exeexplorgu.exerundll32.exepid process 824 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe 824 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe 3140 explorgu.exe 3140 explorgu.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe 5552 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Traffic.exedescription pid process Token: SeDebugPrivilege 5308 Traffic.exe Token: SeBackupPrivilege 5308 Traffic.exe Token: SeSecurityPrivilege 5308 Traffic.exe Token: SeSecurityPrivilege 5308 Traffic.exe Token: SeSecurityPrivilege 5308 Traffic.exe Token: SeSecurityPrivilege 5308 Traffic.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exechckik.exepid process 824 0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe 5240 chckik.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
explorgu.exegoldprimeldlldf.exealex1234.exeRegAsm.exerundll32.exerundll32.exedescription pid process target process PID 3140 wrote to memory of 4624 3140 explorgu.exe goldprimeldlldf.exe PID 3140 wrote to memory of 4624 3140 explorgu.exe goldprimeldlldf.exe PID 3140 wrote to memory of 4624 3140 explorgu.exe goldprimeldlldf.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 4624 wrote to memory of 4520 4624 goldprimeldlldf.exe RegAsm.exe PID 3140 wrote to memory of 3676 3140 explorgu.exe alex1234.exe PID 3140 wrote to memory of 3676 3140 explorgu.exe alex1234.exe PID 3140 wrote to memory of 3676 3140 explorgu.exe alex1234.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3676 wrote to memory of 3176 3676 alex1234.exe RegAsm.exe PID 3176 wrote to memory of 5308 3176 RegAsm.exe Traffic.exe PID 3176 wrote to memory of 5308 3176 RegAsm.exe Traffic.exe PID 3176 wrote to memory of 5292 3176 RegAsm.exe propro.exe PID 3176 wrote to memory of 5292 3176 RegAsm.exe propro.exe PID 3176 wrote to memory of 5292 3176 RegAsm.exe propro.exe PID 3140 wrote to memory of 5528 3140 explorgu.exe rundll32.exe PID 3140 wrote to memory of 5528 3140 explorgu.exe rundll32.exe PID 3140 wrote to memory of 5528 3140 explorgu.exe rundll32.exe PID 5528 wrote to memory of 5552 5528 rundll32.exe rundll32.exe PID 5528 wrote to memory of 5552 5528 rundll32.exe rundll32.exe PID 5552 wrote to memory of 5636 5552 rundll32.exe netsh.exe PID 5552 wrote to memory of 5636 5552 rundll32.exe netsh.exe PID 3140 wrote to memory of 5840 3140 explorgu.exe 987123.exe PID 3140 wrote to memory of 5840 3140 explorgu.exe 987123.exe PID 3140 wrote to memory of 5840 3140 explorgu.exe 987123.exe PID 3140 wrote to memory of 5240 3140 explorgu.exe chckik.exe PID 3140 wrote to memory of 5240 3140 explorgu.exe chckik.exe PID 3140 wrote to memory of 5240 3140 explorgu.exe chckik.exe PID 5552 wrote to memory of 1532 5552 rundll32.exe powershell.exe PID 5552 wrote to memory of 1532 5552 rundll32.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe"C:\Users\Admin\AppData\Local\Temp\0b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2712 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 3523⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 3964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001038001\file.exe"C:\Users\Admin\AppData\Local\Temp\1001038001\file.exe"2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 58401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5992 -ip 59921⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1Install Root Certificate
1Modify Registry
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fe3aab3ae544a134b68e881b82b70169
SHA1926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA5123fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD57f5130f8643f9c281b6384704d27b900
SHA1c384737918a1e492e8742800a251d31de1842de2
SHA256e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f
SHA512ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeFilesize
1.8MB
MD5aea36596333fda13e77b376fd103ad9a
SHA198dccd9fafc42d5cc2b421c2258aecb1274207e9
SHA2560b151681aa8889612bc85e481f91469e8894f5a73ba325951bc2289a5d746d66
SHA512dfd72bbab8ec945c0afd1a754b47e2a392bd02f37cc0e27788610851107b424a6fb22cbafa1fe4c3b3c812a3a42d988c33e345c5cefb46a42285e4f8094fa68b
-
C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exeFilesize
1.1MB
MD55bbf369512fd34d1336ca4c839154d92
SHA13c343795508e28cf05f3f937c319466e48e9af3c
SHA2567bdb1994bc8e960409e77cf4dd087c04474a5584a86ad09c1446bdae4ffd1387
SHA51275bb42802ff3ce451c9ec36006ff8586ae75a5f3efce28cb0d34be9c3a36b2ea0e45af769934237a841e7cc79e413a3a783b078a25020c3c4e58bad3c38dc539
-
C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exeFilesize
640KB
MD5201bdfd47a53ba8b84a59467fa31b001
SHA14c4512bdf8336cf090c8f8719bbee9ae465ef90f
SHA2568839aff0afeb34d3cbb75972ec72af678b586cb05130f1793a2465591ae76ecb
SHA5120f91af4f7d474eada6d76f0866f20faabc8714a454862712317ceec5aab646d059253141f4f0992d151686e1396651aab5f3989e4b8d8c13eb89325c5a5e4118
-
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exeFilesize
227KB
MD57b09acb6cc6425fade98408ec43bfcd3
SHA1681ec6f05ccc78aa5e519b1fb13cab4455fb2638
SHA256261fdc86bd8ccc62299a6f57194d59167a751f3b8b8649f8a252d39ca3a31226
SHA51274621bef98d9c8ce9e33cf1731c16bbe4d3fda2fca06ed03b09f9b5237e4747f0ac0229f70afa852d8c4d1d3baf5b0411e76f568619a038cef39ae55611c6bc3
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
3.2MB
MD568c8d806697e6bb0c61785636e47cc86
SHA102b7894a814088e8d7b1ffdd48fad5b23107de0a
SHA256e0534186fb101458d7b6b8f0aabb2b774a7d4ed058c16c3dc8c1d879e62ac7b9
SHA5126847b61ba17a257c66c54ff5beb095871d86a2bb7e6844b782911b135ddb398cc0a282e3d94824d37c9c901e96e7bc86266a930e66d915d91e63fdca1e66de2b
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
704KB
MD584b3a2d989f17e12d2dd25a5064fbe6c
SHA1cca6ab6f3dc3fdb5207d77e7dd4df5309f8004b3
SHA25698976bca2dc8f48c2ff2164dd81e94b088d0819759a37184191f94a11c8a7c5f
SHA5129c6236542601950dabc4e7be53c2bc169d28e132660e1599cb79ec073dab0d13c46d7083753a70103968d75fa1da8fba55a38df7d04b26d06505aa07bcb25eee
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
640KB
MD58bfe384436a00037b7976eaf27872a78
SHA1dbb84b1f081d90d536183f03d223269c0eaa2541
SHA2569124baf8d75dad8aa4302ba1b22cc3ea48b8157a2f7c106b85134b95634cdba5
SHA512d5258eac32358c59663626eea4ecede2f17a74b42dae0cf33a23fd0da09e954e9a1c58e11bf937b441eafe0a3a6a70184c8391be6421e700315702824fcf20be
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exeFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exeFilesize
464KB
MD5c084d6f6ba40534fbfc5a64b21ef99ab
SHA10b4a17da83c0a8abbc8fab321931d5447b32b720
SHA256afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
SHA512a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exeFilesize
1.2MB
MD52c21819a5a2fb466c4b3a92a284becbb
SHA1b29e49414d1613c805d96ac3a011a0a80a3b471a
SHA256d085503768d280b40b6f6880765a8aa99dbe7d68c2da6bfa2e9b47dfc7fd2459
SHA512d8257493d3171336e94b6c749a8ee2b93fb94f7c1188f40b109674282debcf2dde2651438d5ee62bc7adae68e027b5f2c0c1b4f2b78bbd60dff105bcf0c21d6d
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exeFilesize
960KB
MD583356df6f15009c7b75cf3b34a1fbe06
SHA1f3a6d83bed03a03216f4ea160395aa437488c9ab
SHA256c6f67d7cfc86da85b0ba5db54b002d3697dd365ddfbd4cc6e91e8c043d109850
SHA5123887af81b054c4fadaadf1d8b8dd9d4c062dfda27e938112e22a72a0059ff779ce3607d740fc99bc1ba4c5204deabe44a94f1dad5f59af38aabc61843e353b1e
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exeFilesize
1.1MB
MD57a38d76606a4415e78120dfc8b30fc3d
SHA16b3cd359229f78377b551792267dc10fd42b9772
SHA256196080f3a46c02560f261b84830b0ba5a42da1b13c90e6e5abcf6aab25ef032f
SHA512179fd316b4878a0d4a38a6d11566fc4357f83a952f11620c8d79e69302daedbc93a04961c76428a9c7b8c48bf8a5116f0e612edd3c25cbd9e5cfce27320f505d
-
C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exeFilesize
315KB
MD55fe67781ffe47ec36f91991abf707432
SHA1137e6d50387a837bf929b0da70ab6b1512e95466
SHA256a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
SHA5120e32d9a72b562d4c4a8c4edbd3d0ece54b67ee87c8ac382c6508c62b04b11a2dcd1fba23c3a78004fcd0c2b623dc854fd2fd82eb372dc7becdcbdd7ec7fe1b68
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exeFilesize
413KB
MD5d467222c3bd563cb72fa49302f80b079
SHA19335e2a36abb8309d8a2075faf78d66b968b2a91
SHA256fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
SHA512484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka111.exeFilesize
1KB
MD55343c1a8b203c162a3bf3870d9f50fd4
SHA104b5b886c20d88b57eea6d8ff882624a4ac1e51d
SHA256dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
SHA512e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeFilesize
320KB
MD52d65492ea6b38bd6fc8ee8a64bef1524
SHA147bd0cacd3a668f593b762d92374946e03e7829f
SHA2566280b0782a483d381de0bc671f603c9af4975d6e5e7d2793bc5c857c2bdfded5
SHA512152686ee7c268e53c371461e68475687c95bd4a0fda9c3e9d54086ab53b8cb3135a0ecbbe1febc94b0da6470fe512dc0f7d425870123df3ef72c3feb22dc66b6
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeFilesize
224KB
MD50e797e4ba0a59d4912145f2e5ce55234
SHA1d139b6ae2789451da44b740970f8c1fcae1d4d6b
SHA256f3700f8b56b9b9afa1166fd44a950de013e890e54c5925d7ae8412d5cba87025
SHA51249a257c16a15ef322b2dc318bb20a46b49bc2eb9e2606966d0dcffef4ce4442fe3114d89d0caf4c1c2c418ef66a7724de46d2fd674b0c89fa24a3571d5148e74
-
C:\Users\Admin\AppData\Local\Temp\1001038001\file.exeFilesize
2.9MB
MD5888e5eaf60ee47c5b317100fd2cb0ea2
SHA118b1b9b8da5a01dfc2e7ce3f79e67589cf92ce7a
SHA2562da17294c11d5e06e92dda2eaa2a3b09e3cc1c485a474955a804fd3b1b85cf4f
SHA512e8149ed6e310d2a5a035dc45990bc020e04801b654257a7076326c3c819a48734f4607c019e11007ac67e0ab0fb783ad79bc78289fbbe7cd3dd73ce4ef0995d9
-
C:\Users\Admin\AppData\Local\Temp\1001038001\file.exeFilesize
3.0MB
MD5c5eb4e206e53665e155ec58aebfbcd4c
SHA1a1de468c8fcaf5b0f4413db865d6bbc62cf05fe6
SHA256065e41c037919ba657e74528f9d5dbf09347499d08f92fcdcec9307e2583dd07
SHA5129e4285caad9bfcc153860ac08673fb50a61e462b1f69eb0c1cdccaf41dad8b760232a971a4d3c03278e9f3d388342e421ae5da404c9a181c8d078a61a3dd5948
-
C:\Users\Admin\AppData\Local\Temp\1001038001\file.exeFilesize
4.8MB
MD590489ae7eda45c9ab0904ec54c1caa71
SHA1ad96a6b3b10bb1452143f2fb0c450afb6ef6cd3e
SHA256d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc
SHA5122f7f0494ae586bd0dc65cb9100d6259858de08970c980fff83a4169e04a192954ea88c38c0ec07d448c711a81ad710265a0ecc50e49d6709c35c1116c76816d8
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exeFilesize
301KB
MD5832eb4dc3ed8ceb9a1735bd0c7acaf1b
SHA1b622a406927fbb8f6cd5081bd4455fb831948fca
SHA2562a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
SHA5123ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exeFilesize
499KB
MD583d0b41c7a3a0d29a268b49a313c5de5
SHA146f3251c771b67b40b1f3268caef8046174909a5
SHA25609cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
SHA512705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exeFilesize
384KB
MD5d136b56697046f2d632ea2aed9baa40d
SHA1a7386a492bbdf0c6259499ada69824c6487bae7c
SHA256b65b96d40b7e3cd10848186a0f0a2334db087065969d0f4c3679445709472784
SHA512e5f601224415e9a3bd18a830369fce2aa0bb148be271fd8444e219c8847e19ca91cf965d1f318b29e4a72ddf823058ca0abdf32f09398133f993b55b2371abdf
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbsFilesize
260B
MD5841c24716c25d1d8c1f5eab82fc73be7
SHA1a2cae95040bff067feaa70e45441f197d13a5f5d
SHA25629cd1166bdab2568a4a4665c9c072ed0c21e9365be74e01c01d39ca927631b53
SHA51200f67e7c3b342fca261c8ba9aad1325e56864eaa7359d4f68ab05b2dfe9fb165898d8d74f08d5b90b47dcb6c7ce2f6e56e1bfb53aebf272c38fb6f2404f715aa
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exeFilesize
1.1MB
MD5267da3f2c7640b43a673803d4eb5731c
SHA1ed6cfd4934972b8705f19e4a61e9834ce5382126
SHA2564cef3efd40ca927257f12881e15d6540a1930074f397d8c7f515a018b7525183
SHA512ef0928ef5c92ccefb01cdfaed1cb1ae2e8b1be2389312fa9a33ef4fb0ae118cf0f018d3c2b222b360205dbb163b0d86f78548047db4c5028450093a7d9d1557f
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exeFilesize
64KB
MD5ba35340c34bcde783ac83d4fdab59894
SHA1152aad7ed1bc2600a8ab51d47ff3d7f88fd2083c
SHA256616c679924ad56823a2916c541276beceb8ce1ae411850c4a13dcd8f5cdc7148
SHA512b8128c482c24c9ba16171884b2b94b5adc4aacd25d31bdd385579319906709aa1bb98d4cb402da92897c58fe0a14b991d0c8812fc0584409c1d1b1e1ac98a119
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exeFilesize
2.2MB
MD50919d76709704c22d602ca37aadab717
SHA1dafdc1303d028b36a7fe9b71465f9144b1c83ba6
SHA256495c76a1f5b27c1d1dd4c02a2d6b14c33f02f7fff1d4720e9f751055f9dd9a51
SHA512e58ed25f8e456ebe29904b10c6b79de863cdd788eee13d04c5ac5800d5693874b9d62003312f8580576a140a9d22a93e5e6c4d1d778734f5d8b345863ca8f938
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exeFilesize
448KB
MD5d9723d17723d8f677295644c5dda2fca
SHA165128924cdc7b696bf724efd74603fed77e722e5
SHA2566459ae77ebc0ddc5dd39a2a34b09779f3c67d50925935f41dfdcb75eb438efe4
SHA512ed35bee3e08701289482049a881f282e835f9d4c5d31656984741bc676e5d8940cc9967f93df34940741d0d548ebf943e10428c233c19a66379f9f4670a69190
-
C:\Users\Admin\AppData\Local\Temp\Tmp8B43.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tx2i4t2c.jcq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\tmpC65A.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpC7F7.tmpFilesize
56KB
MD5d444c807029c83b8a892ac0c4971f955
SHA1fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA2568297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e
-
C:\Users\Admin\AppData\Local\Temp\tmpC877.tmpFilesize
220KB
MD56f58d9cf9e3305acdccfb422f76a4e85
SHA17fc8795c5771a8b91320e5992d2f884bb57f9a83
SHA256c69c27ae9c2d90923b65b445f2315bc3a9126cb5e77c4eb80404f24eab0d1dd7
SHA51281e351303f9924e9b2298d46c18a819e6a309d58631e86409614342481f1cbc96d3bcf9e82cef5068cbe37aa7169004391b3b31815ff6a3f4fa8f304efabb9dd
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
896KB
MD53352f5d7dd96e4e9d86a20a9930a0c57
SHA16bcf1e0a0feef8945f142bf12e338f01dcefdd45
SHA256d2ddc67244ab4062ef12e3705aaa02b084709d8c068006aaf1a8e0d39c0937bc
SHA51269246f0d1b1a06454284fb299007ec382fab02362939d52da497bf9bf862a6595e4889c4762e369f2987aa698b85762fa195cc325b620d6feef07ed6dec6514f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
448KB
MD50b9fd51c3214dca29e5f2f3d9d78c83a
SHA15cfd912d53a63ce702c2874a9d317e158ec5d751
SHA256af3da92fdc2266cdca76d757ce8e3d3ccdcb232bbead6599b815734bfdd13cb8
SHA51288a0a0df0aca10b2cae34f3f8cefe28450e1d7446b7a7ada3947e332e7d27961979e928a4da4e38c8344642f8aaeb517ba64170c9a27b439414c2fa1b497c691
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
320KB
MD5c10dad55de7888d278ad5dc0e212d0e3
SHA121bbfe499707c29ea7d4c7139b6866524098c360
SHA256f97c9de83a03ca73c86ffd734bc9a4f4f313ae4db27d5f1e3a4a27dde3280a7f
SHA51236471b208ee49c60d20f4cb9da47bb29b78189dce2aad0222e4159ada01b47a379cb5e9496bb72544529185857ae3a6d8901dc6679d70dc5f4d6c6c6e1e01f00
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
128KB
MD5e3ef46defbcdca7fe8a1e7b2d61db673
SHA168630c44e048e7e767e70249e5d66af60f54e66b
SHA256351a910e7430fd8cd5345f7b6a300033c700ae63c1bf36fadf6419c3fe851e79
SHA5126ef374060a47c7ae202f480f79b9ee418e00b7f2e78caf8797a65a93088d8c2153f3b9cdba76b2c3b4a21e28fbf6715cd8eed7417d4d9b9e961278d09aeb7b47
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
384KB
MD5afe8bf3481929d5a371ae1a3c15aaa62
SHA127f2c1d1cf93f010e17c959293ec335fa40ceb1b
SHA256d253c60dc0f41e4a409a406ecca30757f1312b6c8e34930a0f174e4078a57f76
SHA5126efda8b6c425309143238736aee76ff59b23f75c8b262ecd313b629f572b28f1161e835258b69c554642f4442d15180c4747ea2a23b2196e954718503a69bf20
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
64KB
MD5ca3f1da32f17588fdf20049b28dabdfd
SHA11e2b3ddebd664c63d4bd8ff30b550e95a455f6ff
SHA2563b8805d2ad9bc57a2d0ca06cab06b0125944b91f2a6f10fa1e58fad89ca49f96
SHA512454cd5c52dc749d672ab80972c94eeeb39d38bcbf424f9fa402d027df897e9b426c529015d2458126a75f1138d39fe10569e882cb34893dbb112951caec3e162
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD561a41e67c20194f1e1df849f1019a1ff
SHA1e56d6c6cc6162b70b60cf395a06952a7c67805c6
SHA256a8eeec15a78f9eaa194e61e510e4e42ebca4a5c3b38b9494c8f92b7285fa851f
SHA5123d66e3e699844ffd6d31583d0a9be626168f985e71230c0a9990f542f6b7635b019ab4017af302834d049ed11cdd78288b384bd71109de7a0fc52fa64d2cbc38
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5e94400c90c32966765f186c5f924669f
SHA1899e75629f6809d1608225a4e6b1463779df30d2
SHA256e6e2d29771f1424e6a89fe072807867fb88e5f41a85d1fb032d2ac5a0cb29d89
SHA512ffbc04333564a2f00dd562fec2ece2173496e358da4882f3e9ca2bc51bdd820c8e3ea3b6e49f81e87f42f6ef0a45c08a8a78591d28405a2b7cea86abab15df17
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53ee9d866ef91ae7bbdf7a5e66d1b2d66
SHA17b91f89233e60cf38c6c9e3bb6e59707ecfd8676
SHA256baa168bf51f816ca1fcbfbb329a6bf71987e9d6ab630343f8d9d6208e9fa9161
SHA512635a3cb7a5b5df19820792c98a8656646d7c122e4836ae27e834185d1e759b7455080768986db516ef58c1196d76b0886a98ca0827a3edac8cc3736afca8fc99
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5709c2cfc1455bf0e769821346a0f2d8e
SHA1e432e3df95a6a62360eb5038c5e64c312b47e267
SHA256e593f2b931f12e270464a7bd9f28cc222b375a860b2705a0f01cfe5d25d8ed53
SHA5123afd00d975534d4cdecf49738f527ff4752c03d55d06c7f2e14c3325b2f99cfe14cbf277f05ccd8f2bd5856d022f69b4e15c10357934e5c6a238f9df5b01dfdd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5693db7c02a905bee04cc0c5dac49edd6
SHA1dfb076cb6fa6463c98aab4482688ec80b8ec113c
SHA256c30e460ce8c6a4245b11363b5f246620e3fe22e299f81f6cdaa0bfa348f5544a
SHA512a4e62eb4c1acd702dfde0fa9274a8a52b298c707af94d5bdd363d3445ff11a9901bc58976b6b9d96b16214016c943df127e0924dc13016035e0eb5e65e710de6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57f0ed77751696b0ca43ac7c8fd928fe5
SHA1c63eb59176b84dbb88dd40e23482bcd55adb1c6e
SHA25651e2c0649c013258cc0e49ab2a842428e93fdf480104b9eb9f97ec975e13db45
SHA512664b1adbe26c2909718a232ff3223db1e967bdd9c6c63f76b08bb1ee377aa066d1395a3d4ec7344b2b90de3a372965ece123506234d5af6f78f936f829af9c94
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51162a6ded9e4ab9a8fcc2689bbb17fe0
SHA110ae231b89c4a94257d622ca1b1c4c57cd3f2645
SHA256d26547f9c5caa104d56f1af802374b39903436845af253f0febb5620a128cc7c
SHA5121f8f3257376e232d61117ffeaed688c1acf05b2a556e8558819f982cfaabb5fd5df3a6884aa15e6668dd2bb3e5e90a13aca073a548da1c683923973c1d3e3712
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5be4ada03c4f584bb3b6137c9cf83759a
SHA1488f15239c84975602db9fa9c0b115ff3431045e
SHA2566af2fccb34fa2671362f61a83863bd432395a56a794be4aeba182e07fd32c011
SHA512ad5f477cd54530ed20a75671306a87080a8283796c72d6dbc2ddb94e5b5ca472253e7c79f1497c54afa905deced038fc264e28f0cb70d029b3aeec6683856723
-
memory/824-7-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/824-6-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/824-1-0x00000000778A4000-0x00000000778A6000-memory.dmpFilesize
8KB
-
memory/824-3-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/824-2-0x0000000000A50000-0x0000000000EFB000-memory.dmpFilesize
4.7MB
-
memory/824-4-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/824-5-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/824-0-0x0000000000A50000-0x0000000000EFB000-memory.dmpFilesize
4.7MB
-
memory/824-9-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/824-8-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/824-16-0x0000000000A50000-0x0000000000EFB000-memory.dmpFilesize
4.7MB
-
memory/824-11-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/824-10-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/1532-263-0x00007FFABEA20000-0x00007FFABF4E1000-memory.dmpFilesize
10.8MB
-
memory/2448-790-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-780-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-784-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-760-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-776-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-772-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-768-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-764-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/2448-758-0x0000000005B70000-0x0000000005DC4000-memory.dmpFilesize
2.3MB
-
memory/3140-87-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-23-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/3140-19-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-22-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/3140-561-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-235-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-26-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/3140-734-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-103-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-25-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/3140-24-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3140-412-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-21-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3140-479-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-631-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-20-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3140-27-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/3140-359-0x0000000000430000-0x00000000008DB000-memory.dmpFilesize
4.7MB
-
memory/3176-116-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/3176-109-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/3176-117-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/3676-101-0x00000000005F0000-0x00000000007AC000-memory.dmpFilesize
1.7MB
-
memory/3676-114-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/3676-115-0x0000000002A10000-0x0000000004A10000-memory.dmpFilesize
32.0MB
-
memory/3676-105-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/3676-102-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/3992-542-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3992-521-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4520-72-0x0000000005370000-0x0000000005914000-memory.dmpFilesize
5.6MB
-
memory/4520-77-0x0000000006240000-0x0000000006858000-memory.dmpFilesize
6.1MB
-
memory/4520-75-0x0000000004D50000-0x0000000004D5A000-memory.dmpFilesize
40KB
-
memory/4520-68-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4520-76-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/4520-88-0x0000000007BD0000-0x0000000007CDA000-memory.dmpFilesize
1.0MB
-
memory/4520-89-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/4520-106-0x0000000005D00000-0x0000000005D4C000-memory.dmpFilesize
304KB
-
memory/4520-74-0x0000000004DC0000-0x0000000004E52000-memory.dmpFilesize
584KB
-
memory/4520-100-0x0000000005C50000-0x0000000005C62000-memory.dmpFilesize
72KB
-
memory/4520-104-0x0000000005CB0000-0x0000000005CEC000-memory.dmpFilesize
240KB
-
memory/4520-199-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/4520-204-0x0000000005E20000-0x0000000005E86000-memory.dmpFilesize
408KB
-
memory/4520-248-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/4520-205-0x0000000007EE0000-0x0000000007F30000-memory.dmpFilesize
320KB
-
memory/4624-73-0x0000000002970000-0x0000000004970000-memory.dmpFilesize
32.0MB
-
memory/4624-196-0x0000000002970000-0x0000000004970000-memory.dmpFilesize
32.0MB
-
memory/4624-63-0x0000000000510000-0x000000000058A000-memory.dmpFilesize
488KB
-
memory/4624-64-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/4624-65-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/4624-71-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/4912-756-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-785-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-781-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-777-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-745-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-746-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-749-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-752-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-773-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-761-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-769-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/4912-765-0x00000000052D0000-0x00000000054EE000-memory.dmpFilesize
2.1MB
-
memory/5036-685-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/5036-618-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/5292-168-0x0000000005750000-0x00000000057C6000-memory.dmpFilesize
472KB
-
memory/5292-141-0x00000000001B0000-0x0000000000202000-memory.dmpFilesize
328KB
-
memory/5292-142-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/5292-174-0x0000000006010000-0x000000000602E000-memory.dmpFilesize
120KB
-
memory/5292-140-0x00000000734B0000-0x0000000073C60000-memory.dmpFilesize
7.7MB
-
memory/5308-225-0x000000001B580000-0x000000001B5BC000-memory.dmpFilesize
240KB
-
memory/5308-173-0x0000000000550000-0x00000000005DC000-memory.dmpFilesize
560KB
-
memory/5308-175-0x00007FFABEA20000-0x00007FFABF4E1000-memory.dmpFilesize
10.8MB
-
memory/5308-200-0x000000001B300000-0x000000001B310000-memory.dmpFilesize
64KB
-
memory/5308-245-0x000000001B5D0000-0x000000001B779000-memory.dmpFilesize
1.7MB
-
memory/5308-223-0x000000001DA70000-0x000000001DB7A000-memory.dmpFilesize
1.0MB
-
memory/5308-224-0x000000001B520000-0x000000001B532000-memory.dmpFilesize
72KB
-
memory/5504-441-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/5840-201-0x0000000002EA0000-0x0000000002EAB000-memory.dmpFilesize
44KB
-
memory/5840-202-0x0000000000400000-0x0000000002D4D000-memory.dmpFilesize
41.3MB
-
memory/5840-203-0x0000000002F90000-0x0000000003090000-memory.dmpFilesize
1024KB