Analysis
-
max time kernel
209s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 15:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dl.pentestcore.com/dl.php?url=up/upload-wp/2020/12/H-Pro-v1.17-PentestCore.rar
Resource
win10v2004-20230220-en
General
-
Target
https://dl.pentestcore.com/dl.php?url=up/upload-wp/2020/12/H-Pro-v1.17-PentestCore.rar
Malware Config
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
https://technet.microsoft.com/en-us/library/security/ms14-064.aspx
http://rarlab.com/vuln_sfx_html2.htm
https://blake2.net
Extracted
C:\Program Files\WinRAR\Rar.txt
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WinRAR.exewinrar-x64-621.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation WinRAR.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation winrar-x64-621.exe -
Executes dropped EXE 6 IoCs
Processes:
winrar-x64-621.exeuninstall.exeWinRAR.exeHavij 1.17 Pro.exeHavij 1.17 Pro.tmpHavij.exepid process 2948 winrar-x64-621.exe 2940 uninstall.exe 1088 WinRAR.exe 3840 Havij 1.17 Pro.exe 4276 Havij 1.17 Pro.tmp 2888 Havij.exe -
Loads dropped DLL 7 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeHavij.exepid process 1184 regsvr32.exe 4144 regsvr32.exe 1180 regsvr32.exe 4800 regsvr32.exe 4852 regsvr32.exe 4900 regsvr32.exe 2888 Havij.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Havij.exedescription ioc process File opened for modification \??\PhysicalDrive0 Havij.exe -
Drops file in System32 directory 6 IoCs
Processes:
Havij 1.17 Pro.tmpdescription ioc process File created C:\Windows\SysWOW64\is-NE0LO.tmp Havij 1.17 Pro.tmp File created C:\Windows\SysWOW64\is-9FRL7.tmp Havij 1.17 Pro.tmp File created C:\Windows\SysWOW64\is-UONSR.tmp Havij 1.17 Pro.tmp File created C:\Windows\SysWOW64\is-JLNM3.tmp Havij 1.17 Pro.tmp File created C:\Windows\SysWOW64\is-AKRKN.tmp Havij 1.17 Pro.tmp File created C:\Windows\SysWOW64\is-3P8JN.tmp Havij 1.17 Pro.tmp -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Havij.exepid process 2888 Havij.exe -
Drops file in Program Files directory 64 IoCs
Processes:
winrar-x64-621.exeHavij 1.17 Pro.tmpuninstall.exedescription ioc process File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-621.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-621.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-4HQK5.tmp Havij 1.17 Pro.tmp File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-MA70C.tmp Havij 1.17 Pro.tmp File created C:\Program Files\WinRAR\Descript.ion winrar-x64-621.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-621.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR winrar-x64-621.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-621.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-621.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-621.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-A5P8C.tmp Havij 1.17 Pro.tmp File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-621.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-621.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-621.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-EVGF2.tmp Havij 1.17 Pro.tmp File opened for modification C:\Program Files (x86)\ITSecTeam\Havij Pro\unins000.dat Havij 1.17 Pro.tmp File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-621.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-621.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-UDQA3.tmp Havij 1.17 Pro.tmp File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-621.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-621.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-621.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-621.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-621.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-I95P1.tmp Havij 1.17 Pro.tmp File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240635421 winrar-x64-621.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-621.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-621.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-621.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-621.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-621.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-621.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files (x86)\ITSecTeam\Havij Pro\is-BB263.tmp Havij 1.17 Pro.tmp File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-621.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-621.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-621.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
WinRAR.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133249285626042474" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeuninstall.exeregsvr32.exeregsvr32.exeregsvr32.exeHavij 1.17 Pro.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE5-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\VersionIndependentProgID\ = "TabDlg.SSTab" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B617B991-A767-4F05-99BA-AC6FCABB102E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2\CLSID\ = "{C74190B6-8589-11D1-B16A-00C0F0283628}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\InprocServer32\ = "C:\\Windows\\SysWow64\\tabctl32.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}\ = "RichText Apppearance Property Page Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F050-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\Version = "1.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{3B7C8863-D78F-101B-B9B5-04021C009402}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}\ = "IStatusBarEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ = "ICommonDialog" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\havijfile\shelll\open\command\ = "C:\\Program Files (x86)\\ITSecTeam\\Havij Pro\\Havij.exe %1" Havij 1.17 Pro.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Version\ = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.SBarCtrl.2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\ProgID\ = "TabDlg.SSTab.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\ = "TabStrip General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
chrome.exechrome.exeHavij.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 1768 chrome.exe 1768 chrome.exe 2888 Havij.exe 2888 Havij.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WinRAR.exepid process 1088 WinRAR.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe Token: SeShutdownPrivilege 4768 chrome.exe Token: SeCreatePagefilePrivilege 4768 chrome.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
Processes:
chrome.exeWinRAR.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 1088 WinRAR.exe 1088 WinRAR.exe 1088 WinRAR.exe 1088 WinRAR.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe 4768 chrome.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
OpenWith.exewinrar-x64-621.exeuninstall.exeWinRAR.exeHavij.exepid process 1892 OpenWith.exe 2948 winrar-x64-621.exe 2948 winrar-x64-621.exe 2948 winrar-x64-621.exe 2940 uninstall.exe 1088 WinRAR.exe 1088 WinRAR.exe 2888 Havij.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4768 wrote to memory of 2032 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2032 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 3716 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4236 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 4236 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe PID 4768 wrote to memory of 2700 4768 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://dl.pentestcore.com/dl.php?url=up/upload-wp/2020/12/H-Pro-v1.17-PentestCore.rar1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcec559758,0x7ffcec559768,0x7ffcec5597782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4520 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5176 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5408 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4064 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5548 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6116 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6076 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5200 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3392 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5456 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=820 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3372 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Users\Admin\Downloads\winrar-x64-621.exe"C:\Users\Admin\Downloads\winrar-x64-621.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4920 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6056 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6188 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6032 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:12⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\H-Pro-v1.17-PentestCore.rar"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exe"C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-UJ7MS.tmp\Havij 1.17 Pro.tmp"C:\Users\Admin\AppData\Local\Temp\is-UJ7MS.tmp\Havij 1.17 Pro.tmp" /SL5="$B0208,6394355,53248,C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\RICHTX32.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Mscomctl.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Mswinsck.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\comdlg32.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSInet.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\tabctl32.ocx"5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\ITSecTeam\Havij Pro\Havij.exe"C:\Program Files (x86)\ITSecTeam\Havij Pro\Havij.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 --field-trial-handle=1788,i,11041085097321809728,121993268048030212,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\ITSecTeam\Havij Pro\Havij.exeFilesize
719KB
MD59283a910bbf58a143ca8376eadfd1baa
SHA15000d77563417977a2559085fb8d62ddcfe18708
SHA2565608c4b096dc812d9bb714e89421f54ed9559bd319224efeb55f7f10b80e60be
SHA512eb7f0323b440211a47a41e9d6f293c8e10fcfffa84a8a1fa2ba0b6083f801d7394ebcbfbd949d5f378672d5d9b54dada6186ef59f8804f3969504e262f55b0fa
-
C:\Program Files (x86)\ITSecTeam\Havij Pro\Havij.exeFilesize
719KB
MD59283a910bbf58a143ca8376eadfd1baa
SHA15000d77563417977a2559085fb8d62ddcfe18708
SHA2565608c4b096dc812d9bb714e89421f54ed9559bd319224efeb55f7f10b80e60be
SHA512eb7f0323b440211a47a41e9d6f293c8e10fcfffa84a8a1fa2ba0b6083f801d7394ebcbfbd949d5f378672d5d9b54dada6186ef59f8804f3969504e262f55b0fa
-
C:\Program Files (x86)\ITSecTeam\Havij Pro\Havij.exeFilesize
719KB
MD59283a910bbf58a143ca8376eadfd1baa
SHA15000d77563417977a2559085fb8d62ddcfe18708
SHA2565608c4b096dc812d9bb714e89421f54ed9559bd319224efeb55f7f10b80e60be
SHA512eb7f0323b440211a47a41e9d6f293c8e10fcfffa84a8a1fa2ba0b6083f801d7394ebcbfbd949d5f378672d5d9b54dada6186ef59f8804f3969504e262f55b0fa
-
C:\Program Files\WinRAR\Rar.txtFilesize
109KB
MD5e51d9ff73c65b76ccd7cd09aeea99c3c
SHA1d4789310e9b7a4628154f21af9803e88e89e9b1b
SHA2567456f489100ec876062d68d152081167ac00d45194b17af4a8dd53680acfc9bd
SHA51257ab82d4a95d3b5d181c0ec1a1a1de56a4d6c83af5644032ff3af71e9bd8e13051ae274609bda8b336d70a99f2fba17331773694d7e98d4a7635f7b59651b77c
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
437KB
MD5cac9723066062383778f37e9d64fd94e
SHA11cd78fc041d733f7eacdd447371c9dec25c7ef2c
SHA256e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad
SHA5122b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
437KB
MD5cac9723066062383778f37e9d64fd94e
SHA11cd78fc041d733f7eacdd447371c9dec25c7ef2c
SHA256e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad
SHA5122b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59
-
C:\Program Files\WinRAR\WhatsNew.txtFilesize
103KB
MD54c88a040b31c4d144b44b0dc68fb2cc8
SHA1bf473f5a5d3d8be6e5870a398212450580f8b37b
SHA2566f1a005a0e5c765fcc68fe15f7ccd18667a6e583980e001ba7181aaaeed442b8
SHA512e7f224a21d7c111b83775c778e6d9fa447e53809e0efd4f3ba99c7d6206036aa3dde9484248b244fb26789467559a40516c8e163d379e84dcf31ac84b4c5d2a8
-
C:\Program Files\WinRAR\WinRAR.chmFilesize
317KB
MD5381eae01a2241b8a4738b3c64649fbc0
SHA1cc5944fde68ed622ebee2da9412534e5a44a7c9a
SHA256ad58f39f5d429b5a3726c4a8ee5ccada86d24273eebf2f6072ad1fb61ea82d6e
SHA512f7a8903ea38f2b62d6fa2cc755e0d972a14d00a2e1047e6e983902eff1d3a6bca98327c2b8ed47e46435d1156816e4b0d494726fce87b6cbe7722f5249889b88
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.4MB
MD546d15a70619d5e68415c8f22d5c81555
SHA112ec96e89b0fd38c469546042e30452b070e337f
SHA2562e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781
SHA51209446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.4MB
MD546d15a70619d5e68415c8f22d5c81555
SHA112ec96e89b0fd38c469546042e30452b070e337f
SHA2562e503ad5a9c800f2dac2fed2b3e8698d96d25b219ed86ed1a54896232cbe4781
SHA51209446dc9d0c768844213f7f71ba65ee4e86b61d7a61610b63892d1b142952bdd346d14d27d878c026362e012e22fcb49c6746912d5e02db6b40223cafa6d01fb
-
C:\Program Files\WinRAR\uninstall.exeFilesize
437KB
MD5cac9723066062383778f37e9d64fd94e
SHA11cd78fc041d733f7eacdd447371c9dec25c7ef2c
SHA256e187e1119350caa3aec9d531989f60452d0198368f19cf65ffd2194a8a4003ad
SHA5122b3dc50fb5006f1f3beec1774d0927a0533b49d20122e49a0b4b41840f83c494376c8e61da735aa58d27453c44450203d5c2bb4f03fdd37b648ee0f51f925c59
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\768444b1-d991-4aea-be8b-3ae34a5c4dcb.tmpFilesize
176KB
MD5e6068d0dfe2722c41c7459b3a39bbf29
SHA114ebb26a13a22582f8e467107d7fafc2a5a67d8a
SHA256eb347cd4bcf00fd4c0c0a373fec28174bc73c6bf8006841f33b3a45b7548b216
SHA5122a1b56ed8530fce551191a7d50d801a28b8fa9181779ba1c67a60c10cb5fe1493f76a4960f3ac2986035691ebc1d59800bde74722f4eb091a0fb1710b0b3ecf8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD59637c2950c10d0c9cb319e55ca44dde6
SHA17b5aae9ff3ac01d71753164b5138a426ee5e3dd4
SHA256474b277d3b07a83422c042cae62e1335e1c8900bdaabc32206a034c313e4518a
SHA51206bd14588f6250ae63e331aa8dfc500910b7d5505f93b7ec847c42826850a174b2d2f8f6d8a8625160de7c5e8c5e9b4ac7cacd42a2fbd151b5c785491b1d5bf2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
312B
MD595947f9cd8a189345fdba47c8a538fd7
SHA1b7523343af04bf9dd9c333f270e0ed84b2235bb9
SHA256f5a10f5e6268b83d8d4f5973b47e62362733ebfb9cf7f1b1e6e028803965c324
SHA5128b16b47eda95b4b05f0c47b76b085fd32f6ed8ee09851ef7a06170830f2158d378a854349865b0b57941b5f70bda561168ac77e1e7b867061fcb963007d740ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD51ddbcb6a1d2f7f0ff6d78f60002ad77b
SHA1c9ade0239e3fcfc07d57d55e676ddde2edb9d84f
SHA25605ebd1dfbf5971d701628683668eef351f37f3215bbac9d9c3a0d7c5b7881770
SHA512dd86bc2328bd6b05a44f7c2296bb88260d1f6a7604b78f9ad44a79989122b3529cc218c9918f62a4d107e562d9bed1067a84c6aa2a724057a28172ecc386307a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD56b7ad8813cf635f627b400c3bb5f2a41
SHA1a473861c8c6821a02f96dc7320ad669a40405d3c
SHA2561595c5eb9b2df23faf01d4777ca8b59c69cdec10e1e21f71e976ab98b6da4caf
SHA512e75323c4bad571ea50e3f4decf9aefe2cdeaa96e3ed25de94bb659d8f1d6bebd1ec58e98b6b1039e98daf0258aa078ddd7caa560181ec61a4ff4f079a31a13f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5f028d372ecdce4e88812deb986ca6f7c
SHA1b990d877880d17deaa02aa11887ac6419f85c7d9
SHA2567a851d5d08288a791e50c649c6d882d3ecb447c1283dbcc27d636fbf8481eec3
SHA51228e8b80aa8cde3adb89e797ec034cea7e01c27adc3adaa5684bcef39f12da308c767fee9de24372ebde61718c37fa6ece44ba2d7a59074722d9e0600b7a2e590
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD5e955b8143156f1ab427d170b2cfe64b5
SHA1081a882f1e6f96c61b02915d3053d3380ae0bc62
SHA256c642552d04782fe287e149703ec3f2dc61fc2facc7c5de860309d68963851719
SHA512e7f04e88d79b76ccad52c3837f043c40771f54bcc0928d18254daccfd444d2c4ccec9e6cfb9f29bdade50aaf932cff50ab155a0c48bd36f72dffb44cf4720a52
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD58940c38df62c6ce4a4e96423c8595694
SHA1bfb0c587b4af203ac5d5767305b040719e048492
SHA2561c9eec913585170f3e01417d0e3a4207a5c70174a13323f579108d44899ad05c
SHA512836b89c8e7d7431a105789967497e45221a09bcbe2c557eca66b5989d0399770fd7b69e98dd487cad52498585d950d53e889b57710cd3ee3705f652a32838530
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD5ba4a62e7959718ef5f680eb015e8ddf3
SHA10414a01c366c8e47a66515e8ec770f4fbff04370
SHA2562cde89c97d3edcc3c2e49805789d9592eed2c245ada41f3cc93cd0f532bf6aca
SHA512d187fba0895aeea35d4f9e41f450c5b49adad8329c593db6228d21d77a023405da3799fafbbf7545f2eaefb0a613784cbc6c0ce03248201370327658e10afe30
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
872B
MD5483335b79a90ff10aa412e212a9c755e
SHA1c87bad5ba9aa13a0e1a12201b46a3b3197af5ec3
SHA256b68ee90833fa8578c6127e2f136d648d295062dd37e569ba22879742a0b34442
SHA512d412a1947b06734fd9944fa4344dec0882e7d2a825f68f1a3dada4e86bfc5da0414790552766671ee1837e1a63480a7f30441891171ad03e221398f252d9ed89
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD50cfb2ccf95850d5beec12349493d5aaf
SHA189cfa8b7571ad04c907b1ceb62ee50c931f2f23b
SHA2562810ee3992f0d9cb4825c07ebc43f4babb90481276849ae55a1d4ab83516a97e
SHA51276c1bc6327432a25b5bbe73efc8b9410adbb857b69976540626dcd2ec89acf3b7f87634208b0306c1bcaacacbf3049f55b96e3f384ef98ed48bee85a3aa0402c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD58e3883eb6747aeb8b5952b5c174b0e94
SHA19ab899b14ee68367a9b181e95c85cd5de061ada3
SHA256b41e40a323a7b6dcfd4114c70e80404e8730137b482fa4a2d757b9f748c44ba3
SHA512c5ea8ec2b2784096e937d3bdf4c282c938f261339f8114d6fe6f8dcc462b604f33946e49d928cb7218d56848e161d711cd678cdea727987844af0185b1324e22
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD53d17ca57a4861bd5528c73331f765adf
SHA1292fa610b40e5c01143ceccff80f817f5ac82d3d
SHA256383280cf6e4e7395c2463fa1e6498870559b3a142a2571fc9ea9b438e282eea4
SHA5120e8d8c9a05c88630b4e99293481d82092a1490a5228d2fa62327898d2de65485eac38e925b3e4ea714a7cedd2274a0250effc1562c2433fa7fa009dcfd2f0b12
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD565e6d671bcf0bb2bb349515174700ec3
SHA1014230c2d23e8ea808a3e3b9ab892c5b78066127
SHA25648e33d974ed44446018bd086c2eb4dee5dab32faf85daba91383a1e555062e94
SHA512d76a812fb4af8315b4d4760aa6445985f560251ca155cb6ed087a851eaf21c65fce17cffe24dccb09aa7f28b2376b29da77e5bce6ee69f947a8914ff8daeabb9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD59eeb5735ed2fd2e57e59c79dcad6fd1d
SHA16707ce0bce8f33ff2d7ebe75da86dbd2f81d40ca
SHA25683b4b99ea1a87407cb40baa97290953d8bf4f79604ec7e19a7b7579b1561a30b
SHA512db59156caa0d22249165201043f635733a0231e8e4555bef7f637cd19f9f8a5ac5d2afea956f9461262da8dce3aea303bf4f2da80b0055207e0913e6703c4765
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD513d8a758e86e4db947742a57cfd809e3
SHA1aee79feedf8267af5654e9613caf5b41ee48f914
SHA256e930ab26d6e0894197cc0716bffca24519edd9800f31561b47865d2fab0c0c3f
SHA512a2986a5b2300f4aa48bd90c261c24607b4df0c0bca3e24480f7e661a885346857e86af400d8cc37bb467486476143b2573e9fbcba3a1ab249c2930f1ce1404bc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5163313bb8fc3f0679005f0a0926da75f
SHA14dd986d1c6ed83a6b46f0fe29ec7bf27d7b86f80
SHA256e50837d52b861c95f7f0c38ea410bf0f330b6353d152f64d7306b4e28f1c8ef4
SHA512192a25d48d2bd98ec0df92eb90cdff1b244697f07e1726656186046c89b76b545a1a8cfddd51b5fb68193b7905574c9c73d962e2cb2d997a13bfb5c5d232beac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5e6dc2d66dde8685a2a66d8e190518080
SHA186579c93f38adcb5056182684aea5bf8d84d2134
SHA256e42f1b517ce0d497a5fd6603469f743d10897bfbf32a51da5f518db205faa68a
SHA5124ecc2277cb437121653ef8cb663b49a9f832e7f173e2cdaf4239ff24a7f30a0aa0169bdc13487dbace1c6a7e5473758e3c75795778831e262c38f2437f99407a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
72KB
MD5ae6d58ce63cbb06959e0e89bcd72cc64
SHA10c02f3dff42012ca26fdfe710e6d5199437be242
SHA256a7cb0b3a71a05f88a025b4dcce1e1eafbe24333fcbb72ac928f3c4a42e69368d
SHA5128c8b71c79e169229f55b2cddbfcd02b220fcf8d6ba756d4e994116e8c96ee2d6695dc34009b276a1947388b60c656157d12b423b6debfde079dd2aeecbd65586
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD577f990fd24694795408171efbb6dcdf8
SHA1538a641c1dcaba20fe4cea59d37c6de8610957a4
SHA2567e4a05b2f9efc2319961f216579684884c659a594005bb95b42063fc256b4cd5
SHA512d99cc2f40e78d11c8902fd441df8d9b525d8f9d491e0f94c5b691382ef06243f975f12af808fa1b6850deb9d989eea2cfed81222ab0160278cdeaecc58e5a39f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD5d530242ee86c654d6a2bb192569848d5
SHA1372fec343235d86e3e0c6b379a52299e4331fc1d
SHA2569f6ed8ddf8c2ed99538a6254fafead2678f4ea60bbf24612ad2db46d12eae2d6
SHA5127803e8a1f6306971f610e7d4b07e081a4f236b011783efd0f7b5e38f82bb20ad2027f2ba65f380bfa6684783a12b7cd36caf31d2844bbd3783de56277bc9eae4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD53c503878ed86dcbf8ebf9f63a3596343
SHA1f26076be3109aecad0d0766a5561b911049d94c2
SHA256e776ab2bf30cd60f4c81e10b9364fabf010add8146ca2802bac08fdfe09f8b42
SHA512af6606320081b72a92f10db6578e185ba20e6dd83b0c159158209688ba14a58a14ee9b6433b675999dc9a51a90203df76c757692e6cb4ff48c41d18c2e3dac40
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD56b2c6b98090153782dbc81eb8ecf5907
SHA1a3a42f67fd770741ab25ea608d132dfb954d6f42
SHA256e4d42bb7d70f854935686744b3e42b16066264afa8e0472371ea1630de42549f
SHA51290b2d8ba2be06b897fbc94c4837b22a2a03aacf8645f532f12925809ce3ee04e1ed3213c17109c100a3ece5c98c9af7f5580e815d1bb9217602f0d89ed01a486
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD53c4868d50bd3e799ec24948f51470e59
SHA1ca5ab620de71ceb4dc3f5db06ba1a2e11445e959
SHA2564e70a71e03a858cbd44f022d7c373ce29482de8cccd401fbe4e73c501b5a5413
SHA512da4764f142e9ba20a8a781f955436f2b8a5d5b8f95bb8b8492c3b7361d1f847f55618eee3bd64868f80c67b235f49ccc49269e7964531c008e4c28531a3f9a90
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
175KB
MD5f2a169a6b3c65ed8a4fe80f1498b3ebb
SHA193c35c8801ea90c3309509c30a43b51a872884e9
SHA2568065c9752cd74010303863c1fb351e61dc88183773f38ceb8bb89c786b8e2df2
SHA51275edaade2b11fd4946ed974ad76cb1a2b723dd0d6f0a3b6d2537d1c9cbb58bf47fc98926e748805c747b0d9db0e371324f629eada2cd3845d1ddd8ddc39e0c07
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
117KB
MD529dce5ed9071d109209626d4fc8838f1
SHA1a980aa5b11aa1ec595b64689dfb3fa820a6a0091
SHA256dbf637d0158e49463930be23ee6fa036de2ba9386a354d5dad06cca2854d03fb
SHA512faa2efa53e67af3cf2016c866adb6fd53e9f8cd45e93745bc1a86ea46ef8b4f0913a78effa6be7c37cb6ecf383c1de819cd6a1b6d614d0d710a3658c03ffccd1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e251.TMPFilesize
113KB
MD5ec13732371ad3b4c239124805eb08d03
SHA11cc5310e2db9bba028aba52100c9dfc7f1b4a182
SHA256c594447009c04ca3ebe1842e39c9aa88db92a4cd33f16e26d1c386dd137a6ff1
SHA5129239ce46346e8887cebd7b0919845949656a78f0909f2516b2f3403b2d4841cc9af938226d00270cc838abab2f82c4c5186dae77d43bca83dd8f4576f1eb080c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exeFilesize
6.3MB
MD57174885a28d74433457f718b592fe141
SHA1910fd3e659f1151743e4dc6a435119c3a6386d41
SHA256883ec8f4371547d297895632d59ccd2e50ad1826f6cc47d09873390a53393344
SHA5125ab64a7a76c1e000a36f8d91ded361c60b6cd0942bc6e76b231e003e19404e84a2ec1f3720cfe8eaba493f7be2b727d33335dddf22414d34f6cdc86abebff6aa
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exeFilesize
6.3MB
MD57174885a28d74433457f718b592fe141
SHA1910fd3e659f1151743e4dc6a435119c3a6386d41
SHA256883ec8f4371547d297895632d59ccd2e50ad1826f6cc47d09873390a53393344
SHA5125ab64a7a76c1e000a36f8d91ded361c60b6cd0942bc6e76b231e003e19404e84a2ec1f3720cfe8eaba493f7be2b727d33335dddf22414d34f6cdc86abebff6aa
-
C:\Users\Admin\AppData\Local\Temp\Rar$EXb1088.5386\Havij-Pro-v1.17-PentestCore\Havij 1.17 Pro.exeFilesize
6.3MB
MD57174885a28d74433457f718b592fe141
SHA1910fd3e659f1151743e4dc6a435119c3a6386d41
SHA256883ec8f4371547d297895632d59ccd2e50ad1826f6cc47d09873390a53393344
SHA5125ab64a7a76c1e000a36f8d91ded361c60b6cd0942bc6e76b231e003e19404e84a2ec1f3720cfe8eaba493f7be2b727d33335dddf22414d34f6cdc86abebff6aa
-
C:\Users\Admin\AppData\Local\Temp\is-UJ7MS.tmp\Havij 1.17 Pro.tmpFilesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
-
C:\Users\Admin\AppData\Local\Temp\is-UJ7MS.tmp\Havij 1.17 Pro.tmpFilesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
-
C:\Users\Admin\Downloads\H-Pro-v1.17-PentestCore.rarFilesize
6.3MB
MD540d2b3f6ec770b960df9dc68f8befab1
SHA18ae3c2a9b06a9e2871cfa08af32240a8bfc38b9c
SHA2568d5729259089fb3d5b14f86c6ab3db93db27b05e58a9e1f4d8d106c272b5a424
SHA512291d40afdaa8e5d3eb92de096c66426de922ee588cd5ce610b9834d5a69f17bbb60d2b9be34bd933751c0e02ea399662afdea263a6ebaa72decac02167c22e4f
-
C:\Users\Admin\Downloads\H-Pro-v1.17-PentestCore.rarFilesize
6.3MB
MD540d2b3f6ec770b960df9dc68f8befab1
SHA18ae3c2a9b06a9e2871cfa08af32240a8bfc38b9c
SHA2568d5729259089fb3d5b14f86c6ab3db93db27b05e58a9e1f4d8d106c272b5a424
SHA512291d40afdaa8e5d3eb92de096c66426de922ee588cd5ce610b9834d5a69f17bbb60d2b9be34bd933751c0e02ea399662afdea263a6ebaa72decac02167c22e4f
-
C:\Users\Admin\Downloads\winrar-x64-621.exeFilesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
C:\Users\Admin\Downloads\winrar-x64-621.exeFilesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
C:\Users\Admin\Downloads\winrar-x64-621.exeFilesize
3.4MB
MD5766ac70b840c029689d3c065712cf46e
SHA1e54f4628076d81b36de97b01c098a2e7ba123663
SHA25606d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
SHA51249064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
-
C:\Windows\SysWOW64\MSInet.ocxFilesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
C:\Windows\SysWOW64\MSInet.ocxFilesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
C:\Windows\SysWOW64\Mscomctl.ocxFilesize
1.0MB
MD5ecc7d7f0d3446de36045d1d9e964fafe
SHA1da6b0ec081d628c33b150327f3bd16d3b7fa4729
SHA256bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
SHA512443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
-
C:\Windows\SysWOW64\Mscomctl.ocxFilesize
1.0MB
MD5ecc7d7f0d3446de36045d1d9e964fafe
SHA1da6b0ec081d628c33b150327f3bd16d3b7fa4729
SHA256bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
SHA512443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
-
C:\Windows\SysWOW64\Mswinsck.ocxFilesize
121KB
MD5e8a2190a9e8ee5e5d2e0b599bbf9dda6
SHA14e97bf9519c83835da9db309e61ec87ddf165167
SHA25680ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311
SHA51257f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee
-
C:\Windows\SysWOW64\Mswinsck.ocxFilesize
121KB
MD5e8a2190a9e8ee5e5d2e0b599bbf9dda6
SHA14e97bf9519c83835da9db309e61ec87ddf165167
SHA25680ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311
SHA51257f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee
-
C:\Windows\SysWOW64\RICHTX32.ocxFilesize
254KB
MD521034a336e16f30345a96de9bd8cec25
SHA1c9fb876a001874c4ee8670fabf12c36036f54a1f
SHA256251a419bb5998882227a11188311b82f20c4952865ff916397973bd9a50c69d5
SHA512ed1f33cd13f6cda5aa4696271927ff2497a2bd33fee606655ed50bb5f13cedb81a3597844c1a8030e6ffa3c46ed34c217a55dab062ba00a76f2f079b7da2e86f
-
C:\Windows\SysWOW64\RICHTX32.ocxFilesize
254KB
MD521034a336e16f30345a96de9bd8cec25
SHA1c9fb876a001874c4ee8670fabf12c36036f54a1f
SHA256251a419bb5998882227a11188311b82f20c4952865ff916397973bd9a50c69d5
SHA512ed1f33cd13f6cda5aa4696271927ff2497a2bd33fee606655ed50bb5f13cedb81a3597844c1a8030e6ffa3c46ed34c217a55dab062ba00a76f2f079b7da2e86f
-
C:\Windows\SysWOW64\comdlg32.ocxFilesize
137KB
MD5d76f0eab36f83a31d411aeaf70da7396
SHA19bc145b54500fb6fbea9be61fbdd90f65fd1bc14
SHA25646f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
SHA5129c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
-
C:\Windows\SysWOW64\comdlg32.ocxFilesize
137KB
MD5d76f0eab36f83a31d411aeaf70da7396
SHA19bc145b54500fb6fbea9be61fbdd90f65fd1bc14
SHA25646f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
SHA5129c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
-
C:\Windows\SysWOW64\comdlg32.ocxFilesize
137KB
MD5d76f0eab36f83a31d411aeaf70da7396
SHA19bc145b54500fb6fbea9be61fbdd90f65fd1bc14
SHA25646f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
SHA5129c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
-
C:\Windows\SysWOW64\tabctl32.ocxFilesize
204KB
MD5908938d3ba2d870ee9fc6238a4c6af95
SHA1e8648d6d69fd5cf900c4bf98b210f6921bed3ef5
SHA25640cadbfb2eb5732f025d687664f34239db7153a192bca0287f9208852b201fb6
SHA512f9433f48330f7ddc64edb8a64229c1490fa31978e9f4ffdc5fa5ff8b18430317a39a07a559d560051ba195b730429acfb18edb38bf712507b00ac788ffca0b74
-
C:\Windows\SysWOW64\tabctl32.ocxFilesize
204KB
MD5908938d3ba2d870ee9fc6238a4c6af95
SHA1e8648d6d69fd5cf900c4bf98b210f6921bed3ef5
SHA25640cadbfb2eb5732f025d687664f34239db7153a192bca0287f9208852b201fb6
SHA512f9433f48330f7ddc64edb8a64229c1490fa31978e9f4ffdc5fa5ff8b18430317a39a07a559d560051ba195b730429acfb18edb38bf712507b00ac788ffca0b74
-
\??\pipe\crashpad_4768_ELBHXNKDTERQHTHEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1088-655-0x0000028CFD040000-0x0000028CFD797000-memory.dmpFilesize
7.3MB
-
memory/1088-647-0x0000028CFD040000-0x0000028CFD797000-memory.dmpFilesize
7.3MB
-
memory/2888-772-0x0000000000780000-0x00000000007C0000-memory.dmpFilesize
256KB
-
memory/2888-782-0x0000000000780000-0x00000000007C0000-memory.dmpFilesize
256KB
-
memory/2888-767-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-769-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-786-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-784-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-770-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/2888-781-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-773-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-775-0x0000000000400000-0x0000000000622000-memory.dmpFilesize
2.1MB
-
memory/2888-776-0x0000000000780000-0x00000000007C0000-memory.dmpFilesize
256KB
-
memory/3840-696-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3840-683-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3840-771-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4276-697-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/4276-768-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/4276-694-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB