Analysis
-
max time kernel
83s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 17:54
Static task
static1
General
-
Target
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe
-
Size
1.8MB
-
MD5
733fce8af4aa232cb80b7d61fa272764
-
SHA1
1bcc5b6309f5ff21b3e7d69a26d65ab318d2e760
-
SHA256
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5
-
SHA512
8d4384aa54bce3ab173fc9b2f8146e08499c2be3520b41a5a24cdc4fbc15f37ffae6287bc4e32337a5a617942c3d70f46e70d4400718c2097e3ec8ff0db728be
-
SSDEEP
49152:4MtlcinxPGTqYeF1mj5OkN8Si74S82w0WR34Hm6VeWN:4MM38NUYw0aVA
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Detect ZGRat V1 17 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe family_zgrat_v1 behavioral1/memory/3540-84-0x0000000000350000-0x000000000050C000-memory.dmp family_zgrat_v1 behavioral1/memory/688-496-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-489-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-509-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-511-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-513-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-515-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-529-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-539-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-546-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-548-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-553-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-557-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-559-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-562-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 behavioral1/memory/688-567-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 9 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral1/memory/4252-118-0x0000000000F00000-0x0000000000F52000-memory.dmp family_redline behavioral1/memory/4156-125-0x0000000000590000-0x000000000061C000-memory.dmp family_redline behavioral1/memory/2056-180-0x0000000000CD0000-0x0000000000D4D000-memory.dmp family_redline behavioral1/memory/3164-181-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/2056-183-0x0000000000CD0000-0x0000000000D4D000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline behavioral1/memory/3656-245-0x0000000000220000-0x0000000000272000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exechrosha.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 94 5012 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3824 netsh.exe 5824 netsh.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
chrosha.exeRegAsm.exeNewB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation chrosha.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation NewB.exe -
Executes dropped EXE 13 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exepropro.exeTraffic.exegold.exeNewB.exejok.exe070.exeswiiii.exeis-GQBP4.tmpcddvdrunner2333.execddvdrunner2333.exepid process 412 chrosha.exe 628 swiiiii.exe 3540 alexxxxxxxx.exe 4252 propro.exe 4156 Traffic.exe 2056 gold.exe 4672 NewB.exe 3656 jok.exe 3760 070.exe 3316 swiiii.exe 3292 is-GQBP4.tmp 4748 cddvdrunner2333.exe 4104 cddvdrunner2333.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exechrosha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Wine 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe Key opened \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Wine chrosha.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exeis-GQBP4.tmppid process 1584 rundll32.exe 5012 rundll32.exe 3292 is-GQBP4.tmp -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 156 api.myip.com 157 api.myip.com 158 ipinfo.io 159 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exechrosha.exepid process 3124 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe 412 chrosha.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
swiiiii.exealexxxxxxxx.exegold.exeswiiii.exedescription pid process target process PID 628 set thread context of 3156 628 swiiiii.exe RegAsm.exe PID 3540 set thread context of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 2056 set thread context of 3164 2056 gold.exe RegAsm.exe PID 3316 set thread context of 4332 3316 swiiii.exe RegAsm.exe -
Drops file in Windows directory 1 IoCs
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exedescription ioc process File created C:\Windows\Tasks\chrosha.job 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4064 628 WerFault.exe swiiiii.exe 4880 4076 WerFault.exe u2ag.0.exe 5456 2968 WerFault.exe oJHAhuRwe9TkV02DeZ3TxiJx.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3740 schtasks.exe 3224 schtasks.exe -
Processes:
propro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 propro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 propro.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exechrosha.exerundll32.exepowershell.exeTraffic.exepid process 3124 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe 3124 72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe 412 chrosha.exe 412 chrosha.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 5012 rundll32.exe 2768 powershell.exe 2768 powershell.exe 2768 powershell.exe 4156 Traffic.exe 4156 Traffic.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Traffic.exepowershell.exedescription pid process Token: SeDebugPrivilege 4156 Traffic.exe Token: SeBackupPrivilege 4156 Traffic.exe Token: SeSecurityPrivilege 4156 Traffic.exe Token: SeSecurityPrivilege 4156 Traffic.exe Token: SeSecurityPrivilege 4156 Traffic.exe Token: SeSecurityPrivilege 4156 Traffic.exe Token: SeDebugPrivilege 2768 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exerundll32.exerundll32.exegold.exeNewB.exedescription pid process target process PID 412 wrote to memory of 628 412 chrosha.exe swiiiii.exe PID 412 wrote to memory of 628 412 chrosha.exe swiiiii.exe PID 412 wrote to memory of 628 412 chrosha.exe swiiiii.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 628 wrote to memory of 3156 628 swiiiii.exe RegAsm.exe PID 412 wrote to memory of 3540 412 chrosha.exe alexxxxxxxx.exe PID 412 wrote to memory of 3540 412 chrosha.exe alexxxxxxxx.exe PID 412 wrote to memory of 3540 412 chrosha.exe alexxxxxxxx.exe PID 3540 wrote to memory of 2644 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 2644 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 2644 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 3540 wrote to memory of 396 3540 alexxxxxxxx.exe RegAsm.exe PID 396 wrote to memory of 4252 396 RegAsm.exe propro.exe PID 396 wrote to memory of 4252 396 RegAsm.exe propro.exe PID 396 wrote to memory of 4252 396 RegAsm.exe propro.exe PID 396 wrote to memory of 4156 396 RegAsm.exe Traffic.exe PID 396 wrote to memory of 4156 396 RegAsm.exe Traffic.exe PID 412 wrote to memory of 2056 412 chrosha.exe gold.exe PID 412 wrote to memory of 2056 412 chrosha.exe gold.exe PID 412 wrote to memory of 2056 412 chrosha.exe gold.exe PID 412 wrote to memory of 1584 412 chrosha.exe rundll32.exe PID 412 wrote to memory of 1584 412 chrosha.exe rundll32.exe PID 412 wrote to memory of 1584 412 chrosha.exe rundll32.exe PID 1584 wrote to memory of 5012 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 5012 1584 rundll32.exe rundll32.exe PID 5012 wrote to memory of 1096 5012 rundll32.exe netsh.exe PID 5012 wrote to memory of 1096 5012 rundll32.exe netsh.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 2056 wrote to memory of 3164 2056 gold.exe RegAsm.exe PID 412 wrote to memory of 4672 412 chrosha.exe NewB.exe PID 412 wrote to memory of 4672 412 chrosha.exe NewB.exe PID 412 wrote to memory of 4672 412 chrosha.exe NewB.exe PID 4672 wrote to memory of 3740 4672 NewB.exe schtasks.exe PID 4672 wrote to memory of 3740 4672 NewB.exe schtasks.exe PID 4672 wrote to memory of 3740 4672 NewB.exe schtasks.exe PID 5012 wrote to memory of 2768 5012 rundll32.exe powershell.exe PID 5012 wrote to memory of 2768 5012 rundll32.exe powershell.exe PID 412 wrote to memory of 3656 412 chrosha.exe jok.exe PID 412 wrote to memory of 3656 412 chrosha.exe jok.exe PID 412 wrote to memory of 3656 412 chrosha.exe jok.exe PID 412 wrote to memory of 3316 412 chrosha.exe swiiii.exe PID 412 wrote to memory of 3316 412 chrosha.exe swiiii.exe PID 412 wrote to memory of 3316 412 chrosha.exe swiiii.exe PID 4672 wrote to memory of 3760 4672 NewB.exe 070.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe"C:\Users\Admin\AppData\Local\Temp\72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 8763⤵
- Program crash
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4252 -
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵PID:4840
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3164
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵PID:1096
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\597858682981_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe"C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe"3⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\is-NNU2R.tmp\is-GQBP4.tmp"C:\Users\Admin\AppData\Local\Temp\is-NNU2R.tmp\is-GQBP4.tmp" /SL4 $601FE "C:\Users\Admin\AppData\Local\Temp\1000200001\070.exe" 3710753 522244⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3292 -
C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe"C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -i5⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe"C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exe" -s5⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1000201001\3zH6P6Qx.exe"C:\Users\Admin\AppData\Local\Temp\1000201001\3zH6P6Qx.exe"3⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3316 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exe"2⤵PID:688
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵PID:3308
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:2788
-
C:\Users\Admin\Pictures\oJHAhuRwe9TkV02DeZ3TxiJx.exe"C:\Users\Admin\Pictures\oJHAhuRwe9TkV02DeZ3TxiJx.exe"4⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"5⤵PID:4076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 12246⤵
- Program crash
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\u2ag.3.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.3.exe"5⤵PID:5396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 11005⤵
- Program crash
PID:5456 -
C:\Users\Admin\Pictures\Bp8KYmg2zZlvGknbVPbcdAhZ.exe"C:\Users\Admin\Pictures\Bp8KYmg2zZlvGknbVPbcdAhZ.exe"4⤵PID:3016
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:3320
-
C:\Users\Admin\Pictures\Bp8KYmg2zZlvGknbVPbcdAhZ.exe"C:\Users\Admin\Pictures\Bp8KYmg2zZlvGknbVPbcdAhZ.exe"5⤵PID:1616
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:2096
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:5728
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
PID:5824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:4616
-
C:\Users\Admin\Pictures\hDqycOF9Qr6od4Us3K3Z8eFh.exe"C:\Users\Admin\Pictures\hDqycOF9Qr6od4Us3K3Z8eFh.exe"4⤵PID:4020
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵PID:2148
-
C:\Users\Admin\Pictures\hDqycOF9Qr6od4Us3K3Z8eFh.exe"C:\Users\Admin\Pictures\hDqycOF9Qr6od4Us3K3Z8eFh.exe"5⤵PID:1196
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:1044
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:5632
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
PID:3824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵PID:6056
-
C:\Users\Admin\Pictures\nA6OhePY1qFpY8BOfo7AkDra.exe"C:\Users\Admin\Pictures\nA6OhePY1qFpY8BOfo7AkDra.exe"4⤵PID:3776
-
C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe"C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe" --silent --allusers=04⤵PID:3984
-
C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exeC:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6b07e1d0,0x6b07e1dc,0x6b07e1e85⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\JdHWaLdxNk3R6kEXcAZlHWGs.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\JdHWaLdxNk3R6kEXcAZlHWGs.exe" --version5⤵PID:1184
-
C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe"C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3984 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240419175641" --session-guid=cfe84aa8-29c2-4204-99ad-0c20c91bb0ad --server-tracking-blob="MmExZWE4NDBjYTgxZjcyYWVkYTEyMmEyNDAyYTgzNzVlMTMzYzdiNzFmMjBmMzc3MTJlMTk0YTA3M2I0YjJhNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNTQ5MzkxLjY2ODUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiZTdlMjkzZmQtZTAwZS00ZmY5LTgwOTctZjk4ZGVhMDliNzE2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=18040000000000005⤵PID:1360
-
C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exeC:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2ac,0x2b0,0x278,0x2b4,0x6a6fe1d0,0x6a6fe1dc,0x6a6fe1e86⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\assistant_installer.exe" --version5⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0xc76038,0xc76044,0xc760506⤵PID:632
-
C:\Users\Admin\Pictures\0SjmbTajZ93FBw8eumkBnS26.exe"C:\Users\Admin\Pictures\0SjmbTajZ93FBw8eumkBnS26.exe"4⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\7zSCB36.tmp\Install.exe.\Install.exe /nxdidQZJ "385118" /S5⤵PID:2808
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵PID:736
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵PID:552
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵PID:1704
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵PID:3648
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 17:58:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\xQBxmYC.exe\" em /Kpsite_idZks 385118 /S" /V1 /F6⤵
- Creates scheduled task(s)
PID:3224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵PID:784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 628 -ip 6281⤵PID:4020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4076 -ip 40761⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵PID:736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2968 -ip 29681⤵PID:5416
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\CD-DVD-Runner\cddvdrunner2333.exeFilesize
3.9MB
MD580d5389c5a4f9a34ffb6432986f20cf1
SHA19fa64fbf8788152616e84f708655c7278d30e09d
SHA25613d2fce54d140f74b58df72e26d1be9803a2e953f48972bf576c5e4f8b5e8f04
SHA5127d202a373f1d5ca0be5ed9a7e10a396c3b986f4d7f0e4a0ef373ebd71a9cbcb508e11a3a9abab911bc91d0ed6a972e2291e25304c1bf2a74cf3870e9dbc22485
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\additional_file0.tmpFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404191756411\opera_packageFilesize
103.8MB
MD55014156e9ffbb75d1a8d5fc09fabdc42
SHA16968d1b5cec3039e53bbbedeee22e2d43d94c771
SHA2567a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802
SHA512bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000173001\Startup.exeFilesize
3.3MB
MD576eae6ef736073145d6c06d981615ff9
SHA16612a26d5db4a6a745fed7518ec93a1121fffd9c
SHA2563acdea11112584cd1f78da03f6af5cfc0f883309fc5ec552fa6b9c85a6c483bb
SHA512e7c118bbe9f62d5834b374e05242636b32daab2c1fe607521d6e78520665c59f78637b74c85d171f8608e255be50731771f0a09dcca69e016b281ee02ab77231
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
552KB
MD50f5235116df283e424268f99bb1806fd
SHA1a79cd569110deffbfbda863b78de3e8f999d5a57
SHA256d007291fcf888c4009a7a389deb36534955ae7ffb668896b02a5532f7b3122c4
SHA512f956b363540595d70ec7a8e49e0baeb4980f4432ad286abe0ee19d7bf171f9f448d347c717e4697f3408a9fc7c9ed46eba56f5d9964396abfdfe58b129c7cc96
-
C:\Users\Admin\AppData\Local\Temp\1000200001\070.exeFilesize
3.9MB
MD5f1d29fddb47e42d7dbf2cf42ba36cc72
SHA195be0248f53891aa5abecc498af5c3c98b532ba6
SHA256a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c
SHA512f2e82e4e57dc6b3033ac74846f9830092521a26067d96f1c07b613258267c2d578bee901a0db04cd4fad13d2cc8afbbd3c3a685e040d225afd70203891632bbd
-
C:\Users\Admin\AppData\Local\Temp\1000201001\3zH6P6Qx.exeFilesize
2.9MB
MD5230d1c9342e0069aa228de1c26d5d24b
SHA166d2db599170c6aaacb57fdbc27a1903f7e9908d
SHA256d0214bb28c1f6f434d3eef3c4e31761ee3f79340bd46e8b4937d0244e4ab9e6a
SHA5123b7f259e4d0e920803b9a39dacf54b41d3050c9d4fbc15e4b26d179c4829623cb0697e5d7bedc155413d62bd4f95c61d42ac44a5d7138d142ce484594c68de47
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD5733fce8af4aa232cb80b7d61fa272764
SHA11bcc5b6309f5ff21b3e7d69a26d65ab318d2e760
SHA25672a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5
SHA5128d4384aa54bce3ab173fc9b2f8146e08499c2be3520b41a5a24cdc4fbc15f37ffae6287bc4e32337a5a617942c3d70f46e70d4400718c2097e3ec8ff0db728be
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404191756405743984.dllFilesize
4.6MB
MD50415cb7be0361a74a039d5f31e72fa65
SHA146ae154436c8c059ee75cbc6a18ccda96bb2021d
SHA256bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798
SHA512f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e
-
C:\Users\Admin\AppData\Local\Temp\Tmp47EC.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3u3v0fvo.myu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD580a01966f83801a51eb31125ba317f85
SHA1616eb23c14d8ccb93cd2976d238d6451c8cbd8b2
SHA2567373440793c922220759e2c051ef3b025a6cea3599677cc5b1e94b8ac2748985
SHA51295fc6a8dfb75904e579c8d456190f89c9223d855ee03c828af5e3b1c852f8096c9d0a11c737fa693b42410b759e890ac41a118fc49203dd19c8944c37c4d6354
-
C:\Users\Admin\AppData\Local\Temp\is-IKU9J.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-NNU2R.tmp\is-GQBP4.tmpFilesize
648KB
MD5782aaa5100055fb2ac7c59bb0ac9ca39
SHA1653c293fa0a42782903ba9b35f982d120cd39c36
SHA2566fda9904124971c92f5401c6802709d8031bf78996739e65055ace740154d0f2
SHA5122c9119aa69cb7be5d73b54f2351f8d2f0d96bdfd4bfb85b8fc0a82bec6948624a3bc47da0fc20ef9942acc593d4e772e74388eaf16fe46e5f9fcc7d0c265d7b5
-
C:\Users\Admin\AppData\Local\Temp\tmp6951.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp6A2F.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\u2ag.0.exeFilesize
316KB
MD56cd9e105a876df54cf1f36128c80a1f9
SHA1fee8638467bd94dc2afbbd2464eff0910ef5fab9
SHA25664ded4d9ca23baca7cffdc77c836cf63a832a2b681ef3891d41f3b1207dd53cd
SHA5120d95cb243b7c0e9e09ab4fb845676b22ebfef8c9f3cdd4e0428206e15a592be870cedecd90856ed4d8f9b770693796a7b409df69942e9c91ed27d518da780e3a
-
C:\Users\Admin\AppData\Local\Temp\u2ag.3.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-259785868-298165991-4178590326-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1037f2ac-7687-4b04-90ea-cc9b87b0e187Filesize
2KB
MD5d7db036ac4975be05ac2cc4d66a4a9b7
SHA1e0108c464e22901e062ee83448f4cfcda3a98045
SHA25667246a1ad46f8143f5ec17ba59160f34287c5ed44dbf2f19177de42ad2441c69
SHA5128e0767ff8d06ddef0421742b5682d348e89dc15e8ef17135cba403d00f25771c53bf3872405e70561c8949db286690aa2f5c467f8c5d9d04ba35a5f03dfd9729
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.datFilesize
40B
MD50866b73f8daae5a252718b51501d33cf
SHA1d60b9e40545000422e14a417a53e83a0c9cf852c
SHA256019c5537c67b57087197c1816ada97e54919c9531a9f76e8ac744b14e3168627
SHA5121eaebbf856442abd4d35033d5ce84ca2b7e1096a365396bb861e084c059f99c7cd35dbd03a09f7d9a4c21a24bfc200659cf730700f6c0e88b74e9257ebf694fa
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5b521c5fc459a29db604fac8927888a7f
SHA1d827046a2bb5d698bd59b093c35c653d790d131f
SHA256ed979dacf4c44b0bad562c502ba0ad68d6cf73154129fe02a72a47695ebf6a01
SHA512c99e3c13c4ca36adeca070218470dbe9c0c0db3c7f26c43a96304e1bea9eb8a44977ca106b44ba39dacbe95d49adb82c642ec6f3ad47b62395d66955841a12c2
-
C:\Users\Admin\Pictures\0SjmbTajZ93FBw8eumkBnS26.exeFilesize
6.4MB
MD5aaa56797070369ad346fbd9bb6cc5e8b
SHA1a1d01943f0a354d3a000628262671254ca6a91b8
SHA2569d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905
SHA512e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be
-
C:\Users\Admin\Pictures\Bp8KYmg2zZlvGknbVPbcdAhZ.exeFilesize
4.2MB
MD52e853f93f686838504b23085b24c9eda
SHA162574fed0d34299cf6b35eb8c03a44ac74c0788b
SHA256579b31cfb342233fa0562cedb3bfd8fd1c58d0445e1575adc090cecc6c3d7d24
SHA5121c0b9c8d55c65e1b9957e14032cbddedcbfb3bbecc119d451f08b6d386be44fe51abf709bed0de9f41620738676bfcbd4ed0baf5e253fdc480d3b93c5f008dbe
-
C:\Users\Admin\Pictures\JdHWaLdxNk3R6kEXcAZlHWGs.exeFilesize
5.1MB
MD5f77e072a6d4ce7114d45130ba9adf23f
SHA154db0f6f2ef19ca6be6211395f73766cbbae2e0c
SHA25649a288c0b321b5481818018b6e95f48983959322248a827f3d6eb52f33fd05f9
SHA51213dce17bc25cc40528a10695c9bb6e662088eeb4d60a121e1b7a6fcf40e4fb9077f75d52c48f519516b49a5380acbc765911c50c09b941d0692f9c5e1181c7b9
-
C:\Users\Admin\Pictures\VR1mf40a8WIyX7eL22zfpZRQ.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\nA6OhePY1qFpY8BOfo7AkDra.exeFilesize
2.5MB
MD5749cb9cb3ce89a03fdd97a9aaf96e895
SHA173ecd478ace66e1dfb7aeed8ed061af48214a46f
SHA25685aeb0eca144912f0713ac4e8392e2645a91bb4ba8e2ffa55e5bf834665170af
SHA512ac0afac898ab53a3277b4d1aef90af246ca8596872a6a61bbf47817c1ea038fc4394094a4d14d2cc0aa94aeaf1435f9ccc7cf7143010ff581fd4256dc653bd31
-
C:\Users\Admin\Pictures\oJHAhuRwe9TkV02DeZ3TxiJx.exeFilesize
471KB
MD579c630b8d1b9f3e7d28d6807acd0b52b
SHA19c81ad243fc0c113094aaef1a068c9bad17ad78e
SHA2568ccf83dc4e38c8f77ec6dd6eda15f6851e92cd222993d0b45d3d5eb9c423540a
SHA5126371613b522ac21643f9a25142449b0e6d50ba62074cbf9cd2b06357da2468a858d9b38bf8aa5a3574b981a78594d027ba619151d125ab1afbe708a3d9bd157e
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD51e68832793d8d777910c2d3e30804bb3
SHA1a6fc19ac7bd5c9283d4a8b324babec28278a738a
SHA256a1e76542c19dab576a4ae9e1411567710618a7a9a749eec2646ebb0cd42dd36f
SHA5128a2b12bcba75279fab4675fd1a1da5a6b0b1145eca1bd9536e920a2e9e92f6f6bcfded536ceaa1de54d9f31dce20f4695e5633c0344bb6e0e12d9fbd1724f9aa
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
memory/396-97-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/396-98-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/396-89-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/412-28-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/412-19-0x0000000000300000-0x00000000007B9000-memory.dmpFilesize
4.7MB
-
memory/412-64-0x0000000000300000-0x00000000007B9000-memory.dmpFilesize
4.7MB
-
memory/412-24-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/412-377-0x0000000000300000-0x00000000007B9000-memory.dmpFilesize
4.7MB
-
memory/412-22-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/412-20-0x0000000000300000-0x00000000007B9000-memory.dmpFilesize
4.7MB
-
memory/412-21-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/412-29-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/412-27-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/412-26-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/412-25-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/412-91-0x0000000000300000-0x00000000007B9000-memory.dmpFilesize
4.7MB
-
memory/412-23-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/628-49-0x0000000000C90000-0x0000000000CE2000-memory.dmpFilesize
328KB
-
memory/628-50-0x0000000072B80000-0x0000000073330000-memory.dmpFilesize
7.7MB
-
memory/628-57-0x0000000003160000-0x0000000005160000-memory.dmpFilesize
32.0MB
-
memory/628-63-0x0000000072B80000-0x0000000073330000-memory.dmpFilesize
7.7MB
-
memory/688-489-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-513-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-548-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-546-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-539-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-557-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-496-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-529-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-553-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-515-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-559-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-562-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-567-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-509-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/688-511-0x0000025EFC330000-0x0000025EFC5EB000-memory.dmpFilesize
2.7MB
-
memory/2056-183-0x0000000000CD0000-0x0000000000D4D000-memory.dmpFilesize
500KB
-
memory/2056-180-0x0000000000CD0000-0x0000000000D4D000-memory.dmpFilesize
500KB
-
memory/2788-561-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3124-4-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/3124-10-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/3124-9-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/3124-8-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/3124-11-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/3124-6-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3124-7-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/3124-5-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3124-16-0x0000000000340000-0x00000000007F9000-memory.dmpFilesize
4.7MB
-
memory/3124-3-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/3124-2-0x0000000000340000-0x00000000007F9000-memory.dmpFilesize
4.7MB
-
memory/3124-0-0x0000000000340000-0x00000000007F9000-memory.dmpFilesize
4.7MB
-
memory/3124-1-0x0000000076F74000-0x0000000076F76000-memory.dmpFilesize
8KB
-
memory/3156-59-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/3156-53-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3156-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3156-58-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/3156-60-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/3156-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3156-61-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/3164-182-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/3164-181-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3164-193-0x0000000005170000-0x0000000005180000-memory.dmpFilesize
64KB
-
memory/3540-95-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/3540-96-0x00000000027F0000-0x00000000047F0000-memory.dmpFilesize
32.0MB
-
memory/3540-84-0x0000000000350000-0x000000000050C000-memory.dmpFilesize
1.7MB
-
memory/3540-85-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/3540-86-0x0000000004E40000-0x0000000004E50000-memory.dmpFilesize
64KB
-
memory/3656-245-0x0000000000220000-0x0000000000272000-memory.dmpFilesize
328KB
-
memory/3656-244-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/4156-224-0x000000001CB70000-0x000000001CBAC000-memory.dmpFilesize
240KB
-
memory/4156-223-0x000000001C930000-0x000000001C942000-memory.dmpFilesize
72KB
-
memory/4156-222-0x000000001E130000-0x000000001E23A000-memory.dmpFilesize
1.0MB
-
memory/4156-126-0x00007FFA4E2F0000-0x00007FFA4EDB1000-memory.dmpFilesize
10.8MB
-
memory/4156-125-0x0000000000590000-0x000000000061C000-memory.dmpFilesize
560KB
-
memory/4252-144-0x0000000006D90000-0x0000000006DAE000-memory.dmpFilesize
120KB
-
memory/4252-124-0x00000000059C0000-0x00000000059CA000-memory.dmpFilesize
40KB
-
memory/4252-120-0x0000000005D00000-0x00000000062A4000-memory.dmpFilesize
5.6MB
-
memory/4252-118-0x0000000000F00000-0x0000000000F52000-memory.dmpFilesize
328KB
-
memory/4252-116-0x0000000072A50000-0x0000000073200000-memory.dmpFilesize
7.7MB
-
memory/4252-122-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/4252-162-0x0000000007130000-0x000000000717C000-memory.dmpFilesize
304KB
-
memory/4252-121-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/4252-143-0x0000000006430000-0x00000000064A6000-memory.dmpFilesize
472KB
-
memory/4252-147-0x00000000074D0000-0x0000000007AE8000-memory.dmpFilesize
6.1MB
-
memory/4252-148-0x0000000007020000-0x000000000712A000-memory.dmpFilesize
1.0MB
-
memory/4252-158-0x0000000006F60000-0x0000000006F72000-memory.dmpFilesize
72KB
-
memory/4252-159-0x0000000006FC0000-0x0000000006FFC000-memory.dmpFilesize
240KB
-
memory/4332-431-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4332-360-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4332-365-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB