Analysis
-
max time kernel
11s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-04-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe
Resource
win10v2004-20240412-en
General
-
Target
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe
-
Size
3.1MB
-
MD5
3b69ce65e1b7235f333906eb776e68ca
-
SHA1
666588ba21b5751422e0b3c27a6ab53b9ba93dbd
-
SHA256
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68
-
SHA512
56a626f645031724dfa27ad1dd876de58ac5e9f44ce57f4a8dc360b0d76fa31a5c26aa2b2835edd299ec7492a57ea2ede43ed94bbd9e4af9262cf036667d86e6
-
SSDEEP
49152:nOej1M0rQw14aqx8g4L6M5DyiWuVwKgrmBKC2O3ddQuuI:Sw15qxHs6M5Dtj7jN3d
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.17
http://193.233.132.167
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exeexplorha.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorha.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exeexplorha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorha.exe -
Executes dropped EXE 3 IoCs
Processes:
explorha.exeexplorha.exe3e7ea72aa1.exepid process 2272 explorha.exe 1196 explorha.exe 2024 3e7ea72aa1.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorha.exe4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe Key opened \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine explorha.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000055001\3e7ea72aa1.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exeexplorha.exepid process 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe 2272 explorha.exe 1196 explorha.exe -
Drops file in Windows directory 1 IoCs
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exedescription ioc process File created C:\Windows\Tasks\explorha.job 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1048 1336 WerFault.exe swiiiii.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exeexplorha.exepid process 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe 2272 explorha.exe 2272 explorha.exe 1196 explorha.exe 1196 explorha.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
3e7ea72aa1.exepid process 2024 3e7ea72aa1.exe 2024 3e7ea72aa1.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
3e7ea72aa1.exepid process 2024 3e7ea72aa1.exe 2024 3e7ea72aa1.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exeexplorha.exe3e7ea72aa1.exechrome.exedescription pid process target process PID 2676 wrote to memory of 2272 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe explorha.exe PID 2676 wrote to memory of 2272 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe explorha.exe PID 2676 wrote to memory of 2272 2676 4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe explorha.exe PID 2272 wrote to memory of 2024 2272 explorha.exe 3e7ea72aa1.exe PID 2272 wrote to memory of 2024 2272 explorha.exe 3e7ea72aa1.exe PID 2272 wrote to memory of 2024 2272 explorha.exe 3e7ea72aa1.exe PID 2024 wrote to memory of 2684 2024 3e7ea72aa1.exe chrome.exe PID 2024 wrote to memory of 2684 2024 3e7ea72aa1.exe chrome.exe PID 2684 wrote to memory of 3804 2684 chrome.exe chrome.exe PID 2684 wrote to memory of 3804 2684 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe"C:\Users\Admin\AppData\Local\Temp\4f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1000055001\3e7ea72aa1.exe"C:\Users\Admin\AppData\Local\Temp\1000055001\3e7ea72aa1.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff153fab58,0x7fff153fab68,0x7fff153fab785⤵PID:3804
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:25⤵PID:1408
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:4712
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2116 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:4724
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:15⤵PID:4224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:15⤵PID:3132
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4212 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:15⤵PID:3104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4200 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:15⤵PID:2728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4520 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:2108
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:2648
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:3460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:1076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3404 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:85⤵PID:4560
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 --field-trial-handle=1792,i,10410257297307124706,5565163349122241958,131072 /prefetch:25⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵PID:1196
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵PID:1504
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵PID:1904
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal5⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\1000056001\458d0216b0.exe"C:\Users\Admin\AppData\Local\Temp\1000056001\458d0216b0.exe"3⤵PID:2208
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"3⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1196
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵PID:1336
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 9083⤵
- Program crash
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵PID:4812
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2440
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵PID:2104
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵PID:2860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3964
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵PID:4696
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵PID:1736
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵PID:2772
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal4⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵PID:4884
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵PID:2192
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵PID:644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1336 -ip 13361⤵PID:4924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
360B
MD5a25276059aba97857d1df73bec4911f5
SHA1a768b6932787ef0d60850f0938841f412caadb85
SHA256f3c81ff78ff0971f27a40d871b98489b6162656ad605e1880f7a7a9adb32cbfa
SHA5123f016bc32b7c75e8822cae9092f980ca260dcab02765e5ac00557738451c9223488ead82aa0f7ae393da480639bde8de7abf1783ae9e999f217dce5930ff3424
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesFilesize
20KB
MD5c018cc27377af9512a145ad62e024a44
SHA1558629d220467db2770aa019ce198c92f94b3cbb
SHA2562f533e2a93def1081e96b856367cf1341b0356ebb59ca60dacc044dcf93d1f8b
SHA512ccfe589558b65e5b6e0fadd2f130a2c10ade4274b8019cd9b03f555e83df130b458c07bac5d4123b9c007ef373ddedc943783ed7046bc0cd7cced5453b6d8eca
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD50ce4281931df8d70ee0d89984a333bd8
SHA1def6db0262033377fe0eff53f24e13139d5d731b
SHA25695c982184238c02f40e09cb476a0edd77e90e4495469e1ff74828f6fca881c6e
SHA512f40c4f45a9b84ad9be52a5ffeea450689d2caa0283ea72490b8358ffd33e5dc71d0ee8b58a49dadfd7fcb0df5c2c39688e412f8848b0d62c5a6f05695b7a84aa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD54c19ea4c94a614f9916602d7b537ecd6
SHA1f07da8d4ba8467ee85ff4219ff8354c63a4a3ceb
SHA256f7ae3afd74e4654dde0a07420b0d32d3e5ed2c3284098fd0a3b3f33c5dd3a28f
SHA5124f2ca8b70c6658e6ac336e692ed3ebaced9d875b970ae37e6266aa773b5bbe40c410b7f3c96510ebc529b022cbc0490045b450e1ce9ac8f2595c8d5fb2b8fef3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5e5feac2a549f60b22687faaba25c562d
SHA179cf5e64caab648151706aed0ebbc23e0ef07cb0
SHA256e66fe7660d5485ced39910a6e43f4bc49b56d1a87a3dbbbdaa1c43dd589c3235
SHA51271efa7a5e25fb77fa2c048cd74b0f332f10ce554de70aab6d4a597e2d4a0e8f25bc54dafcf083a647d943cc8da3006458486e9df88858fab86af7bc5541acd67
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5c88af02cdd5a06c9ea0fec7456820b26
SHA1ac4734c4df2ebcff14fbb2207cb3f7ce6ba637bf
SHA256b4309b2174906687ca8b2e51d21471996e744081879238c173fd47f310922f5d
SHA512889509d6eade60a7a11343e8271d0df74104530c6a2f0c65468276d9dd2651bedc940df8ee55132c9cf45f5a9659adf193f7306103726d061bc8440385d2d3da
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5714f2d8be69ea05b84b2be80fbc7c5d4
SHA1a37a94665dee019425328a09f1632fa823cd3901
SHA25624025a209671007a43bb82d556ff2493eab1712de719d2744a44e5aa19e2317c
SHA5127f29042f8821cf2b976b29f25f99c367673f6daf5127ab989a6804c31f642d1c7540a1e0443715f2c2c6bb7f1aa1cf07ddcc243386fe06975034c5f6c69a56ce
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5e99285a92cb07fcfdf1ab4addec9b441
SHA1748e4f237283d99135b4cddffb78db13dfbd27af
SHA256a95ef96058b813622953cfa7dc3517a49605d2690d627d27432554da7536aecb
SHA512bf3e3516d7043d5e285d9832a148a9f57db8302ba4b93a6de3248cf3a7c0f7ecef53ef2fdb5eb59d1d00121f048f2503654d943b537da09dede4046aa10bd588
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
252KB
MD5df437775e8cf1627c779adfc7f7c3183
SHA11daf22f584df243f56267af9724d935626a4104d
SHA256de6892e9ee0889ab7c9c96d5ba2f464fcd1504c96bb10fe28064ed0a2ab17371
SHA51260040c523f63ffe7a412810940874d22c1ec7ea00bc7f57f1b5ff7733ca01c4eeeca80be394f217c91fe24f892194fcb0867eaa4ceb417b943f0b92038044ebf
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5ae626d9a72417b14570daa8fcd5d34a4
SHA1c103ebaf4d760df722d620df87e6f07c0486439f
SHA25652cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a
SHA512a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD51ca0032e53df57864eca5c293d705d0d
SHA1faf09dad6654035c51e5f0e373cb280cf97fde34
SHA256661aeb3b5959e598699b8d83e3f8b962ad2783c4d1ed7cd9ed8355b26e013b17
SHA512a5e92e427a6ffc7d177819d63e86adc50c34b20abb5304335933de388b46c2ffad7d993d6a478edbcdd203cca2b98d96db6f50ab917b6e21825327e164e7b437
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeFilesize
3.1MB
MD53b69ce65e1b7235f333906eb776e68ca
SHA1666588ba21b5751422e0b3c27a6ab53b9ba93dbd
SHA2564f08c3aa2560c97cc24fa3943a2d8a11095620c32c7209d23dcae03603668a68
SHA51256a626f645031724dfa27ad1dd876de58ac5e9f44ce57f4a8dc360b0d76fa31a5c26aa2b2835edd299ec7492a57ea2ede43ed94bbd9e4af9262cf036667d86e6
-
C:\Users\Admin\AppData\Local\Temp\1000055001\3e7ea72aa1.exeFilesize
1.1MB
MD57d2528cbd7a1de4a0da710bdd9f50e5d
SHA1924f6a5fa107d405420c5ac20a1f9b72384a90df
SHA25643311c09c7a9c1bc0bb2d090b4da3fb5d2fca694080052384b084f369993df62
SHA512eceafa276533873883d0d1247946a4181d37cd999486354999698581d42bf2c553a4cf2a56d262f304704c0b12391da35825c7f56a0dc1c57ee88dab58574774
-
C:\Users\Admin\AppData\Local\Temp\1000056001\458d0216b0.exeFilesize
2.3MB
MD56c41dcf3e3f1cd2532e572b9fb65228e
SHA1652a4a2b268099b2ba67201dfcba10c0d1e9d1b2
SHA256b24f6c6e0a83f73c3434fc5bf3a48eaed2facdf397740c984d9c74ab9413c389
SHA5127c474f984f59cd0ec591438162264c824e5bdf7c2e820a709e8b67220dc3ae6d0be31f11b596a81f29eadb67c54f317cf48f2b64681e9a29dc2cabc3df16c63f
-
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exeFilesize
1.8MB
MD5283177eb03a118928caa2120942b3160
SHA1e47e736ad3ff15108036901476a1ad6859368b5d
SHA256280ffcc06cb568629c5146aea0e412f1add9e0e16f3d462e5e50eea586455e60
SHA512e58199608b54e76bece47f0694dd3b19a34fd42914fbd436ed3a44c318f386c16e136d210617413ce13fac2d085b96c6e93ca5258e6d097bc5c7117039cbc96b
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\Tmp8BBC.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qoi4ygjj.nmj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpACE3.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmpAD24.tmpFilesize
100KB
MD5d67511e6b6353f4790d1c1bfdf2f53ee
SHA1edd9873c0aa895f8af3dfeaee87edbda77a46aec
SHA256601cbdbcca7389cc5adf6e87730de1ab78f12e64097feb3129dda15b949701da
SHA51257474c3ab9426bac786d4d3b794bae856feb78a326fb8de6fae1fb86abcf196159ded93e21f887abd854118a4dab0e965aae506dd439846fa11f4042e5c52258
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3777591257-2471171023-3629228286-1000\76b53b3ec448f7ccdda2063b15d2bfc3_dc25d36c-3a5d-4177-8466-03057136ebe3Filesize
2KB
MD5ff3b25a060e30247a27387734db9ee3d
SHA19c605d8b3c949a451fb043eae8313c95510aa846
SHA256937d91a7c0b1bb8e648d83f5ddfb749a4f6364fc7a19e1303dcc283484103a55
SHA512bc12ec4d8b30475f53561e23d172ecdc2bce3f2acafdd075419042c7df3e3072949485b75def56f2a66098a4246ae08914638ca9fc2cea4ca4ad8b03978a8d50
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
109KB
MD5726cd06231883a159ec1ce28dd538699
SHA1404897e6a133d255ad5a9c26ac6414d7134285a2
SHA25612fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA5129ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
1.2MB
MD515a42d3e4579da615a384c717ab2109b
SHA122aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA2563c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA5121eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5601bab861365f5f8ad14cd04a76bd9c7
SHA1da816d82f7ed51ab632a74427953b81a29da6ea4
SHA256f4b9d31121727593c534de88881bf7e973bd19ea6b4152a65f4c5524e2135ac0
SHA512f8c3a7aa7a8180f89d94468dd0d0e8ec10a741184af5bc765bbde76056f4c9c7435b9e0fe1a2ebd786dd98aafab93e0d83145a89ae0c713f97ee869fd044cf23
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5824f96522a625ad76525af2a1eb21e23
SHA14d68fcbcdf115d80ec15d7a4b023a37eaf301e89
SHA25668dada757f435dd00062f7d631eafc6f9e6b9e0afbc674f2eb5cfe031bd3a437
SHA51245e3bc636effcbe3c0ab91b4cfc91e3906ea24a4ab94e16f185bac2ebda9e28f6295821f139365d200d7124f3aac60fc9a1b3dc1bff5b91df86da736518b707f
-
\??\pipe\crashpad_2684_YJRTTDMCWAZCIPJBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/644-392-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-274-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-255-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/1196-36-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1196-39-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/1196-32-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-35-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/1196-38-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1196-264-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/1196-42-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-262-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1196-257-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/1196-258-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/1196-260-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/1196-253-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1196-251-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-248-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/1196-37-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/1196-34-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/1196-33-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2208-301-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-223-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-204-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/2208-203-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/2208-202-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2208-201-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/2208-200-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/2208-199-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/2208-198-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/2208-197-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2208-196-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/2208-195-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/2208-425-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-205-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/2208-194-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-286-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-371-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-225-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-226-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-206-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2208-237-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-369-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-358-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2208-356-0x0000000000630000-0x0000000000C07000-memory.dmpFilesize
5.8MB
-
memory/2244-159-0x000001BF6CA90000-0x000001BF6CAA0000-memory.dmpFilesize
64KB
-
memory/2244-150-0x000001BF6CAA0000-0x000001BF6CAC2000-memory.dmpFilesize
136KB
-
memory/2244-168-0x00007FFF11C50000-0x00007FFF12712000-memory.dmpFilesize
10.8MB
-
memory/2244-157-0x00007FFF11C50000-0x00007FFF12712000-memory.dmpFilesize
10.8MB
-
memory/2244-161-0x000001BF6CED0000-0x000001BF6CEE2000-memory.dmpFilesize
72KB
-
memory/2244-158-0x000001BF6CA90000-0x000001BF6CAA0000-memory.dmpFilesize
64KB
-
memory/2244-162-0x000001BF6CE90000-0x000001BF6CE9A000-memory.dmpFilesize
40KB
-
memory/2244-160-0x000001BF6CA90000-0x000001BF6CAA0000-memory.dmpFilesize
64KB
-
memory/2272-370-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-463-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-22-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-30-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2272-29-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/2272-28-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/2272-27-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/2272-26-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/2272-25-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/2272-207-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-24-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2272-23-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-373-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-224-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-236-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-240-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-368-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-41-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/2272-133-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-357-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-40-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/2272-115-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-106-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-317-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-107-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2272-300-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/2440-456-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/2676-1-0x00000000777F6000-0x00000000777F8000-memory.dmpFilesize
8KB
-
memory/2676-7-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/2676-6-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/2676-5-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/2676-4-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2676-3-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/2676-2-0x00000000007A0000-0x0000000000AB3000-memory.dmpFilesize
3.1MB
-
memory/2676-0-0x00000000007A0000-0x0000000000AB3000-memory.dmpFilesize
3.1MB
-
memory/2676-9-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/2676-8-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/2676-20-0x00000000007A0000-0x0000000000AB3000-memory.dmpFilesize
3.1MB
-
memory/3260-267-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-270-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-245-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-273-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-244-0x0000000000090000-0x00000000003A3000-memory.dmpFilesize
3.1MB
-
memory/3260-276-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-275-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-272-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-271-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-259-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-269-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-268-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-280-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-281-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-282-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-266-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-265-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-283-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-256-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-263-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-241-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-284-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-261-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-249-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-252-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-254-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-250-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-278-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-277-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-279-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-246-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3260-285-0x0000000000400000-0x00000000009E4000-memory.dmpFilesize
5.9MB
-
memory/3296-490-0x00000000005C0000-0x0000000000A7A000-memory.dmpFilesize
4.7MB
-
memory/4276-419-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4276-416-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4808-355-0x0000000000510000-0x00000000009CA000-memory.dmpFilesize
4.7MB