Analysis
- max time kernel
147s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
15/09/2024, 03:14
General
- Target 5ba0fa5b9cd80353f88930547daef763dd9ba34270a7e9976d3bb123b06de7b7.exe
- Size 1.8MB
- Sample240915-drmtgsshqg
- SHA256 5ba0fa5b9cd80353f88930547daef763dd9ba34270a7e9976d3bb123b06de7b7
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@OLEH_PSP
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
redline
-
bundle
-
185.215.113.67:15206
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
cryptbot
-
analforeverlovyu.top
-
fivevd5sb.top
-
url_path
/v1/upload.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
91.194.55.146:29862
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects ZharkBot payload 3 IoCs
ZharkBot is a botnet written C++.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
- ZharkBot
ZharkBot is a botnet written C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 4 IoCs
- Executes dropped EXE 31 IoCs
- Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 52 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5ba0fa5b9cd80353f88930547daef763dd9ba34270a7e9976d3bb123b06de7b7.exe"C:\Users\Admin\AppData\Local\Temp\5ba0fa5b9cd80353f88930547daef763dd9ba34270a7e9976d3bb123b06de7b7.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sDxFCimdXp.exe"C:\Users\Admin\AppData\Roaming\sDxFCimdXp.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Oo3dYC7dVZ.exe"C:\Users\Admin\AppData\Roaming\Oo3dYC7dVZ.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000351001\e85db9aec6.exe"C:\Users\Admin\AppData\Local\Temp\1000351001\e85db9aec6.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000356001\BowExpert.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\BowExpert.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6841268⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "VegetablesIndividualBindingGba" Ever8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\684126\Intake.pifIntake.pif C8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 58⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 4206⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6076986⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MaskBathroomCompositionInjection" Participants6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\607698\Waters.pifWaters.pif Q6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3688 -ip 36881⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
RegAsm.exe.log
gold.exe
crypteda.exe
Nework.exe
stealc_default2.exe
2.exe
needmoney.exe
penis.exe
bundle.exe
acentric.exe
2.exe
splwow64.exe
crypted.exe
BowExpert.exe
axplong.exe
Q
Waters.pif
610320281626
Asbestos
Ashley
Bet
Emotions
Ensures
Fla
Language
Navy
Participants
Rick
Streaming
Temperature
TmpCAA3.tmp
Viruses
Width
svchost015.exe
76b53b3ec448f7ccdda2063b15d2bfc3_397a1569-0be2-47f2-b50f-ef09823a05f8
Oo3dYC7dVZ.exe
d3d9.dll
sDxFCimdXp.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/244-41-0x00000000002A0000-0x00000000002F4000-memory.dmp
memory/244-40-0x000000007303E000-0x000000007303F000-memory.dmp
memory/548-581-0x0000000000650000-0x0000000000B17000-memory.dmp
memory/548-579-0x0000000000650000-0x0000000000B17000-memory.dmp
memory/716-648-0x0000000000450000-0x0000000000917000-memory.dmp
memory/760-367-0x0000000000400000-0x000000000081B000-memory.dmp
memory/924-313-0x0000000000860000-0x00000000008E0000-memory.dmp
memory/1212-623-0x0000000000830000-0x0000000000841000-memory.dmp
memory/1248-179-0x000000000A800000-0x000000000AD2C000-memory.dmp
memory/1248-178-0x000000000A100000-0x000000000A2C2000-memory.dmp
memory/1248-176-0x00000000087C0000-0x0000000008826000-memory.dmp
memory/1248-111-0x0000000000BC0000-0x0000000000C62000-memory.dmp
memory/1592-258-0x0000000000450000-0x0000000000917000-memory.dmp
memory/1672-332-0x00000000002A0000-0x00000000002F2000-memory.dmp
memory/1672-351-0x0000000006480000-0x00000000064CC000-memory.dmp
memory/2176-468-0x0000000000430000-0x0000000000484000-memory.dmp
memory/2240-256-0x0000000000550000-0x0000000000793000-memory.dmp
memory/2240-180-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2240-172-0x0000000000550000-0x0000000000793000-memory.dmp
memory/2288-222-0x0000000007470000-0x00000000074C0000-memory.dmp
memory/2288-110-0x0000000000580000-0x00000000005D2000-memory.dmp
memory/2324-48-0x00000000057C0000-0x0000000005852000-memory.dmp
memory/2324-72-0x0000000008F40000-0x0000000008F8C000-memory.dmp
memory/2324-71-0x0000000007600000-0x000000000763C000-memory.dmp
memory/2324-69-0x0000000008E30000-0x0000000008F3A000-memory.dmp
memory/2324-68-0x0000000007670000-0x0000000007C88000-memory.dmp
memory/2324-65-0x0000000006CE0000-0x0000000006CFE000-memory.dmp
memory/2324-64-0x0000000006500000-0x0000000006576000-memory.dmp
memory/2324-49-0x0000000005970000-0x000000000597A000-memory.dmp
memory/2324-47-0x0000000005C90000-0x0000000006236000-memory.dmp
memory/2324-70-0x00000000075A0000-0x00000000075B2000-memory.dmp
memory/2324-44-0x0000000000400000-0x0000000000452000-memory.dmp
memory/2568-16-0x00000000001A0000-0x0000000000667000-memory.dmp
memory/2568-0-0x00000000001A0000-0x0000000000667000-memory.dmp
memory/2568-5-0x00000000001A0000-0x0000000000667000-memory.dmp
memory/2568-3-0x00000000001A0000-0x0000000000667000-memory.dmp
memory/2568-2-0x00000000001A1000-0x00000000001CF000-memory.dmp
memory/2568-1-0x0000000077676000-0x0000000077678000-memory.dmp
memory/2648-636-0x0000000001130000-0x00000000011BC000-memory.dmp
memory/2648-637-0x0000000008A00000-0x0000000008A4C000-memory.dmp
memory/3200-381-0x0000000000400000-0x0000000000643000-memory.dmp
memory/3200-357-0x0000000000400000-0x0000000000643000-memory.dmp
memory/3200-354-0x0000000000400000-0x0000000000643000-memory.dmp
memory/3200-358-0x0000000000400000-0x0000000000643000-memory.dmp
memory/3224-414-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3224-527-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3224-551-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3464-521-0x0000000005BD0000-0x0000000005BEA000-memory.dmp
memory/3464-378-0x0000000000F20000-0x0000000000F98000-memory.dmp
memory/3688-413-0x0000000000760000-0x00000000007B4000-memory.dmp
memory/3688-410-0x0000000000760000-0x00000000007B4000-memory.dmp
memory/3688-408-0x0000000000760000-0x00000000007B4000-memory.dmp
memory/3880-621-0x0000000000450000-0x0000000000917000-memory.dmp
memory/3880-622-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4108-560-0x000000006F700000-0x000000006F83C000-memory.dmp
memory/4108-559-0x0000000000830000-0x0000000000841000-memory.dmp
memory/4208-217-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-20-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-17-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-221-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-543-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-19-0x0000000000451000-0x000000000047F000-memory.dmp
memory/4208-552-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-177-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-627-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-624-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-21-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-382-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-173-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-522-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-261-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4208-561-0x0000000000450000-0x0000000000917000-memory.dmp
memory/4808-554-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4808-558-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4808-553-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4808-555-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4808-557-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4808-556-0x0000000004020000-0x0000000004091000-memory.dmp
memory/4820-596-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-576-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-401-0x0000000000DF0000-0x0000000000E9E000-memory.dmp
memory/4820-590-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-570-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-531-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-529-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4820-532-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5060-473-0x0000000000400000-0x0000000000452000-memory.dmp