Analysis

  • max time kernel
    75s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 21:02

General

  • Target

    8f1dc6a85630b9a36d235e7f4912309ac8afdfa136125d574b27376cfbb6d059.exe

  • Size

    1.8MB

  • MD5

    4ffe02ab61d06ce1dec85cfef4122de3

  • SHA1

    e92368cd89deb3ccb81ea21a4e6c6a1ab3a0fba7

  • SHA256

    8f1dc6a85630b9a36d235e7f4912309ac8afdfa136125d574b27376cfbb6d059

  • SHA512

    9a01c2baaad83cfe4188b530235cc01dca5bdaeab8c50e881ec36a3ca623afb32915cb9d1d007fd22b8e4d90ad9da4020443d384744127132d846e40935ca8cf

  • SSDEEP

    24576:n0aJQI47Yr+mjlsPjjI2n7D/aaHZf5ksG35LNapv8+eV2e4s8PS8tvvr+etm0cWS:7CejUjlnymwd7q0sPSu3HteW4n

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

redline

Botnet

Jok123

C2

185.215.113.67:26260

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.137.132:1632

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 32 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 9 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f1dc6a85630b9a36d235e7f4912309ac8afdfa136125d574b27376cfbb6d059.exe
    "C:\Users\Admin\AppData\Local\Temp\8f1dc6a85630b9a36d235e7f4912309ac8afdfa136125d574b27376cfbb6d059.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:2092
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=3536,i,10914981530159316853,12381340356750224673,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2372
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
        "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:1432
      • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
        "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:3700
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4908
              • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                4⤵
                  PID:1272
                • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                  4⤵
                    PID:2136
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                    4⤵
                      PID:4528
                      • C:\Windows\SysWOW64\choice.exe
                        choice /C Y /N /D Y /T 3
                        5⤵
                          PID:3348
                  • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
                    2⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    PID:3936
                    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
                      3⤵
                        PID:5744
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                          4⤵
                            PID:5700
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                              5⤵
                                PID:5732
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  6⤵
                                    PID:5860
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal
                                    6⤵
                                      PID:3440
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                  4⤵
                                    PID:3256
                              • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
                                2⤵
                                  PID:5272
                                • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
                                  2⤵
                                    PID:5684
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                    2⤵
                                      PID:5736
                                      • C:\Windows\system32\rundll32.exe
                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                        3⤵
                                          PID:5812
                                          • C:\Windows\system32\netsh.exe
                                            netsh wlan show profiles
                                            4⤵
                                              PID:6004
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\172592802658_Desktop.zip' -CompressionLevel Optimal
                                              4⤵
                                                PID:3736
                                          • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe"
                                            2⤵
                                              PID:4772
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe" /F
                                                3⤵
                                                • Creates scheduled task(s)
                                                PID:5368
                                            • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe"
                                              2⤵
                                                PID:5180
                                              • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
                                                2⤵
                                                  PID:5268
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    3⤵
                                                      PID:5252
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                                    2⤵
                                                      PID:4428
                                                    • C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe"
                                                      2⤵
                                                        PID:5532
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGsAcABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGkAcwAgAGMAbwBtAHAAdQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwB1AHAAcABvAHIAdABlAGQALAAgAHAAbABlAGEAcwBlACAAdAByAHkAIABhAGcAYQBpAG4AIABvAG4AIABhAG4AbwB0AGgAZQByACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB5AGMAYQAjAD4A"
                                                          3⤵
                                                            PID:6136
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAcAB5ACMAPgA="
                                                            3⤵
                                                              PID:2408
                                                            • C:\Users\Admin\AppData\Roaming\a.exe
                                                              "C:\Users\Admin\AppData\Roaming\a.exe"
                                                              3⤵
                                                                PID:5344
                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                  4⤵
                                                                    PID:2452
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                    4⤵
                                                                      PID:5440
                                                                      • C:\Windows\system32\wusa.exe
                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                        5⤵
                                                                          PID:2472
                                                                      • C:\Windows\system32\sc.exe
                                                                        C:\Windows\system32\sc.exe delete "TDFIYZSJ"
                                                                        4⤵
                                                                        • Launches sc.exe
                                                                        PID:3968
                                                                      • C:\Windows\system32\sc.exe
                                                                        C:\Windows\system32\sc.exe create "TDFIYZSJ" binpath= "C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe" start= "auto"
                                                                        4⤵
                                                                        • Launches sc.exe
                                                                        PID:5204
                                                                      • C:\Windows\system32\sc.exe
                                                                        C:\Windows\system32\sc.exe stop eventlog
                                                                        4⤵
                                                                        • Launches sc.exe
                                                                        PID:5516
                                                                      • C:\Windows\system32\sc.exe
                                                                        C:\Windows\system32\sc.exe start "TDFIYZSJ"
                                                                        4⤵
                                                                        • Launches sc.exe
                                                                        PID:5524
                                                                    • C:\Users\Admin\AppData\Roaming\b.exe
                                                                      "C:\Users\Admin\AppData\Roaming\b.exe"
                                                                      3⤵
                                                                        PID:4480
                                                                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                    1⤵
                                                                      PID:4588
                                                                    • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                      1⤵
                                                                        PID:4456
                                                                      • C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
                                                                        C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
                                                                        1⤵
                                                                          PID:5372
                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                            2⤵
                                                                              PID:1616
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                              2⤵
                                                                                PID:5440
                                                                                • C:\Windows\system32\wusa.exe
                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                  3⤵
                                                                                    PID:2808
                                                                                • C:\Windows\system32\conhost.exe
                                                                                  C:\Windows\system32\conhost.exe
                                                                                  2⤵
                                                                                    PID:5708
                                                                                  • C:\Windows\system32\conhost.exe
                                                                                    conhost.exe
                                                                                    2⤵
                                                                                      PID:3732

                                                                                  Network

                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                  Execution

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Persistence

                                                                                  Create or Modify System Process

                                                                                  2
                                                                                  T1543

                                                                                  Windows Service

                                                                                  2
                                                                                  T1543.003

                                                                                  Boot or Logon Autostart Execution

                                                                                  1
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Privilege Escalation

                                                                                  Create or Modify System Process

                                                                                  2
                                                                                  T1543

                                                                                  Windows Service

                                                                                  2
                                                                                  T1543.003

                                                                                  Boot or Logon Autostart Execution

                                                                                  1
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Defense Evasion

                                                                                  Virtualization/Sandbox Evasion

                                                                                  2
                                                                                  T1497

                                                                                  Impair Defenses

                                                                                  1
                                                                                  T1562

                                                                                  Modify Registry

                                                                                  1
                                                                                  T1112

                                                                                  Discovery

                                                                                  Query Registry

                                                                                  4
                                                                                  T1012

                                                                                  Virtualization/Sandbox Evasion

                                                                                  2
                                                                                  T1497

                                                                                  System Information Discovery

                                                                                  3
                                                                                  T1082

                                                                                  Impact

                                                                                  Service Stop

                                                                                  1
                                                                                  T1489

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                    Filesize

                                                                                    3KB

                                                                                    MD5

                                                                                    fe3aab3ae544a134b68e881b82b70169

                                                                                    SHA1

                                                                                    926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                                                                    SHA256

                                                                                    bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                                                                    SHA512

                                                                                    3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    d584df872086c0f7442a664a33d38fe5

                                                                                    SHA1

                                                                                    f0fad100fda4e8bb82ce5bc7d03953605ac53a5d

                                                                                    SHA256

                                                                                    fdb68980ecdb4c9b464cc6a07ec410b2c7dda5b01240a0a8c860e9a94fe372bc

                                                                                    SHA512

                                                                                    5232ebc39075096fa6ae5ae6d5b7b4580003e0be87779281c27fc1e0646500c76ca2178205ccc06e3b85df02a3a88ddb864723a3978cc97a9d63fa07196cdd79

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    Filesize

                                                                                    17KB

                                                                                    MD5

                                                                                    1a16663cc5f3ef4b5e90c160097454e3

                                                                                    SHA1

                                                                                    244689ae9307d9843de16ce61629596b89784f2a

                                                                                    SHA256

                                                                                    cdc614342f2a412a0be84d78edc68683e16d5f378683bce4e1a0b59b265ba1bc

                                                                                    SHA512

                                                                                    db4001b239d7f2bdbb17d09348a6369ce44410f0eb1be14be43bd17b50354c045dbb13b0d3dc280475a017bc3f98af84d14eabd5ee35035fa54b62dcbf8d917a

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    Filesize

                                                                                    944B

                                                                                    MD5

                                                                                    9b80cd7a712469a4c45fec564313d9eb

                                                                                    SHA1

                                                                                    6125c01bc10d204ca36ad1110afe714678655f2d

                                                                                    SHA256

                                                                                    5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                                                                                    SHA512

                                                                                    ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    352045fadf74e650c6b3cb62e96d13e4

                                                                                    SHA1

                                                                                    a05782075ce8f8a899dda15b4e162b1d298b1489

                                                                                    SHA256

                                                                                    2de9f908139d88104b42e23d4d5d4a273ce0b6b5ec66d686dba4359e740351bb

                                                                                    SHA512

                                                                                    312d40226e503846c76a89ec7982913ecc554bdb10d877082a1a751dd380a13a9b8e0b219ad26094a6974d7798134e4c17c51bff253ae4659a442747ecbf9dae

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    baa7aea69f1fc6de5c6744a3de244d9c

                                                                                    SHA1

                                                                                    7ac32cd8e4afa29cbb6c04bb8727735c29ebadc5

                                                                                    SHA256

                                                                                    adb474e336b151cf28ead952e8248f9ec8daf30aadc78e716822d9c27f6dde69

                                                                                    SHA512

                                                                                    4927c72a9d778a8343f812714356150069349e39937f2e32c62f19ffee226b94eada91756f07f96e22472252f20185177038b3e1e1dd7b8920d676e4e2198f0c

                                                                                  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                                    Filesize

                                                                                    1.8MB

                                                                                    MD5

                                                                                    4ffe02ab61d06ce1dec85cfef4122de3

                                                                                    SHA1

                                                                                    e92368cd89deb3ccb81ea21a4e6c6a1ab3a0fba7

                                                                                    SHA256

                                                                                    8f1dc6a85630b9a36d235e7f4912309ac8afdfa136125d574b27376cfbb6d059

                                                                                    SHA512

                                                                                    9a01c2baaad83cfe4188b530235cc01dca5bdaeab8c50e881ec36a3ca623afb32915cb9d1d007fd22b8e4d90ad9da4020443d384744127132d846e40935ca8cf

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
                                                                                    Filesize

                                                                                    2.9MB

                                                                                    MD5

                                                                                    3be2c82f1d245feafc826b8f786fa525

                                                                                    SHA1

                                                                                    1cc1a1f1bcce41032cfae09e576ac895b1a64084

                                                                                    SHA256

                                                                                    23ce1e7b38187460fa783503838278047cbd6a85cb55d88e892d932595c9d1c2

                                                                                    SHA512

                                                                                    6411f455f895669bd780d8b7475aa55d4ca8ae9406d73d197cc6e592ef2333b172530f232b694a19eb0b837dfeebe355065e0fbc70aae2087e26e9d6d4b0e7a1

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                                                    Filesize

                                                                                    1.7MB

                                                                                    MD5

                                                                                    85a15f080b09acace350ab30460c8996

                                                                                    SHA1

                                                                                    3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                                                    SHA256

                                                                                    3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                                                    SHA512

                                                                                    ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                                                                                    Filesize

                                                                                    1.8MB

                                                                                    MD5

                                                                                    580643b99b04be7565391dd1d33c2a0a

                                                                                    SHA1

                                                                                    2dd4e4a2c95c92adc1cb69a849fe1a7dde198a6a

                                                                                    SHA256

                                                                                    212dbe7ed0d02688939def1ca2fad347f44091dfa1b8e0d47b9d90585f4178f0

                                                                                    SHA512

                                                                                    fcf93cb8c3d2ab74372f0dfd1755167a389060c64c66bfb3a2b27b70a22db4f0eef2913a72179c374deeeaefcfb3828ecd7e07991929ae822697d08f9b9c9786

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                                                    Filesize

                                                                                    301KB

                                                                                    MD5

                                                                                    832eb4dc3ed8ceb9a1735bd0c7acaf1b

                                                                                    SHA1

                                                                                    b622a406927fbb8f6cd5081bd4455fb831948fca

                                                                                    SHA256

                                                                                    2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                                                                                    SHA512

                                                                                    3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                                                    Filesize

                                                                                    499KB

                                                                                    MD5

                                                                                    83d0b41c7a3a0d29a268b49a313c5de5

                                                                                    SHA1

                                                                                    46f3251c771b67b40b1f3268caef8046174909a5

                                                                                    SHA256

                                                                                    09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                                                                                    SHA512

                                                                                    705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                    Filesize

                                                                                    418KB

                                                                                    MD5

                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                    SHA1

                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                    SHA256

                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                    SHA512

                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001051001\Umr.exe
                                                                                    Filesize

                                                                                    296B

                                                                                    MD5

                                                                                    f2f4183ae342466a505cb5b8dc850ce2

                                                                                    SHA1

                                                                                    3f6ddc6152d0190108953e410ec62e8abcdc51d1

                                                                                    SHA256

                                                                                    fc56488690aec272d2853fb59f6678391f19fc67707ed0e31688d337d5159b7d

                                                                                    SHA512

                                                                                    aa5cfb6e787255918880e1e71703c2280e0012ed08d5eaf5a91f8d43d984a8f30107b852bfc74eb1b6004032e4c91cb985629fea3a0a3579ac64564f8c542c73

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                                                                    Filesize

                                                                                    2.8MB

                                                                                    MD5

                                                                                    1e1152424d7721a51a154a725fe2465e

                                                                                    SHA1

                                                                                    62bc3d11e915e1dbd3cc3ef5a11afec755c995d9

                                                                                    SHA256

                                                                                    674cf1a8997ec6ac5b29b8d7eb6a5fb63ce5aaf4b19ff1ec7749b0225c49906c

                                                                                    SHA512

                                                                                    752e7912d30a2f006ef79600b7412db61644630471ec44bab1e5b2565ef62ccb490ea69159420bb7626248cc8113fe07c09fa51f5c630646b179d880e18b7c02

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                                                    Filesize

                                                                                    464KB

                                                                                    MD5

                                                                                    c084d6f6ba40534fbfc5a64b21ef99ab

                                                                                    SHA1

                                                                                    0b4a17da83c0a8abbc8fab321931d5447b32b720

                                                                                    SHA256

                                                                                    afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                                                                                    SHA512

                                                                                    a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe
                                                                                    Filesize

                                                                                    2.6MB

                                                                                    MD5

                                                                                    55e393da1714013720ddf266c7906f43

                                                                                    SHA1

                                                                                    91a636913604184c010c2d9e0b331a804a2c0ab4

                                                                                    SHA256

                                                                                    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957

                                                                                    SHA512

                                                                                    40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a

                                                                                  • C:\Users\Admin\AppData\Local\Temp\Tmp9E3F.tmp
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                    SHA1

                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                    SHA256

                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                    SHA512

                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tlimddky.f11.ps1
                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpF191.tmp
                                                                                    Filesize

                                                                                    46KB

                                                                                    MD5

                                                                                    02d2c46697e3714e49f46b680b9a6b83

                                                                                    SHA1

                                                                                    84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                    SHA256

                                                                                    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                    SHA512

                                                                                    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpF32D.tmp
                                                                                    Filesize

                                                                                    56KB

                                                                                    MD5

                                                                                    d444c807029c83b8a892ac0c4971f955

                                                                                    SHA1

                                                                                    fa58ce7588513519dc8fed939b26b05dc25e53b5

                                                                                    SHA256

                                                                                    8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

                                                                                    SHA512

                                                                                    b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpF35F.tmp
                                                                                    Filesize

                                                                                    220KB

                                                                                    MD5

                                                                                    f58f3c024c0cc1492671f6149f72eded

                                                                                    SHA1

                                                                                    8a5658c1836d9c42f9c1f15ac54796a64f57b704

                                                                                    SHA256

                                                                                    833f145fc9f886b823389d678b397ceddf658389d62bb559007b769adb12d8e1

                                                                                    SHA512

                                                                                    a2f8a69d76f85ec22c1153695807ba981319b01189540ec739dd82b35f36f5b23e6f9e56c5e14bdc57bfba5d9400bcc0389ac15451b430fdf6ba0e8d13f9ad4c

                                                                                  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                                                    Filesize

                                                                                    109KB

                                                                                    MD5

                                                                                    2afdbe3b99a4736083066a13e4b5d11a

                                                                                    SHA1

                                                                                    4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                                                    SHA256

                                                                                    8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                                                    SHA512

                                                                                    d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                                                  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                    Filesize

                                                                                    1.2MB

                                                                                    MD5

                                                                                    92fbdfccf6a63acef2743631d16652a7

                                                                                    SHA1

                                                                                    971968b1378dd89d59d7f84bf92f16fc68664506

                                                                                    SHA256

                                                                                    b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                                                    SHA512

                                                                                    b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-817259280-2658881748-983986378-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ecf37202-91c8-40df-bd53-4dff817a3c5a
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    75b25be9942dd439623c724dcce8fbd2

                                                                                    SHA1

                                                                                    9fb93365126d9ecf1ed20377cf408fca0d10c762

                                                                                    SHA256

                                                                                    bf4c7fa1664ddd20bf947a8149a714b1ce434883e272d434662a9733d8f59da1

                                                                                    SHA512

                                                                                    09342e31e40f021c6d2b7eece2f062aca3533d4fa7600590f6cef9f5236b1120e9c0b1d2ec307f0255895fbbf19f43d2ded91b830344ee185cf8c887fb5b8d10

                                                                                  • C:\Users\Admin\AppData\Roaming\a.exe
                                                                                    Filesize

                                                                                    2.5MB

                                                                                    MD5

                                                                                    6fd62e635b39a02ba8cac6fc124c9475

                                                                                    SHA1

                                                                                    e13080b9cc546e44a9f1c419ba86aeb190a14b2d

                                                                                    SHA256

                                                                                    78b9d7e485026278b02a1961999ad99cdfa988fbf4403767db5d10d1473e9870

                                                                                    SHA512

                                                                                    e77432582e6abcc0fd86ed997c9c4619bd67a044d33a752e1cf3ceb8008cea27c540949183b80f9dee8a41614cff54afe79c5db294efcb72b27685fcf1010cdc

                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                    Filesize

                                                                                    109KB

                                                                                    MD5

                                                                                    726cd06231883a159ec1ce28dd538699

                                                                                    SHA1

                                                                                    404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                    SHA256

                                                                                    12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                    SHA512

                                                                                    9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                                                    Filesize

                                                                                    1.2MB

                                                                                    MD5

                                                                                    15a42d3e4579da615a384c717ab2109b

                                                                                    SHA1

                                                                                    22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                                                                    SHA256

                                                                                    3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                                                                    SHA512

                                                                                    1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                                                                  • C:\Users\Admin\AppData\Roaming\b.exe
                                                                                    Filesize

                                                                                    95KB

                                                                                    MD5

                                                                                    184ac479b3a878e9ac5535770ca34a2b

                                                                                    SHA1

                                                                                    1f99039911cc2cfd1a62ce348429ddd0f4435a60

                                                                                    SHA256

                                                                                    8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c

                                                                                    SHA512

                                                                                    e0f5185ae890b902ea5325066df23959106712e7990e120a1b9752bbd0331cac968af5ddd6092f75a1c576d4c83f4093dfbf53a2c90870d1c02b31a0e8282bb4

                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                                                    Filesize

                                                                                    541KB

                                                                                    MD5

                                                                                    1fc4b9014855e9238a361046cfbf6d66

                                                                                    SHA1

                                                                                    c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                                                    SHA256

                                                                                    f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                                                    SHA512

                                                                                    2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                                                    Filesize

                                                                                    304KB

                                                                                    MD5

                                                                                    cc90e3326d7b20a33f8037b9aab238e4

                                                                                    SHA1

                                                                                    236d173a6ac462d85de4e866439634db3b9eeba3

                                                                                    SHA256

                                                                                    bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                                                    SHA512

                                                                                    b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    7bab3b045d0c5edf1de44794b65e4c6f

                                                                                    SHA1

                                                                                    375dbc58876c2784a7de051e0ef9295e9910f571

                                                                                    SHA256

                                                                                    cc80ccadf1f9e06190e16c9c2ddea2920b0df40f710ae7f116a16c67dfe63f63

                                                                                    SHA512

                                                                                    1cb04a7450f4288280e4e95be77e8674d58c416bee3db191feed0bb1cc23ed017b0b0770fd4dd470415c5c1eb0e84957227b7f09a55562952a2112cc1143ee47

                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    e94400c90c32966765f186c5f924669f

                                                                                    SHA1

                                                                                    899e75629f6809d1608225a4e6b1463779df30d2

                                                                                    SHA256

                                                                                    e6e2d29771f1424e6a89fe072807867fb88e5f41a85d1fb032d2ac5a0cb29d89

                                                                                    SHA512

                                                                                    ffbc04333564a2f00dd562fec2ece2173496e358da4882f3e9ca2bc51bdd820c8e3ea3b6e49f81e87f42f6ef0a45c08a8a78591d28405a2b7cea86abab15df17

                                                                                  • memory/1272-123-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/1272-125-0x0000000005800000-0x0000000005892000-memory.dmp
                                                                                    Filesize

                                                                                    584KB

                                                                                  • memory/1272-185-0x0000000006C40000-0x0000000006C5E000-memory.dmp
                                                                                    Filesize

                                                                                    120KB

                                                                                  • memory/1272-174-0x0000000006480000-0x00000000064F6000-memory.dmp
                                                                                    Filesize

                                                                                    472KB

                                                                                  • memory/1272-154-0x0000000005950000-0x0000000005960000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1272-140-0x00000000058B0000-0x00000000058BA000-memory.dmp
                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1272-122-0x0000000000EE0000-0x0000000000F32000-memory.dmp
                                                                                    Filesize

                                                                                    328KB

                                                                                  • memory/1272-124-0x0000000005CD0000-0x0000000006274000-memory.dmp
                                                                                    Filesize

                                                                                    5.6MB

                                                                                  • memory/1432-126-0x0000000000290000-0x0000000000629000-memory.dmp
                                                                                    Filesize

                                                                                    3.6MB

                                                                                  • memory/1432-407-0x0000000000290000-0x0000000000629000-memory.dmp
                                                                                    Filesize

                                                                                    3.6MB

                                                                                  • memory/1432-49-0x0000000000290000-0x0000000000629000-memory.dmp
                                                                                    Filesize

                                                                                    3.6MB

                                                                                  • memory/1432-48-0x0000000000290000-0x0000000000629000-memory.dmp
                                                                                    Filesize

                                                                                    3.6MB

                                                                                  • memory/1432-229-0x0000000000290000-0x0000000000629000-memory.dmp
                                                                                    Filesize

                                                                                    3.6MB

                                                                                  • memory/1684-23-0x0000000005150000-0x0000000005151000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-22-0x0000000005130000-0x0000000005131000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-272-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-451-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-26-0x0000000005100000-0x0000000005101000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-100-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-28-0x0000000005170000-0x0000000005171000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-19-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-117-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-25-0x0000000005110000-0x0000000005111000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-21-0x0000000005120000-0x0000000005121000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-27-0x0000000005180000-0x0000000005181000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-20-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/1684-24-0x00000000050F0000-0x00000000050F1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1684-79-0x00000000000F0000-0x00000000005A2000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/2092-9-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-4-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-1-0x0000000077604000-0x0000000077606000-memory.dmp
                                                                                    Filesize

                                                                                    8KB

                                                                                  • memory/2092-2-0x00000000008E0000-0x0000000000D92000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/2092-0-0x00000000008E0000-0x0000000000D92000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/2092-3-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-16-0x00000000008E0000-0x0000000000D92000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/2092-11-0x0000000004C20000-0x0000000004C21000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-6-0x0000000004C10000-0x0000000004C11000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-10-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-7-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2092-8-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/2136-178-0x00007FFD10FE0000-0x00007FFD11AA1000-memory.dmp
                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/2136-177-0x0000000000A20000-0x0000000000AAC000-memory.dmp
                                                                                    Filesize

                                                                                    560KB

                                                                                  • memory/3936-136-0x0000000000E00000-0x00000000012BD000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/3936-149-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-151-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-121-0x0000000000E00000-0x00000000012BD000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/3936-139-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-137-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-226-0x0000000000E00000-0x00000000012BD000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB

                                                                                  • memory/3936-141-0x0000000005010000-0x0000000005011000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-181-0x0000000005040000-0x0000000005041000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-175-0x0000000005030000-0x0000000005031000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/3936-138-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/4456-77-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/4456-69-0x00000000006C0000-0x000000000087C000-memory.dmp
                                                                                    Filesize

                                                                                    1.7MB

                                                                                  • memory/4456-70-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/4456-71-0x00000000052A0000-0x00000000052B0000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4456-78-0x0000000002C10000-0x0000000004C10000-memory.dmp
                                                                                    Filesize

                                                                                    32.0MB

                                                                                  • memory/4456-231-0x0000000002C10000-0x0000000004C10000-memory.dmp
                                                                                    Filesize

                                                                                    32.0MB

                                                                                  • memory/4908-232-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/4908-74-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/4908-82-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/4908-83-0x0000000005000000-0x0000000005010000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/5180-425-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-440-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-327-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-395-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-324-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-400-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-402-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-404-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-323-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-329-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-409-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-415-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-418-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-340-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-365-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-433-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-342-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-437-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-363-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-367-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-444-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-447-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-450-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-346-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-353-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-356-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-359-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5180-361-0x00000000050C0000-0x00000000052D6000-memory.dmp
                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/5252-432-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                    Filesize

                                                                                    320KB

                                                                                  • memory/5272-179-0x0000000005AC0000-0x00000000060D8000-memory.dmp
                                                                                    Filesize

                                                                                    6.1MB

                                                                                  • memory/5272-169-0x0000000000050000-0x00000000000A0000-memory.dmp
                                                                                    Filesize

                                                                                    320KB

                                                                                  • memory/5272-173-0x0000000072F80000-0x0000000073730000-memory.dmp
                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/5272-180-0x0000000004BC0000-0x0000000004BD0000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/5272-182-0x0000000004CE0000-0x0000000004DEA000-memory.dmp
                                                                                    Filesize

                                                                                    1.0MB

                                                                                  • memory/5272-183-0x0000000004BF0000-0x0000000004C02000-memory.dmp
                                                                                    Filesize

                                                                                    72KB

                                                                                  • memory/5272-184-0x0000000004C50000-0x0000000004C8C000-memory.dmp
                                                                                    Filesize

                                                                                    240KB

                                                                                  • memory/5272-211-0x0000000004DF0000-0x0000000004E3C000-memory.dmp
                                                                                    Filesize

                                                                                    304KB

                                                                                  • memory/5744-410-0x0000000000400000-0x00000000008BD000-memory.dmp
                                                                                    Filesize

                                                                                    4.7MB