Analysis
-
max time kernel
159s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:03
Static task
static1
Behavioral task
behavioral1
Sample
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe
Resource
win10v2004-20220812-en
General
-
Target
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe
-
Size
272KB
-
MD5
ec7b3c41c1167a89835f604eeeb67171
-
SHA1
b6488a044aaf1b77d41f054d676735e70c07a38f
-
SHA256
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be
-
SHA512
00fceda18d4b4f3fcfd0891b5d68fd69086e8de2af0d20b8b444f9b0f61c1611f6a78a9cb068c3c4f998a5b5f48ee1b6581165c56e57b65634589e501afd5d29
-
SSDEEP
6144:Ue34zYqHkguRuu0Ay4MubunpunBkguRuu0Ay4Mu7:cDkuupusBkuup7
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
GameLogin.newdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ GameLogin.new -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
9377chiyue_Y_mgaz.exeLoginCycs.exeCycsAnimator.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeGameLogin.newLoginCycs.exeLoginCycs.exeLoginCycs.exepid process 4528 9377chiyue_Y_mgaz.exe 4472 LoginCycs.exe 4444 CycsAnimator.exe 4616 LoginCycs.exe 3984 LoginCycs.exe 2504 LoginCycs.exe 3704 LoginCycs.exe 404 LoginCycs.exe 4280 LoginCycs.exe 4844 GameLogin.new 4396 LoginCycs.exe 976 LoginCycs.exe 5688 LoginCycs.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
GameLogin.newdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GameLogin.new Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion GameLogin.new -
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9377chiyue_Y_mgaz.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 9377chiyue_Y_mgaz.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LoginCycs.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
GameLogin.newdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine GameLogin.new -
Loads dropped DLL 33 IoCs
Processes:
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe9377chiyue_Y_mgaz.exeCycsAnimator.exepid process 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 4528 9377chiyue_Y_mgaz.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 4528 9377chiyue_Y_mgaz.exe 4528 9377chiyue_Y_mgaz.exe 4528 9377chiyue_Y_mgaz.exe 4528 9377chiyue_Y_mgaz.exe 4528 9377chiyue_Y_mgaz.exe 4528 9377chiyue_Y_mgaz.exe 4444 CycsAnimator.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9377chiyue_Y_mgaz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CYCSAnimator = "\"C:\\Program Files (x86)\\9377-³àÔ´«Ëµ\\CycsAnimator.exe\" \"C:\\Program Files (x86)\\9377-³àÔ´«Ëµ\\ChiYue.dll\" 1" 9377chiyue_Y_mgaz.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 9377chiyue_Y_mgaz.exe -
Processes:
GameLogin.newdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GameLogin.new -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
GameLogin.newpid process 4844 GameLogin.new -
Drops file in Program Files directory 32 IoCs
Processes:
9377chiyue_Y_mgaz.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exefa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeGameLogin.newdescription ioc process File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini 9377chiyue_Y_mgaz.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\GameLogin.new LoginCycs.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\CYCSToolTip.exe 9377chiyue_Y_mgaz.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\NetSetup\Unload.exe fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.exe 9377chiyue_Y_mgaz.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File created C:\Program Files (x86)\NetSetup\Unload.exe fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\Cycs.ico 9377chiyue_Y_mgaz.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.lnk 9377chiyue_Y_mgaz.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe 9377chiyue_Y_mgaz.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\Lieyan.ico 9377chiyue_Y_mgaz.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\ChiYue.dll 9377chiyue_Y_mgaz.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs_V5.0.7z LoginCycs.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\replay.htm 9377chiyue_Y_mgaz.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\GameLogin.ini GameLogin.new File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.ini LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File opened for modification C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpg LoginCycs.exe File created C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe GameLogin.new -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4880 2504 WerFault.exe LoginCycs.exe 4904 3984 WerFault.exe LoginCycs.exe 5660 4616 WerFault.exe LoginCycs.exe -
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exemsedge.exemsedge.exeGameLogin.newpid process 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe 560 msedge.exe 560 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 4844 GameLogin.new 4844 GameLogin.new 4844 GameLogin.new 4844 GameLogin.new -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GameLogin.newdescription pid process Token: SeDebugPrivilege 4844 GameLogin.new -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
LoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exeLoginCycs.exepid process 4472 LoginCycs.exe 4472 LoginCycs.exe 4616 LoginCycs.exe 4616 LoginCycs.exe 3984 LoginCycs.exe 3984 LoginCycs.exe 2504 LoginCycs.exe 2504 LoginCycs.exe 3704 LoginCycs.exe 3704 LoginCycs.exe 404 LoginCycs.exe 404 LoginCycs.exe 4280 LoginCycs.exe 4280 LoginCycs.exe 4396 LoginCycs.exe 4396 LoginCycs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exemsedge.exedescription pid process target process PID 2944 wrote to memory of 228 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe msedge.exe PID 2944 wrote to memory of 228 2944 fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe msedge.exe PID 228 wrote to memory of 2004 228 msedge.exe msedge.exe PID 228 wrote to memory of 2004 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 2996 228 msedge.exe msedge.exe PID 228 wrote to memory of 560 228 msedge.exe msedge.exe PID 228 wrote to memory of 560 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe PID 228 wrote to memory of 3628 228 msedge.exe msedge.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe"C:\Users\Admin\AppData\Local\Temp\fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://f.shuianshanba.com/fa1196aa3971c2f8df6d4d229b938e85944c6a62df193034003e6d03f01092be.exe/sohu.jpg3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0xfc,0x100,0x9c,0x104,0x7ff815d446f8,0x7ff815d44708,0x7ff815d447184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4209287857103348036,15497272413649986615,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:14⤵
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exe9377chiyue_Y_mgaz.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled6⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"6⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled7⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"7⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled8⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"8⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled9⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"9⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 24686⤵
- Program crash
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\GameLogin.new"C:\Program Files (x86)\9377-³àÔ´«Ëµ\GameLogin.new" "C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.exe" "C:\Program Files (x86)\9377-³àÔ´«Ëµ\ChiYue.dll" 14⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled6⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"6⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled7⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"7⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled8⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""netsh" interface tcp set global autotuninglevel=disabled"8⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" interface tcp set global autotuninglevel=disabled9⤵
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 24726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 24765⤵
- Program crash
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2504 -ip 25041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3984 -ip 39841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4616 -ip 46161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 404 -ip 4041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\ChiYue.dllFilesize
89KB
MD5434c33de9143870388b9067510b4ff24
SHA12b18c82b342817989b262c7217dbedd731dde311
SHA256851c3182ce6b2de19c6956974ce46741d5db98de5bcd97fa286264ad9ecd7ddc
SHA5122a981b71fc5e9bf57b63946057e395d8883a9c06bee9a14130117f63f36cafbb90eb92bc768463374a07716b90cf85e06149aa923ff59bf0c54acacad2bd7de9
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\ChiYue.dllFilesize
89KB
MD5434c33de9143870388b9067510b4ff24
SHA12b18c82b342817989b262c7217dbedd731dde311
SHA256851c3182ce6b2de19c6956974ce46741d5db98de5bcd97fa286264ad9ecd7ddc
SHA5122a981b71fc5e9bf57b63946057e395d8883a9c06bee9a14130117f63f36cafbb90eb92bc768463374a07716b90cf85e06149aa923ff59bf0c54acacad2bd7de9
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.exeFilesize
143KB
MD579b07ca7567357c22b83cca210604205
SHA1a81db09ac5da3859bdb169cd569360d669b816e4
SHA2564f2995c689958bb55d2eb05948878d698576ccd2e55bc49036bf116974f2e59e
SHA5124e665605887838fc67da52713bb93ca80daf0c1e1d45efa21144b9353731c9745168acbe9d2ffc2178990cda6c42313de7525de76ba8861e9223a6cd12d2d166
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\CycsAnimator.exeFilesize
143KB
MD579b07ca7567357c22b83cca210604205
SHA1a81db09ac5da3859bdb169cd569360d669b816e4
SHA2564f2995c689958bb55d2eb05948878d698576ccd2e55bc49036bf116974f2e59e
SHA5124e665605887838fc67da52713bb93ca80daf0c1e1d45efa21144b9353731c9745168acbe9d2ffc2178990cda6c42313de7525de76ba8861e9223a6cd12d2d166
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\ExpData\Logo.jpgFilesize
77KB
MD570ade46417ca8226b53ea3558b7568ab
SHA12b5cee3021f16abb0782963cc700608e025cf7a1
SHA2566721412379ccfcfb09f9ca52983fa00c3b6ef957c9958c8aaed6ba084724e510
SHA512fe5402c38e7d47ac906fa0a69df52afee58f99e0594102c91cba795f504ff15078008d2a5c5c2d047aa0242561823b0a1a0b4c0e7a1b8ff3864745ab6ff81f9b
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exeFilesize
495KB
MD5fed4002a4929eef2250a39bd95c398fa
SHA1d2f6a795ff0d265d108ac2cce5b1ea72cf825b66
SHA256d761c957a4782632eafeee62e46052a804e6ce12d8f2c6f427e93a3c10edfb10
SHA512a970b7c8504139a6b4b4505842da10b9b26295ae51a56721762da0de954bb5bd8d170643ce6a885500f8dfee57e331608dee9e9d937063535c873d3320193f42
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exeFilesize
495KB
MD5fed4002a4929eef2250a39bd95c398fa
SHA1d2f6a795ff0d265d108ac2cce5b1ea72cf825b66
SHA256d761c957a4782632eafeee62e46052a804e6ce12d8f2c6f427e93a3c10edfb10
SHA512a970b7c8504139a6b4b4505842da10b9b26295ae51a56721762da0de954bb5bd8d170643ce6a885500f8dfee57e331608dee9e9d937063535c873d3320193f42
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exeFilesize
495KB
MD5fed4002a4929eef2250a39bd95c398fa
SHA1d2f6a795ff0d265d108ac2cce5b1ea72cf825b66
SHA256d761c957a4782632eafeee62e46052a804e6ce12d8f2c6f427e93a3c10edfb10
SHA512a970b7c8504139a6b4b4505842da10b9b26295ae51a56721762da0de954bb5bd8d170643ce6a885500f8dfee57e331608dee9e9d937063535c873d3320193f42
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exeFilesize
495KB
MD5fed4002a4929eef2250a39bd95c398fa
SHA1d2f6a795ff0d265d108ac2cce5b1ea72cf825b66
SHA256d761c957a4782632eafeee62e46052a804e6ce12d8f2c6f427e93a3c10edfb10
SHA512a970b7c8504139a6b4b4505842da10b9b26295ae51a56721762da0de954bb5bd8d170643ce6a885500f8dfee57e331608dee9e9d937063535c873d3320193f42
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.exeFilesize
495KB
MD5fed4002a4929eef2250a39bd95c398fa
SHA1d2f6a795ff0d265d108ac2cce5b1ea72cf825b66
SHA256d761c957a4782632eafeee62e46052a804e6ce12d8f2c6f427e93a3c10edfb10
SHA512a970b7c8504139a6b4b4505842da10b9b26295ae51a56721762da0de954bb5bd8d170643ce6a885500f8dfee57e331608dee9e9d937063535c873d3320193f42
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.iniFilesize
195B
MD54464377e3fdbc4f53e6e6f64b800474a
SHA1083ad2865a603569548140777a027675b6baafc1
SHA25664b7e2d98b12c4be57043b52439d3f762f84e92cb68bf4be254972fdfe5ee0af
SHA51203ffcaa693d180ef49dbe0616b16c8af09f0b668ff0359cd307c0b39590912fffc8c16c440e39012fe86223644380eda79cb10484605d91811f159004ee3d74e
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.iniFilesize
195B
MD555aaa43b5a12ef04e2b62d0a04a4ec46
SHA19ea6f8d2ef2bddeb5e0a6828c90959afa10ffdeb
SHA256dc32439c1d01975dd7ca1cf13d4fbe3c1c95d7f87c5c6da5aca12c7d82e9438d
SHA5124ea2f478081283b9e8b9cbbca9d102503a415976e8810dc8477ad125f343b157cbc7c257605687313b550fa1cf94ced5cb30d1b98a0f6207808d09abd42f2a49
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.iniFilesize
195B
MD555aaa43b5a12ef04e2b62d0a04a4ec46
SHA19ea6f8d2ef2bddeb5e0a6828c90959afa10ffdeb
SHA256dc32439c1d01975dd7ca1cf13d4fbe3c1c95d7f87c5c6da5aca12c7d82e9438d
SHA5124ea2f478081283b9e8b9cbbca9d102503a415976e8810dc8477ad125f343b157cbc7c257605687313b550fa1cf94ced5cb30d1b98a0f6207808d09abd42f2a49
-
C:\Program Files (x86)\9377-³àÔ´«Ëµ\LoginCycs.iniFilesize
195B
MD555aaa43b5a12ef04e2b62d0a04a4ec46
SHA19ea6f8d2ef2bddeb5e0a6828c90959afa10ffdeb
SHA256dc32439c1d01975dd7ca1cf13d4fbe3c1c95d7f87c5c6da5aca12c7d82e9438d
SHA5124ea2f478081283b9e8b9cbbca9d102503a415976e8810dc8477ad125f343b157cbc7c257605687313b550fa1cf94ced5cb30d1b98a0f6207808d09abd42f2a49
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exeFilesize
674KB
MD5e258e77914272054d942bc9cb27ca477
SHA1786c0c24b88898fb008da18b2ea7488b6a619fe4
SHA256b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a
SHA5121f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\9377chiyue_Y_mgaz.exeFilesize
674KB
MD5e258e77914272054d942bc9cb27ca477
SHA1786c0c24b88898fb008da18b2ea7488b6a619fe4
SHA256b34280131cf2daf8c71dfaf202a84904234faefdee19b4ab8d73ce2052cead4a
SHA5121f9e50b18ec42fb78853729b19d88a17bb26fafcec735a8400e9d1acf20e49b9532e3fb0ecdddd0cc1e385907ac2d76d144971f513ac526a4e113ce31c98f50f
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NSISdl.dllFilesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NsProcess.dllFilesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\NsProcess.dllFilesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
C:\Users\Admin\AppData\Local\Temp\nsqBD89.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\inetc.dllFilesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\ip.dllFilesize
16KB
MD54df6320e8281512932a6e86c98de2c17
SHA1ae6336192d27874f9cd16cd581f1c091850cf494
SHA2567744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
SHA5127c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
-
C:\Users\Admin\AppData\Local\Temp\nsv7915.tmp\ip.dllFilesize
16KB
MD54df6320e8281512932a6e86c98de2c17
SHA1ae6336192d27874f9cd16cd581f1c091850cf494
SHA2567744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
SHA5127c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
-
C:\Users\Admin\Desktop\9377-³àÔ´«Ëµ.lnkFilesize
1KB
MD5da1c28517f775b0fe72e3b857bb6199c
SHA1ce8e736624e226cf040f0e34f226c940498babf3
SHA256ae7d6610e66206e459613e887a272de416130315bb8fadc0bf153d8773102b1f
SHA51254fb6ee4bda829d8ba8014bcf003805a745b81950fefb740fe9999a2027be0e74993465ea6c35711ffe182bbce76ff028ae8fcf244f3acda2a16c50e090d9cb6
-
C:\Users\Admin\Desktop\9377-³àÔ´«Ëµ.lnkFilesize
1KB
MD5e013a477c3082b56af57a7d04574148d
SHA1c1a37ebde2bf5b1465c4080dea6e473ac4f31661
SHA2566f7f4fe65229a3dcda0b621e0005fd39ac7b61fe24f066ad521bc701e02f9606
SHA51245031ab50ff65c47c814a153dd3206caa934c154ed6340d6977a9fef839a8c0a56d4fb3c9870f338f7690d48f0b6a128f670af626d4ad9e8d5072a21c3e1f765
-
C:\Users\Admin\Desktop\9377-³àÔ´«Ëµ.lnkFilesize
1KB
MD5e013a477c3082b56af57a7d04574148d
SHA1c1a37ebde2bf5b1465c4080dea6e473ac4f31661
SHA2566f7f4fe65229a3dcda0b621e0005fd39ac7b61fe24f066ad521bc701e02f9606
SHA51245031ab50ff65c47c814a153dd3206caa934c154ed6340d6977a9fef839a8c0a56d4fb3c9870f338f7690d48f0b6a128f670af626d4ad9e8d5072a21c3e1f765
-
C:\Users\Admin\Desktop\9377-³àÔ´«Ëµ.lnkFilesize
1KB
MD597ba8f961b375606dacb2f092608ab9e
SHA18622d62b27e3e2a43c1b9e4845833a110c72585a
SHA2569d6e57d0616f5f438850b3ea6bd83dd1dafd58b48905952b6f1e0c79ff032908
SHA5124a531c488d67e4a0a82e004b7a8bd6bc801085942914004beb779fac15fe4fd0589b84d4bc6b95ff12fd1b59e005472704fbd17da1ed905ce86c26682984bdac
-
C:\Users\Admin\Desktop\9377-³àÔ´«Ëµ.lnkFilesize
1KB
MD597ba8f961b375606dacb2f092608ab9e
SHA18622d62b27e3e2a43c1b9e4845833a110c72585a
SHA2569d6e57d0616f5f438850b3ea6bd83dd1dafd58b48905952b6f1e0c79ff032908
SHA5124a531c488d67e4a0a82e004b7a8bd6bc801085942914004beb779fac15fe4fd0589b84d4bc6b95ff12fd1b59e005472704fbd17da1ed905ce86c26682984bdac
-
\??\pipe\LOCAL\crashpad_228_BUYGKPANTRYIFGHLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/228-147-0x0000000000000000-mapping.dmp
-
memory/404-240-0x0000000000000000-mapping.dmp
-
memory/560-157-0x0000000000000000-mapping.dmp
-
memory/728-221-0x0000000000000000-mapping.dmp
-
memory/976-250-0x0000000000000000-mapping.dmp
-
memory/1060-220-0x0000000000000000-mapping.dmp
-
memory/1084-242-0x0000000000000000-mapping.dmp
-
memory/1352-211-0x0000000000000000-mapping.dmp
-
memory/1448-168-0x0000000000000000-mapping.dmp
-
memory/1548-244-0x0000000000000000-mapping.dmp
-
memory/1664-241-0x0000000000000000-mapping.dmp
-
memory/1980-239-0x0000000000000000-mapping.dmp
-
memory/1992-234-0x0000000000000000-mapping.dmp
-
memory/2004-151-0x0000000000000000-mapping.dmp
-
memory/2344-226-0x0000000000000000-mapping.dmp
-
memory/2504-227-0x0000000000000000-mapping.dmp
-
memory/2732-233-0x0000000000000000-mapping.dmp
-
memory/2740-172-0x0000000000000000-mapping.dmp
-
memory/2752-237-0x0000000000000000-mapping.dmp
-
memory/2944-137-0x0000000002F41000-0x0000000002F44000-memory.dmpFilesize
12KB
-
memory/2944-143-0x0000000002DD1000-0x0000000002DD4000-memory.dmpFilesize
12KB
-
memory/2944-146-0x0000000000511000-0x0000000000514000-memory.dmpFilesize
12KB
-
memory/2996-156-0x0000000000000000-mapping.dmp
-
memory/3148-199-0x0000000000000000-mapping.dmp
-
memory/3300-247-0x0000000000000000-mapping.dmp
-
memory/3392-216-0x0000000000000000-mapping.dmp
-
memory/3628-160-0x0000000000000000-mapping.dmp
-
memory/3704-236-0x0000000000000000-mapping.dmp
-
memory/3904-164-0x0000000000000000-mapping.dmp
-
memory/3944-170-0x0000000000000000-mapping.dmp
-
memory/3972-248-0x0000000000000000-mapping.dmp
-
memory/3984-223-0x0000000000000000-mapping.dmp
-
memory/4064-231-0x0000000000000000-mapping.dmp
-
memory/4092-162-0x0000000000000000-mapping.dmp
-
memory/4280-243-0x0000000000000000-mapping.dmp
-
memory/4344-166-0x0000000000000000-mapping.dmp
-
memory/4396-246-0x0000000000000000-mapping.dmp
-
memory/4444-208-0x0000000000000000-mapping.dmp
-
memory/4472-204-0x0000000000000000-mapping.dmp
-
memory/4528-191-0x0000000002041000-0x0000000002044000-memory.dmpFilesize
12KB
-
memory/4528-176-0x0000000000000000-mapping.dmp
-
memory/4528-194-0x0000000002041000-0x0000000002044000-memory.dmpFilesize
12KB
-
memory/4616-209-0x0000000000000000-mapping.dmp
-
memory/4692-203-0x0000000000000000-mapping.dmp
-
memory/4844-245-0x0000000000000000-mapping.dmp
-
memory/4844-257-0x00000000776E0000-0x0000000077883000-memory.dmpFilesize
1.6MB
-
memory/4844-249-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/4844-258-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/4952-201-0x0000000000000000-mapping.dmp
-
memory/5152-251-0x0000000000000000-mapping.dmp
-
memory/5180-252-0x0000000000000000-mapping.dmp
-
memory/5476-253-0x0000000000000000-mapping.dmp
-
memory/5588-254-0x0000000000000000-mapping.dmp
-
memory/5688-255-0x0000000000000000-mapping.dmp