Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 13:19
Static task
static1
Behavioral task
behavioral1
Sample
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe
Resource
win10v2004-20220812-en
General
-
Target
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe
-
Size
5.7MB
-
MD5
5e7766282d74ebf8e5b95c422180b6a0
-
SHA1
68654a5c5219f27d8ba5a3f7b74ae74d1dc9acf0
-
SHA256
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84
-
SHA512
fedbbfceb2a164283f7d3c4672317c79d6744ed099950f9a29ea8c4784f9dc410c728ff3ddab4fbefbfe3c525c1ae621d58ce044520149a20e8b857c27ce2442
-
SSDEEP
98304:jL+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czN:f89J/ANzywiJlgQNUJ2BTDYiqcAViVwR
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
optprosetup.exeoptprosetup.tmpOptProStart.exeOptimizerPro.exepid process 632 optprosetup.exe 712 optprosetup.tmp 1188 OptProStart.exe 1476 OptimizerPro.exe -
Modifies AppInit DLL entries 2 TTPs
-
Loads dropped DLL 21 IoCs
Processes:
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exeoptprosetup.exeoptprosetup.tmprundll32.exerundll32.exeOptimizerPro.exepid process 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe 632 optprosetup.exe 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 712 optprosetup.tmp 1720 rundll32.exe 1720 rundll32.exe 1720 rundll32.exe 1720 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 1652 rundll32.exe 712 optprosetup.tmp 712 optprosetup.tmp 1476 OptimizerPro.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
optprosetup.tmpdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Optimizer Pro = "C:\\Program Files (x86)\\Optimizer Pro\\OptProLauncher.exe" optprosetup.tmp Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run optprosetup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 36 IoCs
Processes:
optprosetup.tmpdescription ioc process File created C:\Program Files (x86)\Optimizer Pro\is-VURNF.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-1J65E.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-JBITA.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-IM75N.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-7O5H6.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-A5QIN.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\itdownload.dll optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProGuard.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-R7V1F.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProHelper.dll optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-6MJRO.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\unins000.dat optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-39P26.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-2RGC2.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-BCBSI.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProUninstaller.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\sqlite3.dll optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-9AO2S.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-7NR52.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-4NJGM.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\unins000.dat optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-5CO2D.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-3EJ0O.tmp optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProSchedule.exe optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-A40T8.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-3UR57.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-H223I.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\unins000.msg optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptimizerPro.chm optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\is-EBGTD.tmp optprosetup.tmp File created C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe optprosetup.tmp File opened for modification C:\Program Files (x86)\Optimizer Pro\OptProStart.exe optprosetup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 51 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\a0743acc = "N/////%%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\0c230bcb = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\1520c6f1 = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\1c311243 = "alAl/YP/b/Af/X6/clAu/XZ/UxAp/X2/GxAk////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\27ddcf6f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\38583bc3 = "Ml/2/CF/M//g/CZ////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\6185d035 = "VP/h/CP/V//l////" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\iiid = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\00000000\3efeb33e = 6e0055003100550030003700780030006d00300031004d00300036004500300071006c0031004d0030003600450030006900550031004e0030003600740030006d006c003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006d00550031005000300037003800300070006c00310044003000360049003000700055003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006900780031004f0030003600680030006e0030003100440030003700780030006a0078003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006d00550031005000300037003800300070006c003000530030003600680030006e006c0031004100300036004500300000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\2d71d5ab = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\587b5709 = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\65114b36 = "VP/+////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\8b9e4cbc = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\414bc593 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\f0bf0bde = "///%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\00000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\7f69fa1f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\d1abcdb6 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\d94388d2 = "alAl/YP/b/Af/X6/clAu/XZ/UxAp/X2/GxAk////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\f1f24e29 = "Vl/l/C/////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\fe94ce1e = "V/////%%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\3c09c42b = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\51d2f2ea = "IlAl/YP/J/Af/X6/PlAf/XD/blAq/B//VP/j/Cx/V//j/CZ/V//l/CZ////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\a2e3b941 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\c99a5f5c = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\e46c271e = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\f6ad6fa6 = "VP/l/C//V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\f2c53c49 = "UlAr/XJ/c//k////" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\00000000\a47da861 = 6f00300031004f0030003700780030006d00300030004b00300032004500300061005500310054003000370030003000690030003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e0030003100550030003700380030006e0055003000530030003600490030007000780031004f003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b00300032004500300061005500310054003000370030003000690030003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e0030003100550030003700380030006e0055003000530030003600680030006e006c00310041003000360045003000610055003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e00300030005400300030002500250000006f00300031004f0030003700780030006d00300030004b00300032004500300061005500310054003000370030003000690030003100550030003700380030006e00550031004d0030003600740030006e007800310054003000370071003000710078003100590030003200490030006f0078003100530030003600710030006e0055003000540030003700740030006e006c003100440030003600490030006d00550031004f0030003600340030006e00300031005900300032004500300000006f00300031004f0030003700780030006d00300030004b00300032004500300061005500310054003000370030003000690030003100550030003700380030006e00550031004d0030003600740030006e007800310054003000370071003000710078003100590030003200490030007100550031005400300036004f003000610055003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e00300030005400300030002500250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100540030003700300030006900300031004400300036004f0030006f00780031004b0030003600740030006d006c003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e0030003000530030003600680030006e006c00310041003000360045003000610055003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e00300030005400300030002500250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100540030003700300030006900300031004400300036004f0030006f00780031004b0030003600740030006d006c003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e0030003000530030003600620030006e00550031005a003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\0dc3ee96 = "/P////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\340d3099 = "/P////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\72758a5d = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\bbf88800 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\c24899a6 = "Vx/g/C//M/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\c6c5dd44 = "V/////%%" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\00000000\370856c7 = 6e0055003100550030003700780030006d00300031004d00300036004500300071006c0031004d0030003600450030006900550031004e0030003600740030006d006c003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006d00550031005000300037003800300070006c00310044003000360049003000700055003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006900780031004f0030003600680030006e0030003100440030003700780030006a0078003000530030003600680030006e006c0031004100300036004500300000006e0055003100550030003700780030006d00300031004d0030003600450030006d00550031005000300037003800300070006c003000530030003600680030006e006c0031004100300036004500300000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\060df2cd = "alAl/YP/b/Af/X6/UxAp/X2/GxAk////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\7367429f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\a1dcff5b = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\c5705860 = "Vx////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\e8f9dcc7 = "UlAr/XJ/c//k////" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\00000000\493c7345 = 00000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\0e93c3f3 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\2e22d94e = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\37b7a6d8 = "UlAr/XJ/c//k////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_70e6ca8c\eae10f9d\48bd1aff = "VP/l/C//N//l////" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
optprosetup.tmppid process 712 optprosetup.tmp 712 optprosetup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
optprosetup.tmppid process 712 optprosetup.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OptimizerPro.exepid process 1476 OptimizerPro.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exeoptprosetup.exeoptprosetup.tmprundll32.exeOptProStart.exeOptimizerPro.exedescription pid process target process PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 1540 wrote to memory of 632 1540 f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe optprosetup.exe PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 632 wrote to memory of 712 632 optprosetup.exe optprosetup.tmp PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 712 wrote to memory of 1720 712 optprosetup.tmp rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 1764 wrote to memory of 1652 1764 rundll32.exe rundll32.exe PID 712 wrote to memory of 1188 712 optprosetup.tmp OptProStart.exe PID 712 wrote to memory of 1188 712 optprosetup.tmp OptProStart.exe PID 712 wrote to memory of 1188 712 optprosetup.tmp OptProStart.exe PID 712 wrote to memory of 1188 712 optprosetup.tmp OptProStart.exe PID 1188 wrote to memory of 1476 1188 OptProStart.exe OptimizerPro.exe PID 1188 wrote to memory of 1476 1188 OptProStart.exe OptimizerPro.exe PID 1188 wrote to memory of 1476 1188 OptProStart.exe OptimizerPro.exe PID 1188 wrote to memory of 1476 1188 OptProStart.exe OptimizerPro.exe PID 1476 wrote to memory of 936 1476 OptimizerPro.exe schtasks.exe PID 1476 wrote to memory of 936 1476 OptimizerPro.exe schtasks.exe PID 1476 wrote to memory of 936 1476 OptimizerPro.exe schtasks.exe PID 1476 wrote to memory of 936 1476 OptimizerPro.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe"C:\Users\Admin\AppData\Local\Temp\f9c82b093a049a082cdf5a1a7042f0b7b5fefe56c0c1a2db53ae8d98683d6b84.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeC:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GRDMH.tmp\optprosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-GRDMH.tmp\optprosetup.tmp" /SL5="$A001C,5286589,118784,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT -install4⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe"C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe" /START5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Optimizer Pro Schedule" /TR "\"C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe\"" /SC ONLOGON /RL HIGHEST /F6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ENT2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Optimizer Pro\English.iniFilesize
22KB
MD517c6915f5142b3d576c19dbe9615f1ea
SHA1c2e4c3b15ae9744ea564bc3393923e3e12e38f09
SHA256e0f54af0f070c5a37dc67182fbc53bbda664d714e0b100f398fddbe5bb817884
SHA512346e7e982401b43ce5d8e19b2f77848802f3dfbb279d369031bb77388edd4b137dc52ec96066c79e27eb49cf621a3a9d8f81c7f8a3c04a8103aadfd46c12a66d
-
C:\Program Files (x86)\Optimizer Pro\OptProStart.exeFilesize
643KB
MD51713fa8e8ecdfb32c46dd466c63107c6
SHA13798f368de630f751d3c05de7f9cfe7134caa604
SHA2568e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f
SHA51271bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1
-
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
C:\Program Files (x86)\Optimizer Pro\Scan.gifFilesize
55KB
MD56858a1ce31e5f92785fb525ce9725b8a
SHA16f666e761cb39ec0efa78038038706c6e09641ca
SHA256d576f0c14f855954701b054d625f7a95a5bfcd97ace82d83a4f00bda7a4cc908
SHA512b23b40e5f278dc12be7ebe0872acff893df84ff7c936f56de8111e0dfc442dd2797583d7bb5feb4157bb67292344ea078bce1f93f5a3f60a5bbe20032ccad9f2
-
C:\Users\Admin\AppData\Local\Temp\is-GRDMH.tmp\optprosetup.tmpFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
C:\Users\Admin\AppData\Local\Temp\is-GRDMH.tmp\optprosetup.tmpFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeFilesize
5.5MB
MD53d31e999e8433d22b740ee0c55ac93ce
SHA173ad53e7f5198f124f70d31bf2b2c6511aa8caea
SHA256769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba
SHA51285654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeFilesize
5.5MB
MD53d31e999e8433d22b740ee0c55ac93ce
SHA173ad53e7f5198f124f70d31bf2b2c6511aa8caea
SHA256769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba
SHA51285654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b
-
\??\c:\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Program Files (x86)\Optimizer Pro\OptProStart.exeFilesize
643KB
MD51713fa8e8ecdfb32c46dd466c63107c6
SHA13798f368de630f751d3c05de7f9cfe7134caa604
SHA2568e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f
SHA51271bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1
-
\Program Files (x86)\Optimizer Pro\OptProStart.exeFilesize
643KB
MD51713fa8e8ecdfb32c46dd466c63107c6
SHA13798f368de630f751d3c05de7f9cfe7134caa604
SHA2568e8c99cbefb1e13e19b730c287f8a46b175f888d1959948bb9540008233dca2f
SHA51271bf969af56061520a534ed5c25bed4fca5fbda02218fe79eab1bb32912c7e3da6bd3071ed5b3a1259205e145d1251ab4dd74cc2afc99ab708b50c39e98470c1
-
\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
\Program Files (x86)\Optimizer Pro\OptimizerPro.exeFilesize
3.1MB
MD5c2c83c1e16f8e452951257ef4e5421cf
SHA119dbd5ea6880f0ba2a2cbfae18c814a038d8a092
SHA2560d826f5799d95619a997f252798fff9ed2f975c96ea7acf1c3c8463062a1ca39
SHA51203941c2f82e353c98a704beed91194a9add36e9d7ed043b141f2d599d4dbce27f0c0dcc33a7c7648ccd61a6dd708e37e331ef25fa1c78f0d2650932055e708c0
-
\Program Files (x86)\Optimizer Pro\unins000.exeFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
\Users\Admin\AppData\Local\Temp\is-09GJF.tmp\OptProCrash.dllFilesize
3.4MB
MD58565b14afbe6625e11065a3526c75192
SHA12eff65173426ca303dec447d66028552629836d5
SHA256da5cd23d75fb370d412568ae909e113145e0e472d8a9a80b3e06ed3c8f839c11
SHA5122740810ab2042e8dd3b887566b0f2bc540ff07737a079c32cf35498e32729651db9466d2db33ff092d43b8735a0b6b83571a146e5503152ced971b23b9e56dd9
-
\Users\Admin\AppData\Local\Temp\is-09GJF.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-09GJF.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-09GJF.tmp\itdownload.dllFilesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-GRDMH.tmp\optprosetup.tmpFilesize
1.1MB
MD550488cf899d007d697893fc72a823fb0
SHA1bc5512f623656ad69a054d558c35d463a5a8a6c1
SHA256d9b74c8ed046400b8966ca503bc5a4f0445736949651c4af8faefc68265652cf
SHA5122b275262a2f7a4a55bc40a8e3e264831273d04f197f52fabfbdb9720f0754da17d3da6a872590aebd5e4fc462b25b55c34c45e56fd7319bf1b52d847dd4f74a0
-
\Users\Admin\AppData\Local\Temp\optprosetup.exeFilesize
5.5MB
MD53d31e999e8433d22b740ee0c55ac93ce
SHA173ad53e7f5198f124f70d31bf2b2c6511aa8caea
SHA256769ce23a88674e9ff07f08652c4fa2498dd6301359a2bc8fda5e50f59ebce6ba
SHA51285654a99bbb36c49490cdc91ad663bd25ca08b691c33002abc7258e9e0e3618734650dbbba51cfd915f80322253d0dd36eabce954a0da8f297d7072dabbc753b
-
memory/632-96-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/632-55-0x0000000000000000-mapping.dmp
-
memory/632-57-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/632-70-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/632-58-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/632-61-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/712-69-0x0000000000930000-0x000000000096C000-memory.dmpFilesize
240KB
-
memory/712-63-0x0000000000000000-mapping.dmp
-
memory/712-72-0x0000000074621000-0x0000000074623000-memory.dmpFilesize
8KB
-
memory/936-102-0x0000000000000000-mapping.dmp
-
memory/1188-93-0x0000000000000000-mapping.dmp
-
memory/1476-98-0x0000000000000000-mapping.dmp
-
memory/1652-85-0x0000000000000000-mapping.dmp
-
memory/1720-78-0x0000000000000000-mapping.dmp