Analysis
-
max time kernel
67s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-04-2024 23:57
General
-
Target
f6e95952e81342fa9cc372254d14ca93a7adda8ecf77cbf2ca4d8226dd36a92c.exe
-
Size
241KB
-
MD5
a7a5dae3aa5eae5ad11274237e907009
-
SHA1
da2bee687f4d91f11ae65ea618a54bace452c9d1
-
SHA256
f6e95952e81342fa9cc372254d14ca93a7adda8ecf77cbf2ca4d8226dd36a92c
-
SHA512
b888c8868a72388f97287b3fe88060f7aed809cdd67d98dd10117b6ef3e1d436b11d871049644f3189d04abba6692f4a453d646b8a45548b08220e85c8454c5b
-
SSDEEP
3072:xmLy2/2aSLQscL19RJsqU8KiK1pyo5OzvZFgv3Ob:cLy2/7FsU1tsqU85KMTZFgv3U
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Extracted
redline
LogsDiller Cloud (Telegram: @logsdillabot)
5.42.65.50:33080
Extracted
lumma
https://greetclassifytalk.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 6 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 10 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6e95952e81342fa9cc372254d14ca93a7adda8ecf77cbf2ca4d8226dd36a92c.exe"C:\Users\Admin\AppData\Local\Temp\f6e95952e81342fa9cc372254d14ca93a7adda8ecf77cbf2ca4d8226dd36a92c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5781.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Users\Admin\AppData\Local\Temp\6E18.exeC:\Users\Admin\AppData\Local\Temp\6E18.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\AA08.exeC:\Users\Admin\AppData\Local\Temp\AA08.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACB9.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=808 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD506ec1c79fa33c2e3407276c32a2c68b5
SHA150fd30c59ea0e5cfe43a73936d65072250dbbf9d
SHA25615fadf5d50696e4bd8e24a6c27111641ad3f8c2becc03aaf8705b1f5352f1d9c
SHA51272b1713463c1e469bec1bf54f55fe448e5ed8beaca8a623627bc9aa0dbc001046242eb6c0350fcace70334371d5f496d14d558a045db75474cbe78c0b7f04bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD5cfaeadd47ca2a47fc6d6b9238028953b
SHA18ad801ec06a0e503c73d7fb5d78c62dce969e77f
SHA2564b427b1a96cc67f511ee3217a31b52b4a6fced3df90372b3507f4afbea4b3dc9
SHA512255d9de5a6efc966ecb00f06c29e433e64ec10044446686298c0d106a19d3a9aa5a562bd0879ae7d349690ba33e08b5973a545e1e0e6541eff832a727b08b800
-
C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datFilesize
1022B
MD57b5058e4550fa36515c5abb454ba8a4b
SHA1fb6f6d9acbe9dd98af89d4f52d305fc3b951201b
SHA256031e1533a094b24157d505d6907a1ede907247faa8d7d4b8570d111fb3c1417f
SHA5121fc9e878a24d4f73ca058daeb7962ff211017104752846336aadcc960df36b3d0fa169485205db41a13175153f844dfdff9c27106461c431b0ea9a70e5384c51
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xmlFilesize
96B
MD584209e171da10686915fe7efcd51552d
SHA16bf96e86a533a68eba4d703833de374e18ce6113
SHA25604d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b
SHA51248d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd
-
C:\Users\Admin\AppData\Local\Temp\5781.batFilesize
77B
MD555cc761bf3429324e5a0095cab002113
SHA12cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA51233f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
-
C:\Users\Admin\AppData\Local\Temp\6E18.exeFilesize
417KB
MD594b423329b05b002507c36396870bb25
SHA1ccb05b11e819fb7ab599cae8ab9c2e798f715ae6
SHA25630adb88349f673c5cd8fb6c9800155febd2e5707a31a5d55f38861f593a295c5
SHA512b559a8283f41ca79f66388fe529324ddfefcaf160a3a5e9f999f6211443a0c39bd69a9687da786721b66bf2d53fc49d3445c9f06a9012c6eaf4251faff2eccc2
-
C:\Users\Admin\AppData\Local\Temp\AA08.exeFilesize
5.5MB
MD53d03e50e7acc908a73cac1928347d0c7
SHA18c059a014a22d80ebbccdd2e3a3bc1e8933fd696
SHA256fd6158af16fde7ad1e8152d53991bedf566b38f54266f0f03c5c73560e486568
SHA5124bf7585d6feddffa6bf865335a9995f354afad3cd331172de194e0a9ac4431651ecc6a2b0aaeb3cb2d29bb95698d1de04fd0bed74ceff1c043151b1f4af8b266
-
C:\Users\Admin\AppData\Local\Temp\Tmp95C3.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfc4nayw.ain.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\filename.exeFilesize
8.0MB
MD56f68dcfef80d64b4825f86d98710b2fd
SHA19c7c018b1be13f610004c51051f8fdb2356a314d
SHA256bf74bbf890ebb102900848ac40b06d10dfdb8684651c77830db27562804eb991
SHA51266b88acfe82b38c803947ffed99e42607be3f17fe9db150d89124f0f724881a6579c79a49851c7ace00f9894d899e7338353b0f0c315c1a3c2240a25840bff40
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5878575dc406e9dd7e45781400a91346a
SHA14753f800949ab64164b2797546077fb35a880f6b
SHA256978923286e1fb3ed536ba358f80d8bc1238f8e8610a734b7d408646f008e21e8
SHA512aca6a2e5eb446e930d4eb433dc337827ac52fa6483699e7edd5088237ca4569f3f78857779b53bdca4e65c93b6873d9f043d72777ee5b467d35d0488ff1ba3b2
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5dba4c9da0667b893c996fe4158a6283c
SHA14a39bc4dab3997076369f623d2a7506ced7b88ce
SHA256e6cc8c1bfa559ffdcb62d40a704206c2d3fa404f2dd94357a14a623b00d04d07
SHA5125496d4a33c35482e80eab0c22336fe67f51b5f65a37c63305833a741cb8365b6d0dcff3ededcfaeab2f85dd7a8e86b8186b37124fcdf594fb752990729c7e405
-
C:\Windows\system32\drivers\etc\hostsFilesize
3KB
MD52d29fd3ae57f422e2b2121141dc82253
SHA1c2464c857779c0ab4f5e766f5028fcc651a6c6b7
SHA25680a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4
SHA512077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68
-
memory/1040-64-0x0000000000980000-0x000000000126E000-memory.dmpFilesize
8.9MB
-
memory/1040-71-0x0000000000980000-0x000000000126E000-memory.dmpFilesize
8.9MB
-
memory/1040-67-0x0000000000980000-0x000000000126E000-memory.dmpFilesize
8.9MB
-
memory/1040-65-0x0000000001370000-0x0000000001371000-memory.dmpFilesize
4KB
-
memory/1044-227-0x00007FFC8E480000-0x00007FFC8EF41000-memory.dmpFilesize
10.8MB
-
memory/1044-228-0x000001607CAB0000-0x000001607CAC0000-memory.dmpFilesize
64KB
-
memory/1044-232-0x00007FFC8E480000-0x00007FFC8EF41000-memory.dmpFilesize
10.8MB
-
memory/1044-223-0x000001607C5D0000-0x000001607C5F2000-memory.dmpFilesize
136KB
-
memory/1044-229-0x000001607CAB0000-0x000001607CAC0000-memory.dmpFilesize
64KB
-
memory/2028-23-0x00000000004B0000-0x000000000051C000-memory.dmpFilesize
432KB
-
memory/2028-21-0x00000000004B0000-0x000000000051C000-memory.dmpFilesize
432KB
-
memory/2036-290-0x000001F06A0A0000-0x000001F06A0C0000-memory.dmpFilesize
128KB
-
memory/2036-297-0x000001F06A060000-0x000001F06A080000-memory.dmpFilesize
128KB
-
memory/2036-300-0x000001F06A720000-0x000001F06A740000-memory.dmpFilesize
128KB
-
memory/2112-3-0x0000000000400000-0x0000000002C1F000-memory.dmpFilesize
40.1MB
-
memory/2112-2-0x0000000002DB0000-0x0000000002DBB000-memory.dmpFilesize
44KB
-
memory/2112-5-0x0000000000400000-0x0000000002C1F000-memory.dmpFilesize
40.1MB
-
memory/2112-8-0x0000000002DB0000-0x0000000002DBB000-memory.dmpFilesize
44KB
-
memory/2112-1-0x0000000002CA0000-0x0000000002DA0000-memory.dmpFilesize
1024KB
-
memory/2236-211-0x000002DA41050000-0x000002DA41070000-memory.dmpFilesize
128KB
-
memory/2236-206-0x000002DA40C80000-0x000002DA40CA0000-memory.dmpFilesize
128KB
-
memory/2236-209-0x000002DA40C40000-0x000002DA40C60000-memory.dmpFilesize
128KB
-
memory/2368-323-0x0000000000CC0000-0x0000000000CE0000-memory.dmpFilesize
128KB
-
memory/2368-327-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-324-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-308-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-321-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-310-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-313-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-319-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-326-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-325-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-317-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2368-322-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2680-92-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2716-189-0x00000273C2B20000-0x00000273C2B40000-memory.dmpFilesize
128KB
-
memory/2716-186-0x00000273C2720000-0x00000273C2740000-memory.dmpFilesize
128KB
-
memory/2716-184-0x00000273C2760000-0x00000273C2780000-memory.dmpFilesize
128KB
-
memory/2880-147-0x000001CD4C250000-0x000001CD4C270000-memory.dmpFilesize
128KB
-
memory/2880-145-0x000001CD4BE40000-0x000001CD4BE60000-memory.dmpFilesize
128KB
-
memory/2880-143-0x000001CD4BE80000-0x000001CD4BEA0000-memory.dmpFilesize
128KB
-
memory/2996-136-0x0000000003F70000-0x0000000003F71000-memory.dmpFilesize
4KB
-
memory/3116-283-0x0000000004100000-0x0000000004101000-memory.dmpFilesize
4KB
-
memory/3380-4-0x0000000003070000-0x0000000003086000-memory.dmpFilesize
88KB
-
memory/3380-80-0x0000000003040000-0x0000000003041000-memory.dmpFilesize
4KB
-
memory/4028-104-0x000001A337680000-0x000001A3376A0000-memory.dmpFilesize
128KB
-
memory/4028-102-0x000001A337060000-0x000001A337080000-memory.dmpFilesize
128KB
-
memory/4028-98-0x000001A3370A0000-0x000001A3370C0000-memory.dmpFilesize
128KB
-
memory/4212-126-0x0000020759240000-0x0000020759260000-memory.dmpFilesize
128KB
-
memory/4212-124-0x0000020758E30000-0x0000020758E50000-memory.dmpFilesize
128KB
-
memory/4212-121-0x0000020758E70000-0x0000020758E90000-memory.dmpFilesize
128KB
-
memory/4288-307-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4288-294-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4288-296-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4288-299-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4288-302-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4288-304-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4416-175-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/4488-27-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/4488-133-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/4488-72-0x0000000074FD0000-0x0000000075780000-memory.dmpFilesize
7.7MB
-
memory/4488-70-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/4488-69-0x0000000006BD0000-0x0000000006C36000-memory.dmpFilesize
408KB
-
memory/4488-55-0x0000000006A70000-0x0000000006ABC000-memory.dmpFilesize
304KB
-
memory/4488-54-0x0000000006900000-0x000000000693C000-memory.dmpFilesize
240KB
-
memory/4488-53-0x00000000068A0000-0x00000000068B2000-memory.dmpFilesize
72KB
-
memory/4488-73-0x0000000007530000-0x0000000007580000-memory.dmpFilesize
320KB
-
memory/4488-22-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4488-174-0x0000000074FD0000-0x0000000075780000-memory.dmpFilesize
7.7MB
-
memory/4488-25-0x00000000057D0000-0x0000000005D74000-memory.dmpFilesize
5.6MB
-
memory/4488-24-0x0000000074FD0000-0x0000000075780000-memory.dmpFilesize
7.7MB
-
memory/4488-198-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/4488-50-0x0000000006960000-0x0000000006A6A000-memory.dmpFilesize
1.0MB
-
memory/4488-82-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/4488-49-0x0000000006E10000-0x0000000007428000-memory.dmpFilesize
6.1MB
-
memory/4488-46-0x00000000067D0000-0x00000000067EE000-memory.dmpFilesize
120KB
-
memory/4488-45-0x0000000006000000-0x0000000006076000-memory.dmpFilesize
472KB
-
memory/4488-28-0x0000000005580000-0x000000000558A000-memory.dmpFilesize
40KB
-
memory/4488-76-0x00000000087D0000-0x0000000008992000-memory.dmpFilesize
1.8MB
-
memory/4488-77-0x0000000008ED0000-0x00000000093FC000-memory.dmpFilesize
5.2MB
-
memory/4488-26-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/4632-320-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmpFilesize
2.0MB
-
memory/4632-318-0x00007FF73FAD0000-0x00007FF740836000-memory.dmpFilesize
13.4MB
-
memory/4632-244-0x00007FF73FAD0000-0x00007FF740836000-memory.dmpFilesize
13.4MB
-
memory/4632-243-0x00007FF73FAD0000-0x00007FF740836000-memory.dmpFilesize
13.4MB
-
memory/4632-241-0x00007FF73FAD0000-0x00007FF740836000-memory.dmpFilesize
13.4MB
-
memory/4632-240-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmpFilesize
2.0MB
-
memory/4632-239-0x00007FF73FAD0000-0x00007FF740836000-memory.dmpFilesize
13.4MB
-
memory/4900-114-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/4948-271-0x0000022DFF960000-0x0000022DFF97C000-memory.dmpFilesize
112KB
-
memory/4948-281-0x00007FFC91500000-0x00007FFC91FC1000-memory.dmpFilesize
10.8MB
-
memory/4948-277-0x0000022DE5B90000-0x0000022DE5BA0000-memory.dmpFilesize
64KB
-
memory/4948-276-0x0000022DFF990000-0x0000022DFF99A000-memory.dmpFilesize
40KB
-
memory/4948-275-0x0000022DFF980000-0x0000022DFF986000-memory.dmpFilesize
24KB
-
memory/4948-274-0x0000022DFF950000-0x0000022DFF958000-memory.dmpFilesize
32KB
-
memory/4948-273-0x0000022DFF9A0000-0x0000022DFF9BA000-memory.dmpFilesize
104KB
-
memory/4948-272-0x0000022DFF940000-0x0000022DFF94A000-memory.dmpFilesize
40KB
-
memory/4948-270-0x0000022DFF510000-0x0000022DFF51A000-memory.dmpFilesize
40KB
-
memory/4948-269-0x0000022DFF740000-0x0000022DFF7F5000-memory.dmpFilesize
724KB
-
memory/4948-267-0x0000022DFF720000-0x0000022DFF73C000-memory.dmpFilesize
112KB
-
memory/4948-268-0x00007FF4DCF20000-0x00007FF4DCF30000-memory.dmpFilesize
64KB
-
memory/4948-257-0x0000022DE5B90000-0x0000022DE5BA0000-memory.dmpFilesize
64KB
-
memory/4948-247-0x0000022DE5B90000-0x0000022DE5BA0000-memory.dmpFilesize
64KB
-
memory/4948-246-0x0000022DE5B90000-0x0000022DE5BA0000-memory.dmpFilesize
64KB
-
memory/4948-245-0x00007FFC91500000-0x00007FFC91FC1000-memory.dmpFilesize
10.8MB
-
memory/5084-236-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmpFilesize
2.0MB
-
memory/5084-235-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB
-
memory/5084-196-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB
-
memory/5084-179-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB
-
memory/5084-176-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB
-
memory/5084-171-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB
-
memory/5084-172-0x00007FFCACDB0000-0x00007FFCACFA5000-memory.dmpFilesize
2.0MB
-
memory/5084-170-0x00007FF689CE0000-0x00007FF68AA46000-memory.dmpFilesize
13.4MB