Analysis
-
max time kernel
10s -
max time network
147s -
platform
windows10_x64 -
resource
win10 -
submitted
25-10-2020 20:00
Static task
static1
Behavioral task
behavioral1
Sample
70fb5e54ff3ba4682fd382c10493ef0e.exe
Resource
win7
Behavioral task
behavioral2
Sample
70fb5e54ff3ba4682fd382c10493ef0e.exe
Resource
win10
General
-
Target
70fb5e54ff3ba4682fd382c10493ef0e.exe
-
Size
1.3MB
-
MD5
70fb5e54ff3ba4682fd382c10493ef0e
-
SHA1
8273c8f09b281f78bfc3055603aa1f8954a39ce3
-
SHA256
bb88b0e196c6418b7b3e20f9703cfc4bc4b7fcbe2afbb0c320abe063e1b7fc8f
-
SHA512
0aac50c66bdf3c30fc283865a8d4537fe4180580191f989a9e48d666ccd5e42e22ed6aeffb6a3e8f676defec7e65b9c8f9d8657b004328e27650285fa66ef07a
Malware Config
Extracted
asyncrat
0.5.7B
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
AsyncMutex_6SI8OkPnk
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 8 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2208-187-0x0000000000400000-0x000000000040C000-memory.dmp disable_win_def behavioral2/memory/2208-190-0x000000000040616E-mapping.dmp disable_win_def behavioral2/memory/3692-209-0x0000000000400000-0x0000000000408000-memory.dmp disable_win_def behavioral2/memory/3692-211-0x0000000000403BEE-mapping.dmp disable_win_def C:\Windows\temp\uquw0k00.exe disable_win_def C:\Windows\Temp\uquw0k00.exe disable_win_def behavioral2/memory/5932-388-0x000000000040616E-mapping.dmp disable_win_def behavioral2/memory/5984-394-0x0000000000403BEE-mapping.dmp disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2108-240-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2108-242-0x000000000040C76E-mapping.dmp asyncrat behavioral2/memory/5124-419-0x000000000040C76E-mapping.dmp asyncrat -
ModiLoader First Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4416-272-0x00000000007C0000-0x00000000007FA000-memory.dmp modiloader_stage1 behavioral2/memory/4416-389-0x0000000004E60000-0x0000000004E9A000-memory.dmp modiloader_stage1 behavioral2/memory/4376-467-0x0000000002300000-0x000000000233A000-memory.dmp modiloader_stage1 behavioral2/memory/4416-508-0x00000000053F0000-0x000000000542A000-memory.dmp modiloader_stage1 behavioral2/memory/4376-546-0x00000000052D0000-0x000000000530A000-memory.dmp modiloader_stage1 behavioral2/memory/4376-542-0x0000000004E80000-0x0000000004EBA000-memory.dmp modiloader_stage1 -
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4416-420-0x0000000004FA0000-0x0000000004FED000-memory.dmp modiloader_stage2 behavioral2/memory/4376-539-0x0000000004C30000-0x0000000004C7D000-memory.dmp modiloader_stage2 -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
AamJcvxxcd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeAamJcvxxcd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeBbmJcvdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeBbmJcvdTYsd.exeBcmfdgdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeCcmfdgsaYsd.exepid process 3688 AamJcvxxcd.exe 2088 Nhrdgfertqw.exe 2280 GFsdfgytrqwe.exe 2392 AamJcvxxcd.exe 2640 Nhrdgfertqw.exe 3508 GFsdfgytrqwe.exe 1228 BbmJcvdTYsd.exe 3768 Nhrdgfertqw.exe 3836 GFsdfgytrqwe.exe 3988 BbmJcvdTYsd.exe 192 BcmfdgdTYsd.exe 2532 Nhrdgfertqw.exe 2200 GFsdfgytrqwe.exe 3640 CcmfdgsaYsd.exe -
Loads dropped DLL 7 IoCs
Processes:
Nhrdgfertqw.exeGFsdfgytrqwe.exepid process 2640 Nhrdgfertqw.exe 2640 Nhrdgfertqw.exe 2640 Nhrdgfertqw.exe 2640 Nhrdgfertqw.exe 3508 GFsdfgytrqwe.exe 3508 GFsdfgytrqwe.exe 3508 GFsdfgytrqwe.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
70fb5e54ff3ba4682fd382c10493ef0e.exepid process 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
70fb5e54ff3ba4682fd382c10493ef0e.exeAamJcvxxcd.exeGFsdfgytrqwe.exeNhrdgfertqw.exeBbmJcvdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exedescription pid process target process PID 3840 set thread context of 1536 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 70fb5e54ff3ba4682fd382c10493ef0e.exe PID 3688 set thread context of 2392 3688 AamJcvxxcd.exe AamJcvxxcd.exe PID 2280 set thread context of 3508 2280 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 2088 set thread context of 2640 2088 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 1228 set thread context of 3988 1228 BbmJcvdTYsd.exe BbmJcvdTYsd.exe PID 3768 set thread context of 2532 3768 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 3836 set thread context of 2200 3836 GFsdfgytrqwe.exe GFsdfgytrqwe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
70fb5e54ff3ba4682fd382c10493ef0e.exeAamJcvxxcd.exeGFsdfgytrqwe.exeNhrdgfertqw.exeBbmJcvdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exepid process 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 3688 AamJcvxxcd.exe 2280 GFsdfgytrqwe.exe 2088 Nhrdgfertqw.exe 1228 BbmJcvdTYsd.exe 3768 Nhrdgfertqw.exe 3836 GFsdfgytrqwe.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
70fb5e54ff3ba4682fd382c10493ef0e.exe70fb5e54ff3ba4682fd382c10493ef0e.exeAamJcvxxcd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeBbmJcvdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exepid process 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe 3688 AamJcvxxcd.exe 2088 Nhrdgfertqw.exe 2280 GFsdfgytrqwe.exe 1228 BbmJcvdTYsd.exe 3768 Nhrdgfertqw.exe 3836 GFsdfgytrqwe.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
70fb5e54ff3ba4682fd382c10493ef0e.exe70fb5e54ff3ba4682fd382c10493ef0e.exeAamJcvxxcd.exeNhrdgfertqw.exeGFsdfgytrqwe.exeBbmJcvdTYsd.exeNhrdgfertqw.exeGFsdfgytrqwe.exedescription pid process target process PID 3840 wrote to memory of 1536 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 70fb5e54ff3ba4682fd382c10493ef0e.exe PID 3840 wrote to memory of 1536 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 70fb5e54ff3ba4682fd382c10493ef0e.exe PID 3840 wrote to memory of 1536 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 70fb5e54ff3ba4682fd382c10493ef0e.exe PID 3840 wrote to memory of 1536 3840 70fb5e54ff3ba4682fd382c10493ef0e.exe 70fb5e54ff3ba4682fd382c10493ef0e.exe PID 1536 wrote to memory of 3688 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe AamJcvxxcd.exe PID 1536 wrote to memory of 3688 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe AamJcvxxcd.exe PID 1536 wrote to memory of 3688 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe AamJcvxxcd.exe PID 3688 wrote to memory of 2088 3688 AamJcvxxcd.exe Nhrdgfertqw.exe PID 3688 wrote to memory of 2088 3688 AamJcvxxcd.exe Nhrdgfertqw.exe PID 3688 wrote to memory of 2088 3688 AamJcvxxcd.exe Nhrdgfertqw.exe PID 3688 wrote to memory of 2280 3688 AamJcvxxcd.exe GFsdfgytrqwe.exe PID 3688 wrote to memory of 2280 3688 AamJcvxxcd.exe GFsdfgytrqwe.exe PID 3688 wrote to memory of 2280 3688 AamJcvxxcd.exe GFsdfgytrqwe.exe PID 3688 wrote to memory of 2392 3688 AamJcvxxcd.exe AamJcvxxcd.exe PID 3688 wrote to memory of 2392 3688 AamJcvxxcd.exe AamJcvxxcd.exe PID 3688 wrote to memory of 2392 3688 AamJcvxxcd.exe AamJcvxxcd.exe PID 3688 wrote to memory of 2392 3688 AamJcvxxcd.exe AamJcvxxcd.exe PID 2088 wrote to memory of 2640 2088 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 2088 wrote to memory of 2640 2088 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 2088 wrote to memory of 2640 2088 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 2280 wrote to memory of 3508 2280 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 2280 wrote to memory of 3508 2280 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 2280 wrote to memory of 3508 2280 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 2088 wrote to memory of 2640 2088 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 2280 wrote to memory of 3508 2280 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 1536 wrote to memory of 1228 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BbmJcvdTYsd.exe PID 1536 wrote to memory of 1228 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BbmJcvdTYsd.exe PID 1536 wrote to memory of 1228 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BbmJcvdTYsd.exe PID 1228 wrote to memory of 3768 1228 BbmJcvdTYsd.exe Nhrdgfertqw.exe PID 1228 wrote to memory of 3768 1228 BbmJcvdTYsd.exe Nhrdgfertqw.exe PID 1228 wrote to memory of 3768 1228 BbmJcvdTYsd.exe Nhrdgfertqw.exe PID 1228 wrote to memory of 3836 1228 BbmJcvdTYsd.exe GFsdfgytrqwe.exe PID 1228 wrote to memory of 3836 1228 BbmJcvdTYsd.exe GFsdfgytrqwe.exe PID 1228 wrote to memory of 3836 1228 BbmJcvdTYsd.exe GFsdfgytrqwe.exe PID 1228 wrote to memory of 3988 1228 BbmJcvdTYsd.exe BbmJcvdTYsd.exe PID 1228 wrote to memory of 3988 1228 BbmJcvdTYsd.exe BbmJcvdTYsd.exe PID 1228 wrote to memory of 3988 1228 BbmJcvdTYsd.exe BbmJcvdTYsd.exe PID 1228 wrote to memory of 3988 1228 BbmJcvdTYsd.exe BbmJcvdTYsd.exe PID 1536 wrote to memory of 192 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BcmfdgdTYsd.exe PID 1536 wrote to memory of 192 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BcmfdgdTYsd.exe PID 1536 wrote to memory of 192 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe BcmfdgdTYsd.exe PID 3768 wrote to memory of 2532 3768 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 3768 wrote to memory of 2532 3768 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 3768 wrote to memory of 2532 3768 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 3768 wrote to memory of 2532 3768 Nhrdgfertqw.exe Nhrdgfertqw.exe PID 3836 wrote to memory of 2200 3836 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 3836 wrote to memory of 2200 3836 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 3836 wrote to memory of 2200 3836 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 3836 wrote to memory of 2200 3836 GFsdfgytrqwe.exe GFsdfgytrqwe.exe PID 1536 wrote to memory of 3640 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe CcmfdgsaYsd.exe PID 1536 wrote to memory of 3640 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe CcmfdgsaYsd.exe PID 1536 wrote to memory of 3640 1536 70fb5e54ff3ba4682fd382c10493ef0e.exe CcmfdgsaYsd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70fb5e54ff3ba4682fd382c10493ef0e.exe"C:\Users\Admin\AppData\Local\Temp\70fb5e54ff3ba4682fd382c10493ef0e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70fb5e54ff3ba4682fd382c10493ef0e.exe"C:\Users\Admin\AppData\Local\Temp\70fb5e54ff3ba4682fd382c10493ef0e.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe"C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe" 03⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe"C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe"C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe" 03⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe"C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe"C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe" 03⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe"C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe" 03⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\msvcp140.dll
-
C:\ProgramData\msvcp140.dll
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_F80805103A05D4F74523519C6EAD8FC0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_F80805103A05D4F74523519C6EAD8FC0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6rtTJ0nWR3.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ds1.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ds2.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vNEAjFVNkB.exe.log
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\D90ZZ2VS.cookie
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
-
C:\Users\Admin\AppData\Local\Temp\4BL3qQdyly.exe
-
C:\Users\Admin\AppData\Local\Temp\4BL3qQdyly.exe
-
C:\Users\Admin\AppData\Local\Temp\4BL3qQdyly.exe
-
C:\Users\Admin\AppData\Local\Temp\4BL3qQdyly.exe
-
C:\Users\Admin\AppData\Local\Temp\6rtTJ0nWR3.exe
-
C:\Users\Admin\AppData\Local\Temp\6rtTJ0nWR3.exe
-
C:\Users\Admin\AppData\Local\Temp\6rtTJ0nWR3.exe
-
C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe
-
C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe
-
C:\Users\Admin\AppData\Local\Temp\AamJcvxxcd.exe
-
C:\Users\Admin\AppData\Local\Temp\Ankgce.vbs
-
C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BbmJcvdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\BcmfdgdTYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
-
C:\Users\Admin\AppData\Local\Temp\Lima.exe
-
C:\Users\Admin\AppData\Local\Temp\Lima.exe
-
C:\Users\Admin\AppData\Local\Temp\Lima.exe
-
C:\Users\Admin\AppData\Local\Temp\Limo.exe
-
C:\Users\Admin\AppData\Local\Temp\Limo.exe
-
C:\Users\Admin\AppData\Local\Temp\Limo.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
-
C:\Users\Admin\AppData\Local\Temp\Rgtwrmi.vbs
-
C:\Users\Admin\AppData\Local\Temp\ac.exe
-
C:\Users\Admin\AppData\Local\Temp\ac.exe
-
C:\Users\Admin\AppData\Local\Temp\ac.exe
-
C:\Users\Admin\AppData\Local\Temp\bQB8YuIei9.exe
-
C:\Users\Admin\AppData\Local\Temp\bQB8YuIei9.exe
-
C:\Users\Admin\AppData\Local\Temp\ds1.exe
-
C:\Users\Admin\AppData\Local\Temp\ds1.exe
-
C:\Users\Admin\AppData\Local\Temp\ds1.exe
-
C:\Users\Admin\AppData\Local\Temp\ds2.exe
-
C:\Users\Admin\AppData\Local\Temp\ds2.exe
-
C:\Users\Admin\AppData\Local\Temp\ds2.exe
-
C:\Users\Admin\AppData\Local\Temp\rc.exe
-
C:\Users\Admin\AppData\Local\Temp\rc.exe
-
C:\Users\Admin\AppData\Local\Temp\vNEAjFVNkB.exe
-
C:\Users\Admin\AppData\Local\Temp\vNEAjFVNkB.exe
-
C:\Users\Admin\AppData\Local\Temp\vNEAjFVNkB.exe
-
C:\Windows\Temp\uquw0k00.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
C:\Windows\temp\kt3qnbay.inf
-
C:\Windows\temp\lvsg2mzn.inf
-
C:\Windows\temp\uquw0k00.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
\??\PIPE\lsarpc
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\mozglue.dll
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\LIbesLLibEs\softokn3.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
\Users\Admin\AppData\Local\Temp\9159DD76\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\9159DD76\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\9159DD76\nss3.dllMD5
556ea09421a0f74d31c4c0a89a70dc23
SHA1f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SHA5122481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2
-
\Users\Admin\AppData\Local\Temp\9159DD76\vcruntime140.dll
-
memory/192-63-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/192-51-0x0000000000000000-mapping.dmp
-
memory/192-168-0x00000000012F0000-0x00000000012FD000-memory.dmpFilesize
52KB
-
memory/192-56-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/192-65-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/192-157-0x000000000ABA0000-0x000000000AC85000-memory.dmpFilesize
916KB
-
memory/752-345-0x0000000000000000-mapping.dmp
-
memory/752-366-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/1228-34-0x0000000000000000-mapping.dmp
-
memory/1536-2-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1536-4-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1536-3-0x000000000040106C-mapping.dmp
-
memory/1564-310-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/1564-304-0x0000000000000000-mapping.dmp
-
memory/2080-302-0x0000000000000000-mapping.dmp
-
memory/2088-12-0x0000000000000000-mapping.dmp
-
memory/2108-242-0x000000000040C76E-mapping.dmp
-
memory/2108-249-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/2108-240-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2176-307-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/2176-303-0x0000000000000000-mapping.dmp
-
memory/2200-60-0x0000000000417A8B-mapping.dmp
-
memory/2200-62-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2208-231-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/2208-202-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/2208-187-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2208-190-0x000000000040616E-mapping.dmp
-
memory/2208-201-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/2208-193-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/2280-15-0x0000000000000000-mapping.dmp
-
memory/2392-20-0x0000000000440102-mapping.dmp
-
memory/2392-24-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2392-19-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2532-55-0x000000000041A684-mapping.dmp
-
memory/2640-32-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2640-27-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2640-28-0x000000000041A684-mapping.dmp
-
memory/3084-254-0x0000000000000000-mapping.dmp
-
memory/3084-261-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/3084-275-0x0000019DB6990000-0x0000019DB6991000-memory.dmpFilesize
4KB
-
memory/3084-279-0x0000019DD0FC0000-0x0000019DD0FC1000-memory.dmpFilesize
4KB
-
memory/3100-102-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3100-96-0x0000000000440102-mapping.dmp
-
memory/3444-85-0x0000000000000000-mapping.dmp
-
memory/3444-91-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/3508-33-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3508-26-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3508-29-0x0000000000417A8B-mapping.dmp
-
memory/3640-66-0x0000000000000000-mapping.dmp
-
memory/3688-7-0x0000000000000000-mapping.dmp
-
memory/3692-209-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3692-211-0x0000000000403BEE-mapping.dmp
-
memory/3692-215-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/3768-39-0x0000000000000000-mapping.dmp
-
memory/3824-196-0x0000000000440102-mapping.dmp
-
memory/3824-199-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3828-84-0x0000000000000000-mapping.dmp
-
memory/3832-83-0x0000000000000000-mapping.dmp
-
memory/3836-40-0x0000000000000000-mapping.dmp
-
memory/3916-203-0x0000000000000000-mapping.dmp
-
memory/3988-49-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/3988-45-0x0000000000440102-mapping.dmp
-
memory/4100-234-0x0000000000000000-mapping.dmp
-
memory/4120-332-0x0000000008880000-0x0000000008881000-memory.dmpFilesize
4KB
-
memory/4120-246-0x0000000007B60000-0x0000000007B61000-memory.dmpFilesize
4KB
-
memory/4120-228-0x0000000006B80000-0x0000000006B81000-memory.dmpFilesize
4KB
-
memory/4120-320-0x0000000008890000-0x0000000008891000-memory.dmpFilesize
4KB
-
memory/4120-288-0x0000000008910000-0x0000000008911000-memory.dmpFilesize
4KB
-
memory/4120-227-0x0000000006650000-0x0000000006651000-memory.dmpFilesize
4KB
-
memory/4120-281-0x0000000008BB0000-0x0000000008BE3000-memory.dmpFilesize
204KB
-
memory/4120-226-0x0000000006CC0000-0x0000000006CC1000-memory.dmpFilesize
4KB
-
memory/4120-229-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/4120-289-0x0000000008CE0000-0x0000000008CE1000-memory.dmpFilesize
4KB
-
memory/4120-297-0x0000000008E40000-0x0000000008E41000-memory.dmpFilesize
4KB
-
memory/4120-223-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4120-221-0x0000000000000000-mapping.dmp
-
memory/4120-230-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/4120-235-0x0000000007870000-0x0000000007871000-memory.dmpFilesize
4KB
-
memory/4120-225-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/4120-236-0x0000000007BF0000-0x0000000007BF1000-memory.dmpFilesize
4KB
-
memory/4128-189-0x0000000000000000-mapping.dmp
-
memory/4156-111-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4156-106-0x0000000000417A8B-mapping.dmp
-
memory/4164-107-0x000000000041A684-mapping.dmp
-
memory/4176-269-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4176-265-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4176-266-0x0000000000417A8B-mapping.dmp
-
memory/4180-414-0x00000199D2D30000-0x00000199D2D31000-memory.dmpFilesize
4KB
-
memory/4180-417-0x00000199D5040000-0x00000199D5041000-memory.dmpFilesize
4KB
-
memory/4180-327-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4180-312-0x0000000000000000-mapping.dmp
-
memory/4180-437-0x00000199D4F50000-0x00000199D4F51000-memory.dmpFilesize
4KB
-
memory/4188-125-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4188-133-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/4188-108-0x0000000000000000-mapping.dmp
-
memory/4188-181-0x0000000002680000-0x0000000002696000-memory.dmpFilesize
88KB
-
memory/4188-143-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/4208-263-0x0000000000000000-mapping.dmp
-
memory/4216-313-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4216-308-0x0000000000000000-mapping.dmp
-
memory/4220-370-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4220-352-0x0000000000000000-mapping.dmp
-
memory/4236-241-0x0000000000000000-mapping.dmp
-
memory/4236-245-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4236-250-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/4236-239-0x0000000000000000-mapping.dmp
-
memory/4240-305-0x0000000000000000-mapping.dmp
-
memory/4240-311-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4312-204-0x0000000004B60000-0x0000000004B74000-memory.dmpFilesize
80KB
-
memory/4312-127-0x0000000000000000-mapping.dmp
-
memory/4312-136-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4312-147-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/4312-138-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/4344-224-0x0000000000000000-mapping.dmp
-
memory/4376-542-0x0000000004E80000-0x0000000004EBA000-memory.dmpFilesize
232KB
-
memory/4376-546-0x00000000052D0000-0x000000000530A000-memory.dmpFilesize
232KB
-
memory/4376-467-0x0000000002300000-0x000000000233A000-memory.dmpFilesize
232KB
-
memory/4376-539-0x0000000004C30000-0x0000000004C7D000-memory.dmpFilesize
308KB
-
memory/4376-339-0x0000000000000000-mapping.dmp
-
memory/4400-139-0x0000000000000000-mapping.dmp
-
memory/4416-272-0x00000000007C0000-0x00000000007FA000-memory.dmpFilesize
232KB
-
memory/4416-420-0x0000000004FA0000-0x0000000004FED000-memory.dmpFilesize
308KB
-
memory/4416-140-0x0000000000000000-mapping.dmp
-
memory/4416-508-0x00000000053F0000-0x000000000542A000-memory.dmpFilesize
232KB
-
memory/4416-389-0x0000000004E60000-0x0000000004E9A000-memory.dmpFilesize
232KB
-
memory/4476-331-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4476-323-0x0000000000000000-mapping.dmp
-
memory/4488-237-0x0000000003040000-0x000000000304F000-memory.dmpFilesize
60KB
-
memory/4488-146-0x0000000000000000-mapping.dmp
-
memory/4488-151-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/4488-238-0x0000000003060000-0x000000000306D000-memory.dmpFilesize
52KB
-
memory/4488-150-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4568-152-0x0000000000000000-mapping.dmp
-
memory/4572-300-0x0000000000000000-mapping.dmp
-
memory/4616-328-0x0000000000000000-mapping.dmp
-
memory/4616-350-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4636-359-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4636-351-0x0000000000000000-mapping.dmp
-
memory/4644-156-0x0000000000000000-mapping.dmp
-
memory/4724-319-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4724-326-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4724-322-0x000000000041A684-mapping.dmp
-
memory/4772-309-0x0000000000000000-mapping.dmp
-
memory/4772-317-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4776-163-0x0000000000000000-mapping.dmp
-
memory/4800-166-0x0000000000000000-mapping.dmp
-
memory/4824-338-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4824-314-0x0000000000000000-mapping.dmp
-
memory/4836-271-0x0000000000000000-mapping.dmp
-
memory/4836-278-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/4836-276-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/4836-315-0x0000000004D10000-0x0000000004D32000-memory.dmpFilesize
136KB
-
memory/4836-274-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4844-169-0x0000000000000000-mapping.dmp
-
memory/4852-255-0x0000000000000000-mapping.dmp
-
memory/4868-173-0x0000000000440102-mapping.dmp
-
memory/4868-172-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4868-175-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4888-336-0x0000000000000000-mapping.dmp
-
memory/4888-358-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/4892-348-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/4892-343-0x0000000000000000-mapping.dmp
-
memory/4996-494-0x0000000000000000-mapping.dmp
-
memory/4996-526-0x0000000000000000-mapping.dmp
-
memory/4996-491-0x0000000000000000-mapping.dmp
-
memory/4996-454-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/4996-455-0x0000000000000000-mapping.dmp
-
memory/4996-457-0x0000000000000000-mapping.dmp
-
memory/4996-461-0x0000000000000000-mapping.dmp
-
memory/4996-466-0x0000000000000000-mapping.dmp
-
memory/4996-537-0x0000000000000000-mapping.dmp
-
memory/4996-469-0x0000000000000000-mapping.dmp
-
memory/4996-472-0x0000000000000000-mapping.dmp
-
memory/4996-477-0x0000000000000000-mapping.dmp
-
memory/4996-481-0x0000000000000000-mapping.dmp
-
memory/4996-487-0x0000000000000000-mapping.dmp
-
memory/4996-453-0x0000000000000000-mapping.dmp
-
memory/4996-496-0x0000000000000000-mapping.dmp
-
memory/4996-452-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4996-500-0x0000000000000000-mapping.dmp
-
memory/4996-502-0x0000000000000000-mapping.dmp
-
memory/4996-505-0x0000000000000000-mapping.dmp
-
memory/4996-540-0x0000000000000000-mapping.dmp
-
memory/4996-507-0x0000000000000000-mapping.dmp
-
memory/4996-511-0x0000000000000000-mapping.dmp
-
memory/4996-513-0x0000000000000000-mapping.dmp
-
memory/4996-545-0x0000000000000000-mapping.dmp
-
memory/4996-517-0x0000000000000000-mapping.dmp
-
memory/4996-549-0x0000000000000000-mapping.dmp
-
memory/4996-521-0x0000000000000000-mapping.dmp
-
memory/4996-523-0x0000000000000000-mapping.dmp
-
memory/4996-529-0x0000000000000000-mapping.dmp
-
memory/5020-176-0x0000000000000000-mapping.dmp
-
memory/5056-256-0x0000000004950000-0x00000000049B9000-memory.dmpFilesize
420KB
-
memory/5056-184-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/5056-194-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/5056-180-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/5056-178-0x0000000000000000-mapping.dmp
-
memory/5100-318-0x0000000000000000-mapping.dmp
-
memory/5100-342-0x00007FF849DC0000-0x00007FF84A7AC000-memory.dmpFilesize
9.9MB
-
memory/5124-423-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/5124-419-0x000000000040C76E-mapping.dmp
-
memory/5152-354-0x0000000000000000-mapping.dmp
-
memory/5716-553-0x0000000000000000-mapping.dmp
-
memory/5716-550-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/5772-379-0x0000000000000000-mapping.dmp
-
memory/5932-392-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/5932-388-0x000000000040616E-mapping.dmp
-
memory/5984-397-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/5984-394-0x0000000000403BEE-mapping.dmp
-
memory/6076-403-0x0000000000000000-mapping.dmp
-
memory/6076-421-0x0000000004AB0000-0x0000000004BB1000-memory.dmpFilesize
1.0MB
-
memory/6088-426-0x0000000072730000-0x0000000072E1E000-memory.dmpFilesize
6.9MB
-
memory/6088-404-0x0000000000000000-mapping.dmp