Overview
overview
7Static
static
3files.zip
windows10-2004-x64
1HorizonXbe...PF.dll
windows10-2004-x64
1HorizonXbe...IX.exe
windows10-2004-x64
7HorizionXbetaFIX.pyc
windows10-2004-x64
3HorizonXbe...UI.dll
windows10-2004-x64
1HorizonXbe...up.exe
windows10-2004-x64
7HorizonXbe...up.exe
windows10-2004-x64
7HorizonXbe...st.exe
windows10-2004-x64
6HorizonXbe...64.exe
windows10-2004-x64
7HorizonXbe...86.exe
windows10-2004-x64
7HorizonXbe...64.exe
windows10-2004-x64
7HorizonXbe...86.exe
windows10-2004-x64
7HorizonXbe...st.msi
windows10-2004-x64
6HorizonXbe....0.dll
windows10-2004-x64
1HorizonXbe...50.dll
windows10-2004-x64
1Analysis
-
max time kernel
110s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 09:09
Behavioral task
behavioral1
Sample
files.zip
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
HorizonXbeta/FluentWPF.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
HorizonXbeta/HorizionXbetaFIX.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
HorizionXbetaFIX.pyc
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
HorizonXbeta/luaGUI.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral6
Sample
HorizonXbeta/redist/dotNetFx40_Full_setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
HorizonXbeta/redist/dxwebsetup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
HorizonXbeta/redist/oalinst.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
HorizonXbeta/redist/vcredist_2015-2019_x64.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
HorizonXbeta/redist/vcredist_2015-2019_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
HorizonXbeta/redist/vcredist_x64.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral12
Sample
HorizonXbeta/redist/vcredist_x86.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
HorizonXbeta/redist/xnafx40_redist.msi
Resource
win10v2004-20240412-en
Behavioral task
behavioral14
Sample
HorizonXbeta/x64/leptonica-1.82.0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
HorizonXbeta/x64/tesseract50.dll
Resource
win10v2004-20240412-en
General
-
Target
HorizonXbeta/HorizionXbetaFIX.exe
-
Size
30.0MB
-
MD5
e3e408b7aaf6e1b6e41e4725ee03ec76
-
SHA1
34f9797389b574ddef7373770795f5f001e63263
-
SHA256
707df1515ab62e28470f1999946e7483abb5a41a4f5ac165871f56c47dc6b6a6
-
SHA512
6e905cf221184826cbcd44a7c2b20550662437c7fdea5566dddab24f48319fe086d6054d84824fae00f68ba18c3e00cef90ed942c2aacd698895348388094cd3
-
SSDEEP
393216:tv9zcQq08AUh2Jp5MPL+9qzTqSJHU1JfjJ+7j6dpdkqYv1:p9gQwhZ+9qHqSJHU1xj2q0qE
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
HorizionXbetaFIX.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HorizionXbetaFIX.exe HorizionXbetaFIX.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HorizionXbetaFIX.exe HorizionXbetaFIX.exe -
Loads dropped DLL 52 IoCs
Processes:
HorizionXbetaFIX.exepid process 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI36122\python311.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ctypes.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\libffi-8.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_lzma.pyd upx behavioral3/memory/4524-107-0x00007FFB1EB90000-0x00007FFB1F17E000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_socket.pyd upx behavioral3/memory/4524-140-0x00007FFB26640000-0x00007FFB2666D000-memory.dmp upx behavioral3/memory/4524-142-0x00007FFB266D0000-0x00007FFB266E9000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\select.pyd upx behavioral3/memory/4524-144-0x00007FFB22E20000-0x00007FFB22E39000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ssl.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_overlapped.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_multiprocessing.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_cffi_backend.cp311-win_amd64.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_asyncio.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\pyexpat.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\libssl-3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\libcrypto-3.dll upx behavioral3/memory/4524-139-0x00007FFB28BB0000-0x00007FFB28BBF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\_bz2.pyd upx behavioral3/memory/4524-117-0x00007FFB27380000-0x00007FFB273A4000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\pywin32_system32\pywintypes311.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\pywin32_system32\pythoncom311.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\win32\win32api.pyd upx behavioral3/memory/4524-159-0x00007FFB229C0000-0x00007FFB229EB000-memory.dmp upx behavioral3/memory/4524-158-0x00007FFB229F0000-0x00007FFB22AAC000-memory.dmp upx behavioral3/memory/4524-156-0x00007FFB22C60000-0x00007FFB22C96000-memory.dmp upx behavioral3/memory/4524-153-0x00007FFB22AB0000-0x00007FFB22ADE000-memory.dmp upx behavioral3/memory/4524-145-0x00007FFB235B0000-0x00007FFB235BD000-memory.dmp upx behavioral3/memory/4524-150-0x00007FFB22E10000-0x00007FFB22E1D000-memory.dmp upx behavioral3/memory/4524-165-0x00007FFB13B30000-0x00007FFB14052000-memory.dmp upx behavioral3/memory/4524-161-0x00007FFB22980000-0x00007FFB229B3000-memory.dmp upx behavioral3/memory/4524-174-0x00007FFB22580000-0x00007FFB225A3000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\psutil\_psutil_windows.pyd upx behavioral3/memory/4524-171-0x00007FFB225B0000-0x00007FFB225C2000-memory.dmp upx behavioral3/memory/4524-175-0x00007FFB1EA10000-0x00007FFB1EB86000-memory.dmp upx behavioral3/memory/4524-177-0x00007FFB225D0000-0x00007FFB2269D000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\charset_normalizer\md.cp311-win_amd64.pyd upx behavioral3/memory/4524-182-0x00007FFB22560000-0x00007FFB22578000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\charset_normalizer\md__mypyc.cp311-win_amd64.pyd upx behavioral3/memory/4524-189-0x00007FFB1E8F0000-0x00007FFB1EA0C000-memory.dmp upx behavioral3/memory/4524-187-0x00007FFB21D90000-0x00007FFB21DB6000-memory.dmp upx behavioral3/memory/4524-190-0x00007FFB21DC0000-0x00007FFB21E47000-memory.dmp upx behavioral3/memory/4524-179-0x00007FFB22890000-0x00007FFB228A5000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI36122\zstandard\backend_c.cp311-win_amd64.pyd upx behavioral3/memory/4524-193-0x00007FFB21D50000-0x00007FFB21D88000-memory.dmp upx behavioral3/memory/4524-192-0x00007FFB22DF0000-0x00007FFB22DFB000-memory.dmp upx behavioral3/memory/4524-191-0x00007FFB22540000-0x00007FFB22554000-memory.dmp upx behavioral3/memory/4524-194-0x00007FFB22530000-0x00007FFB2253B000-memory.dmp upx behavioral3/memory/4524-197-0x00007FFB216E0000-0x00007FFB216EB000-memory.dmp upx behavioral3/memory/4524-196-0x00007FFB21D40000-0x00007FFB21D4C000-memory.dmp upx behavioral3/memory/4524-198-0x00007FFB20910000-0x00007FFB2091C000-memory.dmp upx behavioral3/memory/4524-211-0x00007FFB20900000-0x00007FFB2090B000-memory.dmp upx behavioral3/memory/4524-212-0x00007FFB1E8E0000-0x00007FFB1E8EC000-memory.dmp upx behavioral3/memory/4524-213-0x00007FFB1E8D0000-0x00007FFB1E8DC000-memory.dmp upx behavioral3/memory/4524-216-0x00007FFB1E8C0000-0x00007FFB1E8CE000-memory.dmp upx behavioral3/memory/4524-219-0x00007FFB1E4F0000-0x00007FFB1E4FB000-memory.dmp upx behavioral3/memory/4524-218-0x00007FFB1E810000-0x00007FFB1E81B000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 15 raw.githubusercontent.com 19 raw.githubusercontent.com 37 discord.com 38 discord.com 46 discord.com 49 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 api.ipify.org 43 api.ipify.org -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
HorizionXbetaFIX.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 4524 HorizionXbetaFIX.exe 3344 powershell.exe 3344 powershell.exe 3616 powershell.exe 3616 powershell.exe 5016 powershell.exe 5016 powershell.exe 4620 powershell.exe 4620 powershell.exe 3424 powershell.exe 3424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
HorizionXbetaFIX.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exewmic.exedescription pid process Token: SeDebugPrivilege 4524 HorizionXbetaFIX.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 3616 powershell.exe Token: SeDebugPrivilege 5016 powershell.exe Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 3424 powershell.exe Token: SeIncreaseQuotaPrivilege 2032 WMIC.exe Token: SeSecurityPrivilege 2032 WMIC.exe Token: SeTakeOwnershipPrivilege 2032 WMIC.exe Token: SeLoadDriverPrivilege 2032 WMIC.exe Token: SeSystemProfilePrivilege 2032 WMIC.exe Token: SeSystemtimePrivilege 2032 WMIC.exe Token: SeProfSingleProcessPrivilege 2032 WMIC.exe Token: SeIncBasePriorityPrivilege 2032 WMIC.exe Token: SeCreatePagefilePrivilege 2032 WMIC.exe Token: SeBackupPrivilege 2032 WMIC.exe Token: SeRestorePrivilege 2032 WMIC.exe Token: SeShutdownPrivilege 2032 WMIC.exe Token: SeDebugPrivilege 2032 WMIC.exe Token: SeSystemEnvironmentPrivilege 2032 WMIC.exe Token: SeRemoteShutdownPrivilege 2032 WMIC.exe Token: SeUndockPrivilege 2032 WMIC.exe Token: SeManageVolumePrivilege 2032 WMIC.exe Token: 33 2032 WMIC.exe Token: 34 2032 WMIC.exe Token: 35 2032 WMIC.exe Token: 36 2032 WMIC.exe Token: SeIncreaseQuotaPrivilege 2032 WMIC.exe Token: SeSecurityPrivilege 2032 WMIC.exe Token: SeTakeOwnershipPrivilege 2032 WMIC.exe Token: SeLoadDriverPrivilege 2032 WMIC.exe Token: SeSystemProfilePrivilege 2032 WMIC.exe Token: SeSystemtimePrivilege 2032 WMIC.exe Token: SeProfSingleProcessPrivilege 2032 WMIC.exe Token: SeIncBasePriorityPrivilege 2032 WMIC.exe Token: SeCreatePagefilePrivilege 2032 WMIC.exe Token: SeBackupPrivilege 2032 WMIC.exe Token: SeRestorePrivilege 2032 WMIC.exe Token: SeShutdownPrivilege 2032 WMIC.exe Token: SeDebugPrivilege 2032 WMIC.exe Token: SeSystemEnvironmentPrivilege 2032 WMIC.exe Token: SeRemoteShutdownPrivilege 2032 WMIC.exe Token: SeUndockPrivilege 2032 WMIC.exe Token: SeManageVolumePrivilege 2032 WMIC.exe Token: 33 2032 WMIC.exe Token: 34 2032 WMIC.exe Token: 35 2032 WMIC.exe Token: 36 2032 WMIC.exe Token: SeIncreaseQuotaPrivilege 4284 wmic.exe Token: SeSecurityPrivilege 4284 wmic.exe Token: SeTakeOwnershipPrivilege 4284 wmic.exe Token: SeLoadDriverPrivilege 4284 wmic.exe Token: SeSystemProfilePrivilege 4284 wmic.exe Token: SeSystemtimePrivilege 4284 wmic.exe Token: SeProfSingleProcessPrivilege 4284 wmic.exe Token: SeIncBasePriorityPrivilege 4284 wmic.exe Token: SeCreatePagefilePrivilege 4284 wmic.exe Token: SeBackupPrivilege 4284 wmic.exe Token: SeRestorePrivilege 4284 wmic.exe Token: SeShutdownPrivilege 4284 wmic.exe Token: SeDebugPrivilege 4284 wmic.exe Token: SeSystemEnvironmentPrivilege 4284 wmic.exe Token: SeRemoteShutdownPrivilege 4284 wmic.exe Token: SeUndockPrivilege 4284 wmic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
HorizionXbetaFIX.exeHorizionXbetaFIX.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3612 wrote to memory of 4524 3612 HorizionXbetaFIX.exe HorizionXbetaFIX.exe PID 3612 wrote to memory of 4524 3612 HorizionXbetaFIX.exe HorizionXbetaFIX.exe PID 4524 wrote to memory of 5104 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 5104 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 4768 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 4768 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 1172 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 1172 4524 HorizionXbetaFIX.exe cmd.exe PID 4768 wrote to memory of 4492 4768 cmd.exe netsh.exe PID 4768 wrote to memory of 4492 4768 cmd.exe netsh.exe PID 1172 wrote to memory of 3344 1172 cmd.exe powershell.exe PID 1172 wrote to memory of 3344 1172 cmd.exe powershell.exe PID 4524 wrote to memory of 1856 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 1856 4524 HorizionXbetaFIX.exe cmd.exe PID 1856 wrote to memory of 3616 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 3616 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 5016 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 5016 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 4620 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 4620 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 3424 1856 cmd.exe powershell.exe PID 1856 wrote to memory of 3424 1856 cmd.exe powershell.exe PID 4524 wrote to memory of 3504 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 3504 4524 HorizionXbetaFIX.exe cmd.exe PID 3504 wrote to memory of 2032 3504 cmd.exe WMIC.exe PID 3504 wrote to memory of 2032 3504 cmd.exe WMIC.exe PID 4524 wrote to memory of 4284 4524 HorizionXbetaFIX.exe wmic.exe PID 4524 wrote to memory of 4284 4524 HorizionXbetaFIX.exe wmic.exe PID 4524 wrote to memory of 3728 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 3728 4524 HorizionXbetaFIX.exe cmd.exe PID 3728 wrote to memory of 2284 3728 cmd.exe WMIC.exe PID 3728 wrote to memory of 2284 3728 cmd.exe WMIC.exe PID 4524 wrote to memory of 4272 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 4272 4524 HorizionXbetaFIX.exe cmd.exe PID 4272 wrote to memory of 3904 4272 cmd.exe WMIC.exe PID 4272 wrote to memory of 3904 4272 cmd.exe WMIC.exe PID 4524 wrote to memory of 2564 4524 HorizionXbetaFIX.exe cmd.exe PID 4524 wrote to memory of 2564 4524 HorizionXbetaFIX.exe cmd.exe PID 2564 wrote to memory of 4612 2564 cmd.exe WMIC.exe PID 2564 wrote to memory of 4612 2564 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\HorizionXbetaFIX.exe"C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\HorizionXbetaFIX.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\HorizionXbetaFIX.exe"C:\Users\Admin\AppData\Local\Temp\HorizonXbeta\HorizionXbetaFIX.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid4⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\VCRUNTIME140_1.dllFilesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_asyncio.pydFilesize
36KB
MD5175700fdf830363d7abf41f83f5118d8
SHA10f2be2078f414ffd15f003913593a4f776d0fa85
SHA25628444204cec80cb5b713ae58578dd3522ba9cd271a91079988cd4193db75fa8a
SHA5124353dad4137ef3f2654a949c99395182051d74b8b1d54c6c7bb2485709a85bca6bb820969cf3fb215e686a0d16fd5cb52366376e30efd81988202cccf868a40a
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_bz2.pydFilesize
48KB
MD5e2c477b849154e0172857b3ac1ee3d86
SHA108b9089cb5dbd4f1f65607fad842674389a79ed9
SHA256a58958e5edfa837f9da608b9eb22ad0c4c8f6a3ebc8ff04ef6f3be161f56d069
SHA512f09243fdb6933eae7f4d1cb8b80d914d5c24975cbad8e03a6549e7f187309304ec505732934fd4221a8058877557c7568e41faca57f5032506596abad0c79586
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_cffi_backend.cp311-win_amd64.pydFilesize
71KB
MD555ce382885e748cdc4b567eccf3322e7
SHA188a041792b248b038fdd68cf8200a5ee6de30e12
SHA256d76ccd558721ac80f8215f4e03ad2d49773b3e6aa29aaa01aaf006d9e7f51470
SHA5125f3442b8fdde917f351eb0cf72cf3ae7e45ec4eea74b89bf937f4f2601582ddc5a3c865a70162344f542f877a2e6f7ac8cdbf5fb1dbface560a6992c350c2f4b
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ctypes.pydFilesize
58KB
MD53b537491b8e1b715b42713bd39b1d8a0
SHA159a275be3a8c1d3271a766607fbdb3d19bbdc7c0
SHA256cf8c30616997222cdd3562e4ca3a8012c8275a0afc0f1514aeaeb3d6ccb7f025
SHA5126193f91dc0daabf9ec6591e71c76e1587571e4809182c52815cac678bdb5d58d78ec637cf265ae98c8a604fe000165675a94cab4c39742d13c2450bc84e187f1
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_decimal.pydFilesize
106KB
MD58b7c775fd219b5387aa04316a19dc996
SHA1ae12bdf7bebb53048d61625bdecef9349dfb6079
SHA2569f12be54223f203672da082de5ac60c33e506a307cc136b52ca5a259af759d51
SHA512014d801ece4318eeddacdf8d07c394a94c548dcffaf28528386f80e849001c3f45f90e3ab432a7ab601496eb30f849f101bbec7f2055d512b819721038b08963
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_hashlib.pydFilesize
35KB
MD5653c25f88e513480415057a4a572aeed
SHA1f654aaf661964df51db34de49a53c8f76cac2d8d
SHA2565be45c9de69b388b900fd17525c047569273e71c47b00b4a1531f3741e3ab699
SHA512dd887042b9c3880c95cfa0ba35f6ed26be294cd75fc3b758f47f4671a33c72f9efdfb9152eb3a65dbb9366b5ecbe01b5140aedc182f352ee113fcfc5213e526b
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_lzma.pydFilesize
86KB
MD5cc65d1bc9ae05531e3133bde291b9935
SHA1f8c3f598558d4fb81567497534eedb80aa36ed05
SHA2567495562061ed6cf4a91b2d147babcb3235cee3b75ac94972852498720fb560a7
SHA5124bf4d27a1d061a230489eb8c1fc0bbc7432a4c2b711ab0ce8ff9ac1f0aa1402f285979408ec8c765343ea793ad534421bbe785c9fbdf7afe34a1d19ac3955fc3
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_multiprocessing.pydFilesize
26KB
MD528d1fcc7077f724c7382561e8a08341b
SHA1af9111e34cceae89240853e9f6d2ea9b12f59172
SHA256a020a37e0b00fc314ccccb550f0825cf87814e6eedc30d931ce105cdedc38c95
SHA512782fd35a6a2f3401ae920eb6007b3afdac60c2b0212ba3677a948d2a62f83f1536ec6a2a63f65806d68173c7e41cabc830d3a216b0a1cbebd20d153cfb4e2ff4
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_overlapped.pydFilesize
32KB
MD5712907b30b62f30e6f6b1ad7e63e9a85
SHA160b14b19b5909348ddac8bd5450c6822730c9d15
SHA2568782bb95bae2f2db8d5f6359447c25c05b1fad9dbd331e6a3de097479bbe531a
SHA512bd45aa6777c0d61b47d3811e7d64a546729893667236b02655dfe58b8155ac68f868a2c0cc7b38d2c9a62125e79bacdff31b7380e7748ea94112f7d87eb79103
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_queue.pydFilesize
25KB
MD5237b8472822f8eacb787044a3daf5c6e
SHA197e72d1582b66028199805ab086419e333b35f55
SHA256a119c05628a8dcff1e5d78fd9fe2c5c2e917296fa8aa7c5691afb41cc1d5d384
SHA512b1ec2d48607bc7859718591aa25d234aba59a1030c898cdca81d4cb3db8fb5e20ceb4803f757aa7eb591db7f15cbdea91b32e4228910322580b90801dceb15aa
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_socket.pydFilesize
43KB
MD5d91c29b10936ed573812d6bc0ff4aba7
SHA1d7b04f577c644cf5ce62fb72d3c77a55ef325a01
SHA2563d0b6344828ed5a4214fbaa423dffd078f34d7e939f1bcdd17c477a4f38c1190
SHA512ce97994f90b5b5dfe3987a92f56e80ceb1e0c96a89ac788876800a98a78d809f201411b30d429be21e230e17223f7132bc2ac8d6b17a53773ad832c89cc4a4a3
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_sqlite3.pydFilesize
56KB
MD50ce73abe151c541d57e21f56fa8a162d
SHA1028c363dd8b7d70dcb95925e5612ccfbd39f020d
SHA256a05ccc2f9a6ccbe17866650b14f6b61fa1ddb18c9bdb9e635b126926d1dd7b3e
SHA5128a6a91103013bc17fcc4d0ca02160f47d37b590b875f981e499247bf840ba9e5cb644595e79f5a225b0f63ba8bd27b51b3effe675af5fabf93a6e3e0e4221e77
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_ssl.pydFilesize
65KB
MD50996c0b2ec2a512fa88cee1651dd6640
SHA1a913db52c1a269f8115e06723ae9f25857afd2b3
SHA25672caa24b38a6b2600774aac19ecbdc7921bf1e129be3767a506cef0ab9d01af8
SHA5129321361f5e48165d4044ed6baf909e29e2e173aab80399e5b0707a580076e45b87fea4c2ea1ef2fbc08766c77c19f8a2ecce9aebe85b30ef39af320e207a3dd6
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\_uuid.pydFilesize
24KB
MD54ba1fcf5f12ebc514e86d7e02901b3c3
SHA10fd88df618da41cdeb4afdaded039932a66ce5f6
SHA25651cb69267f77c094d687af5b80c560eaf325d0990304baf20242d477d8b156a1
SHA5123601331a84a9dcf62bbdadfc5c273853acf229931e70f5ff6f541d5f23474373f9366c606534ffdbf73c1044e98e464877b395f2e285821f264a57cd90021705
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\base_library.zipFilesize
1.4MB
MD581cd6d012885629791a9e3d9320c444e
SHA153268184fdbddf8909c349ed3c6701abe8884c31
SHA256a18892e4f2f2ec0dee5714429f73a5add4e355d10a7ba51593afc730f77c51dd
SHA512d5bf47fad8b1f5c7dcaa6bef5d4553e461f46e6c334b33d8adc93689cf89365c318f03e961a5d33994730b72dc8bde62209baca015d0d2d08a081d82df7dfd73
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\charset_normalizer\md.cp311-win_amd64.pydFilesize
9KB
MD570239c7b390eab5a85eeb29364b40b75
SHA120f1c95bf2d04a19a139528efa89aeae329f61c6
SHA2568ba995336395ca0a43627cad79efcd65b08f8cfd0d232bada3115e0edce35311
SHA51210029bf8d2fdd616d8795a7a1fde553fad5f98cb2ea62c6a731a2e88a5f51999e66e15846141330c815a595ff3f8b5c10bd71ae2ac7549f68542465e2b9c6e3e
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\charset_normalizer\md__mypyc.cp311-win_amd64.pydFilesize
39KB
MD584075e082e1890e91c13ae61bf64f22f
SHA1bf80b11f9d9614223335588ff8c1e3142370680b
SHA25608cd664fb67377816a2f29adac3e4df3b92af9e8eec8662bb572ffad21cf97fc
SHA5122d5ab9dcf3542c13ae67894596872f176cadb358473f6b253a2549ea3cc3c7803ff2572fe8b63c32fc11e6fd1674379aa1fae82693f6b53ef7502907db543652
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libcrypto-3.dllFilesize
1.6MB
MD559a6d2868f2d6a1a0406946ea37514d1
SHA1e1c89150bee1d153db2acb513d75d1646a1232e3
SHA256965844602c035f0926c29430ccd52939ba96945b5f3d5146742a1fca41025d1e
SHA5126a0178d5db9d12043593fb8006963feb34676e7ed9f6078ee81cd481e4c7cbd91fb2f617f49f59199194917011fd9232796cad8f9d603ec52051c7bd1573f48b
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libffi-8.dllFilesize
29KB
MD5ae513b7cdc4ee04687002577ffbf1ff4
SHA17d9a5eb0ac504bc255e80055d72e42ccb7ab7b4d
SHA256ed18fc7eee1bf09d994d8eba144e4e7d1e6a030ba87888001eea550d7afffada
SHA5129fcb24debfaf035a3604a2a9abece0655424f981ebb0afef14b9674e57030dea8c5c230ca8cc13c10de8422777b4c549002350f62b9259c486cca841d9c81634
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\libssl-3.dllFilesize
223KB
MD59bb7de1fd2c9e384820370104bbb2cd9
SHA1c1e42c3bf988c743a64da4a38031a686adb437d5
SHA25690ec6f49b4d0fa051373bfd76985e45d07755ffb11051a07fe33abc098ba664a
SHA5120bbcbb1142c615f2d33f432b97dad30cd121abe88f72685bd24e9c2ee238fa9846cacf01a5680bb81fc3673e214fb8f7e973e35224d3efe53e834ac1765fb413
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\psutil\_psutil_windows.pydFilesize
31KB
MD54732b2f1e51342fe289bc316897d8d62
SHA1acb5ac5fc83121e8caec091191bd66d519f29787
SHA2569ba42d887ff1655a9a7fd20b33c6bf80b6429a60dcd9f0409281a25e3d73f329
SHA5127435c0da033dbc07bbd2e6bebfc48041701dbc7bcb58276fbf51ba6db7507a16ad8a7a12dbdbdbdd4074772094c3bd969e27a2c4946c050bcff049a9c4666d18
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\pyexpat.pydFilesize
87KB
MD545457eed121c7d689afd8f9da3e5206b
SHA1e0d763b52c5cc160d09ade60b897df8440bb14ca
SHA256ace1fdd94a69567f8e5c56c4ac0e5e4ca6994bdc7a159d451434be5c92fc75ba
SHA51277c1ecdc75429caf93e978f89bf113ff7557b314b80c513b672136130e34b97d1cf9e733cabb45df30f0809d7f557e919dd5a913a8c3eb2ea7ab863106af8932
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\python3.DLLFilesize
65KB
MD5ff319d24153238249adea18d8a3e54a7
SHA10474faa64826a48821b7a82ad256525aa9c5315e
SHA256a462a21b5f0c05f0f7ec030c4fde032a13b34a8576d661a8e66f9ad23767e991
SHA5120e63fe4d5568cd2c54304183a29c7469f769816f517cd2d5b197049aa966c310cc13a7790560ef2edc36b9b6d99ff586698886f906e19645faeb89b0e65adfdd
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\python311.dllFilesize
1.6MB
MD5ca0b6b8ffcfdcd50d1909a1e67d63ab5
SHA162f455a3cab3bbfd6f66b6280ed3b115721fe376
SHA25640ff47b055e386f5791d76e1f7ea14b9ad2697cdc99bc027284105822d9bac5a
SHA51252d9f163a4fb26e5ab42983c50556f4cba4bc591f0ad7b75f74f5aac38e047625a2e66233d9e1e49d0f15ab5515d82c39236f4d4e3648c0daac16c70cf597f11
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\pywin32_system32\pythoncom311.dllFilesize
193KB
MD562af504ed6833fe66fe2c670c50ecee4
SHA1df1156eb1892ee3add76ada1f1234c7462678dc2
SHA256bfcef0b70fc4bf1693d7d067c3fdbf3379cd67477fbcfebb07e19ed7c811198b
SHA512befed25ef08001d2d2e19c14410f2c59c4f45d6cf4a4937a3029d6dc0ef13a9100260efbe40f8fa2532abd1b483eae0976b43697668f2e8c77094cdb090b90cb
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\pywin32_system32\pywintypes311.dllFilesize
62KB
MD5ee14f23f869d7b6141dfafe5d1ed7243
SHA13e337ad2dcdf3f0c8452ec617ce421c8abb3263a
SHA256d11cdd3026eada9b4d5d4c5e5b632dae9d7d74a7cd151fa210d1fb5ccf43c589
SHA512e7d98a5e93795e22df8650675a5ae6941b2fe285c9c1f41d99db1ccb58fd0d2ea9d3acb55a1958d5ab45bd75349406ab94430d8ae3fcfa62c7bab024572c07b2
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\select.pydFilesize
25KB
MD5bfdf18b1f521da328a1d3953f6b8f1c5
SHA17c5e958497e708fa4a3fd54004813731471e3f07
SHA25633fbd20b2bc634a31494cc084a2ef741492a8fb0e10e47385173d0c94ec9035d
SHA512dc206e1f35c6d488ce913812cb141f265465f81e9650a48a28efe39c7908d89fb951fb77ff784234fff9dbd916e1f6443230971979ccd1369d5087262adae231
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\sqlite3.dllFilesize
630KB
MD529bd308aff062512d1de69e35c3fe60d
SHA116942df5f8c4e12c62d6873c6e6a35b0e2bced6b
SHA256f680d5e3584a2fd15d6f4ebc96adb21abffef1b5b4311d7be3b9ffca98fbbaae
SHA51230cd95430b52abfde32d7655743c8404ed45104a55e40911b4a6d5166e0251188c3a1616dc41c2ad6d3961d648b9ee62b1d12b604655f0e72532d16f35f2b36e
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\unicodedata.pydFilesize
295KB
MD525480cab97e5a9bda09cb6b4de552a69
SHA1172225a540ad926f7533723ef26429238de1c0cb
SHA25643ecbbb9682a7d3c1b2637439c5356a244f948bea3a9ec6f0e7c063399d55045
SHA512bceaf59ed32a236ff73f29ad0643245680e4c9fd2508b8f9320024a8ff9f3fff2e6803481c6026448d1c1e91e3eae459e62b9d441490224a0c943610e6acf8d8
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\win32\win32api.pydFilesize
48KB
MD5c10558ce9e111a1da405afca0faf4e55
SHA1ba2f93e0408bde1c0067ad0cdedaa34ac09818dd
SHA256ad65e409f78b1c79b70c27b1ff7bfbfb7887a453c81adcb4a8959c1c157cdf21
SHA512cc3ea8af5f2b2298b8931ff7d82c0d28fcfef2740727fa4627ce44d2dda94cb67c3ad37326643e0f6755df2983a8d82e3f4ca0a6a764caed2a9e6155409e99b2
-
C:\Users\Admin\AppData\Local\Temp\_MEI36122\zstandard\backend_c.cp311-win_amd64.pydFilesize
174KB
MD571b77fb4818e4c32b34167f43102dcd5
SHA1d817d63284fec8b444886daa70a3fd6f0b859959
SHA2563ebf73ca68a4bc11bfa5c9569f1bd55b72c382184599f63ae38e3bdb2e487c5a
SHA512d059bbc00e86b7a2a9adb267f35832e10a37e63be13181935ed17b3d2301232552be7bcc4b289eaf9193239abcfc6f12c93582b96db516b6f4c6f7051283f015
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ms5ouw2f.0xs.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\prAnGmHscO\Browser\cc's.txtFilesize
91B
MD55aa796b6950a92a226cc5c98ed1c47e8
SHA16706a4082fc2c141272122f1ca424a446506c44d
SHA256c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
-
C:\Users\Admin\AppData\Local\Temp\prAnGmHscO\Browser\history.txtFilesize
23B
MD55638715e9aaa8d3f45999ec395e18e77
SHA14e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA2564db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA51278c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
-
memory/3344-230-0x000001CDF56D0000-0x000001CDF56E0000-memory.dmpFilesize
64KB
-
memory/3344-241-0x000001CDF5EE0000-0x000001CDF5F02000-memory.dmpFilesize
136KB
-
memory/3344-231-0x000001CDF56D0000-0x000001CDF56E0000-memory.dmpFilesize
64KB
-
memory/3344-244-0x00007FFB11DF0000-0x00007FFB128B1000-memory.dmpFilesize
10.8MB
-
memory/3344-229-0x00007FFB11DF0000-0x00007FFB128B1000-memory.dmpFilesize
10.8MB
-
memory/3616-264-0x00007FFB11F30000-0x00007FFB129F1000-memory.dmpFilesize
10.8MB
-
memory/3616-254-0x00007FFB11F30000-0x00007FFB129F1000-memory.dmpFilesize
10.8MB
-
memory/3616-262-0x00000287ECA90000-0x00000287ECAA0000-memory.dmpFilesize
64KB
-
memory/3616-259-0x00000287ECA90000-0x00000287ECAA0000-memory.dmpFilesize
64KB
-
memory/4524-194-0x00007FFB22530000-0x00007FFB2253B000-memory.dmpFilesize
44KB
-
memory/4524-158-0x00007FFB229F0000-0x00007FFB22AAC000-memory.dmpFilesize
752KB
-
memory/4524-175-0x00007FFB1EA10000-0x00007FFB1EB86000-memory.dmpFilesize
1.5MB
-
memory/4524-177-0x00007FFB225D0000-0x00007FFB2269D000-memory.dmpFilesize
820KB
-
memory/4524-174-0x00007FFB22580000-0x00007FFB225A3000-memory.dmpFilesize
140KB
-
memory/4524-182-0x00007FFB22560000-0x00007FFB22578000-memory.dmpFilesize
96KB
-
memory/4524-169-0x00000225F3500000-0x00000225F3A22000-memory.dmpFilesize
5.1MB
-
memory/4524-189-0x00007FFB1E8F0000-0x00007FFB1EA0C000-memory.dmpFilesize
1.1MB
-
memory/4524-187-0x00007FFB21D90000-0x00007FFB21DB6000-memory.dmpFilesize
152KB
-
memory/4524-190-0x00007FFB21DC0000-0x00007FFB21E47000-memory.dmpFilesize
540KB
-
memory/4524-179-0x00007FFB22890000-0x00007FFB228A5000-memory.dmpFilesize
84KB
-
memory/4524-161-0x00007FFB22980000-0x00007FFB229B3000-memory.dmpFilesize
204KB
-
memory/4524-193-0x00007FFB21D50000-0x00007FFB21D88000-memory.dmpFilesize
224KB
-
memory/4524-192-0x00007FFB22DF0000-0x00007FFB22DFB000-memory.dmpFilesize
44KB
-
memory/4524-191-0x00007FFB22540000-0x00007FFB22554000-memory.dmpFilesize
80KB
-
memory/4524-165-0x00007FFB13B30000-0x00007FFB14052000-memory.dmpFilesize
5.1MB
-
memory/4524-197-0x00007FFB216E0000-0x00007FFB216EB000-memory.dmpFilesize
44KB
-
memory/4524-196-0x00007FFB21D40000-0x00007FFB21D4C000-memory.dmpFilesize
48KB
-
memory/4524-198-0x00007FFB20910000-0x00007FFB2091C000-memory.dmpFilesize
48KB
-
memory/4524-211-0x00007FFB20900000-0x00007FFB2090B000-memory.dmpFilesize
44KB
-
memory/4524-212-0x00007FFB1E8E0000-0x00007FFB1E8EC000-memory.dmpFilesize
48KB
-
memory/4524-213-0x00007FFB1E8D0000-0x00007FFB1E8DC000-memory.dmpFilesize
48KB
-
memory/4524-216-0x00007FFB1E8C0000-0x00007FFB1E8CE000-memory.dmpFilesize
56KB
-
memory/4524-219-0x00007FFB1E4F0000-0x00007FFB1E4FB000-memory.dmpFilesize
44KB
-
memory/4524-218-0x00007FFB1E810000-0x00007FFB1E81B000-memory.dmpFilesize
44KB
-
memory/4524-221-0x00007FFB1E4D0000-0x00007FFB1E4DC000-memory.dmpFilesize
48KB
-
memory/4524-220-0x00007FFB1E4E0000-0x00007FFB1E4EC000-memory.dmpFilesize
48KB
-
memory/4524-217-0x00007FFB1E820000-0x00007FFB1E82C000-memory.dmpFilesize
48KB
-
memory/4524-222-0x00007FFB1E4C0000-0x00007FFB1E4CD000-memory.dmpFilesize
52KB
-
memory/4524-223-0x00007FFB1E4A0000-0x00007FFB1E4B2000-memory.dmpFilesize
72KB
-
memory/4524-224-0x00007FFB1E290000-0x00007FFB1E29C000-memory.dmpFilesize
48KB
-
memory/4524-225-0x00007FFB1EB90000-0x00007FFB1F17E000-memory.dmpFilesize
5.9MB
-
memory/4524-226-0x00007FFB22970000-0x00007FFB2297B000-memory.dmpFilesize
44KB
-
memory/4524-227-0x00007FFB13820000-0x00007FFB13A65000-memory.dmpFilesize
2.3MB
-
memory/4524-228-0x00007FFB1E250000-0x00007FFB1E279000-memory.dmpFilesize
164KB
-
memory/4524-150-0x00007FFB22E10000-0x00007FFB22E1D000-memory.dmpFilesize
52KB
-
memory/4524-145-0x00007FFB235B0000-0x00007FFB235BD000-memory.dmpFilesize
52KB
-
memory/4524-153-0x00007FFB22AB0000-0x00007FFB22ADE000-memory.dmpFilesize
184KB
-
memory/4524-156-0x00007FFB22C60000-0x00007FFB22C96000-memory.dmpFilesize
216KB
-
memory/4524-171-0x00007FFB225B0000-0x00007FFB225C2000-memory.dmpFilesize
72KB
-
memory/4524-159-0x00007FFB229C0000-0x00007FFB229EB000-memory.dmpFilesize
172KB
-
memory/4524-117-0x00007FFB27380000-0x00007FFB273A4000-memory.dmpFilesize
144KB
-
memory/4524-139-0x00007FFB28BB0000-0x00007FFB28BBF000-memory.dmpFilesize
60KB
-
memory/4524-144-0x00007FFB22E20000-0x00007FFB22E39000-memory.dmpFilesize
100KB
-
memory/4524-261-0x00007FFB22E10000-0x00007FFB22E1D000-memory.dmpFilesize
52KB
-
memory/4524-260-0x00007FFB22E20000-0x00007FFB22E39000-memory.dmpFilesize
100KB
-
memory/4524-142-0x00007FFB266D0000-0x00007FFB266E9000-memory.dmpFilesize
100KB
-
memory/4524-393-0x00007FFB22580000-0x00007FFB225A3000-memory.dmpFilesize
140KB
-
memory/4524-392-0x00007FFB225B0000-0x00007FFB225C2000-memory.dmpFilesize
72KB
-
memory/4524-391-0x00007FFB22890000-0x00007FFB228A5000-memory.dmpFilesize
84KB
-
memory/4524-268-0x00007FFB22980000-0x00007FFB229B3000-memory.dmpFilesize
204KB
-
memory/4524-279-0x00007FFB13B30000-0x00007FFB14052000-memory.dmpFilesize
5.1MB
-
memory/4524-274-0x00000225F3500000-0x00000225F3A22000-memory.dmpFilesize
5.1MB
-
memory/4524-140-0x00007FFB26640000-0x00007FFB2666D000-memory.dmpFilesize
180KB
-
memory/4524-107-0x00007FFB1EB90000-0x00007FFB1F17E000-memory.dmpFilesize
5.9MB
-
memory/4524-327-0x00007FFB1EB90000-0x00007FFB1F17E000-memory.dmpFilesize
5.9MB
-
memory/4524-328-0x00007FFB27380000-0x00007FFB273A4000-memory.dmpFilesize
144KB
-
memory/4524-372-0x00007FFB13820000-0x00007FFB13A65000-memory.dmpFilesize
2.3MB
-
memory/4524-374-0x00007FFB22CD0000-0x00007FFB22CDF000-memory.dmpFilesize
60KB
-
memory/4524-376-0x00007FFB1EB90000-0x00007FFB1F17E000-memory.dmpFilesize
5.9MB
-
memory/4524-378-0x00007FFB28BB0000-0x00007FFB28BBF000-memory.dmpFilesize
60KB
-
memory/4524-379-0x00007FFB266D0000-0x00007FFB266E9000-memory.dmpFilesize
100KB
-
memory/4524-380-0x00007FFB26640000-0x00007FFB2666D000-memory.dmpFilesize
180KB
-
memory/4524-377-0x00007FFB27380000-0x00007FFB273A4000-memory.dmpFilesize
144KB
-
memory/4524-381-0x00007FFB22E20000-0x00007FFB22E39000-memory.dmpFilesize
100KB
-
memory/4524-382-0x00007FFB235B0000-0x00007FFB235BD000-memory.dmpFilesize
52KB
-
memory/4524-383-0x00007FFB22C60000-0x00007FFB22C96000-memory.dmpFilesize
216KB
-
memory/4524-385-0x00007FFB22AB0000-0x00007FFB22ADE000-memory.dmpFilesize
184KB
-
memory/4524-384-0x00007FFB22E10000-0x00007FFB22E1D000-memory.dmpFilesize
52KB
-
memory/4524-386-0x00007FFB229F0000-0x00007FFB22AAC000-memory.dmpFilesize
752KB
-
memory/4524-387-0x00007FFB229C0000-0x00007FFB229EB000-memory.dmpFilesize
172KB
-
memory/4524-389-0x00007FFB225D0000-0x00007FFB2269D000-memory.dmpFilesize
820KB
-
memory/4524-388-0x00007FFB22980000-0x00007FFB229B3000-memory.dmpFilesize
204KB
-
memory/4524-390-0x00007FFB13B30000-0x00007FFB14052000-memory.dmpFilesize
5.1MB
-
memory/5016-267-0x000002C8B1330000-0x000002C8B1340000-memory.dmpFilesize
64KB
-
memory/5016-266-0x000002C8B1330000-0x000002C8B1340000-memory.dmpFilesize
64KB
-
memory/5016-265-0x00007FFB11F30000-0x00007FFB129F1000-memory.dmpFilesize
10.8MB