Analysis
-
max time kernel
60s -
max time network
110s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-04-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe
Resource
win10v2004-20240412-en
Errors
General
-
Target
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe
-
Size
1.8MB
-
MD5
932173eb2519fcf155a5a29c06974def
-
SHA1
6b629bfa325583031d4bceb1b1b795a796873d3b
-
SHA256
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25
-
SHA512
33e060c8f6f4473821904cf68d9f487ed38ea05728151455f84393f5be539819e08231981c673d2dcb39f9af0fadcb2572ab760030c0e8db0b12322d1664cf56
-
SSDEEP
49152:I4xGyO1ycVnXhcDBZtD44nt990GrXg8URd0KZBHuDZzvwQExej:I4xXO1DLclD44nt4Rd0eZuD5R
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.76
-
url_path
/c73eed764cc59dcb.php
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe family_zgrat_v1 behavioral2/memory/1716-76-0x0000000000E60000-0x000000000101C000-memory.dmp family_zgrat_v1 -
Glupteba payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/488-736-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/3924-854-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/4816-865-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba behavioral2/memory/488-932-0x0000000000400000-0x0000000004426000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline behavioral2/memory/2784-102-0x0000000000520000-0x0000000000572000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral2/memory/3448-157-0x0000000000340000-0x00000000003CC000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline behavioral2/memory/2240-220-0x0000000000BB0000-0x0000000000C02000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
chrosha.exeb7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe -
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe -
Executes dropped EXE 6 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exepropro.exeTraffic.exegold.exepid process 5080 chrosha.exe 2384 swiiiii.exe 1716 alexxxxxxxx.exe 2784 propro.exe 3448 Traffic.exe 3092 gold.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exechrosha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe Key opened \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine chrosha.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 api.myip.com 17 ipinfo.io 66 api.myip.com 68 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exechrosha.exepid process 1480 b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe 5080 chrosha.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
swiiiii.exealexxxxxxxx.exegold.exedescription pid process target process PID 2384 set thread context of 748 2384 swiiiii.exe RegAsm.exe PID 1716 set thread context of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 3092 set thread context of 2932 3092 gold.exe sc.exe -
Drops file in Windows directory 1 IoCs
Processes:
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exedescription ioc process File created C:\Windows\Tasks\chrosha.job b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2932 sc.exe 1512 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2900 2384 WerFault.exe swiiiii.exe 4212 3092 WerFault.exe gold.exe 5016 1312 WerFault.exe toolspub1.exe 5220 4908 WerFault.exe u1js.0.exe 5332 2008 WerFault.exe ISetup8.exe 6020 2204 WerFault.exe u2ag.0.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
propro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 propro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 propro.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exechrosha.exepid process 1480 b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe 1480 b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe 5080 chrosha.exe 5080 chrosha.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Traffic.exedescription pid process Token: SeDebugPrivilege 3448 Traffic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exegold.exedescription pid process target process PID 5080 wrote to memory of 2384 5080 chrosha.exe swiiiii.exe PID 5080 wrote to memory of 2384 5080 chrosha.exe swiiiii.exe PID 5080 wrote to memory of 2384 5080 chrosha.exe swiiiii.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 2384 wrote to memory of 748 2384 swiiiii.exe RegAsm.exe PID 5080 wrote to memory of 1716 5080 chrosha.exe alexxxxxxxx.exe PID 5080 wrote to memory of 1716 5080 chrosha.exe alexxxxxxxx.exe PID 5080 wrote to memory of 1716 5080 chrosha.exe alexxxxxxxx.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1716 wrote to memory of 1188 1716 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 2784 1188 RegAsm.exe propro.exe PID 1188 wrote to memory of 2784 1188 RegAsm.exe propro.exe PID 1188 wrote to memory of 2784 1188 RegAsm.exe propro.exe PID 1188 wrote to memory of 3448 1188 RegAsm.exe Traffic.exe PID 1188 wrote to memory of 3448 1188 RegAsm.exe Traffic.exe PID 5080 wrote to memory of 3092 5080 chrosha.exe gold.exe PID 5080 wrote to memory of 3092 5080 chrosha.exe gold.exe PID 5080 wrote to memory of 3092 5080 chrosha.exe gold.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe PID 3092 wrote to memory of 2932 3092 gold.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe"C:\Users\Admin\AppData\Local\Temp\b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 8843⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 3883⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000218001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000218001\ISetup8.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\u1js.0.exe"C:\Users\Admin\AppData\Local\Temp\u1js.0.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 13685⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exe5⤵
-
C:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\u1js.1.exe"C:\Users\Admin\AppData\Local\Temp\u1js.1.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 11724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000219001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000219001\toolspub1.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 3884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000220001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000220001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000220001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000220001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000221001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000221001\FirstZ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\017659663955_Desktop.zip' -CompressionLevel Optimal4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pc15n3mk\pc15n3mk.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES501F.tmp" "c:\Users\Admin\AppData\Local\Temp\pc15n3mk\CSCE3E6E7B8B6E4847A4BAE4413E96D248.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\Pictures\DAjSSsSxQHnBzUH5B7eR65uu.exe"C:\Users\Admin\Pictures\DAjSSsSxQHnBzUH5B7eR65uu.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 13686⤵
- Program crash
-
C:\Users\Admin\Pictures\LNo2XzCd6giBj6q1jJ66dJwW.exe"C:\Users\Admin\Pictures\LNo2XzCd6giBj6q1jJ66dJwW.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\LNo2XzCd6giBj6q1jJ66dJwW.exe"C:\Users\Admin\Pictures\LNo2XzCd6giBj6q1jJ66dJwW.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\ZfJ9eynh0b8AWtiI2PFWxvyQ.exe"C:\Users\Admin\Pictures\ZfJ9eynh0b8AWtiI2PFWxvyQ.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\ZfJ9eynh0b8AWtiI2PFWxvyQ.exe"C:\Users\Admin\Pictures\ZfJ9eynh0b8AWtiI2PFWxvyQ.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\Pictures\scsOnnsio5PDPoT5V1vLIB2s.exe"C:\Users\Admin\Pictures\scsOnnsio5PDPoT5V1vLIB2s.exe"4⤵
-
C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe"C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exeC:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6b4ee1d0,0x6b4ee1dc,0x6b4ee1e85⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\0rBtLEBslFq4ZgEjUBBIBmOZ.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\0rBtLEBslFq4ZgEjUBBIBmOZ.exe" --version5⤵
-
C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe"C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5236 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240423140129" --session-guid=a6edefea-951c-4d55-ae87-99a3a51ac00b --server-tracking-blob="NGYyMzdiMjNiMDJmNmJmNWJkZjE5MzgzNmNhZTcyYjJmYzhhOGJmMTQ2MGYzZTBhNTNmNDgyNTU4NWRlZjhiZjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzODgwODgxLjA3MjYiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiZWRmNjU4N2UtNjNiMi00MWNjLTkzZjQtMWY2YzQ0Y2NjMDM2In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C040000000000005⤵
-
C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exeC:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6a91e1d0,0x6a91e1dc,0x6a91e1e86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "3⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClient4⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClient confirm4⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"4⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClient4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "3⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClientC4⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClientC confirm4⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"4⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClientC4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2384 -ip 23841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1312 -ip 13121⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
-
C:\Program Files (x86)\GameServerClient\GameServerClient.exe"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"2⤵
-
C:\Windows\Temp\631914.exe"C:\Windows\Temp\631914.exe" --list-devices3⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4908 -ip 49081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2008 -ip 20081⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2204 -ip 22041⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
1Subvert Trust Controls
1Install Root Certificate
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameServerClient\GameServerClient.exeFilesize
2.5MB
MD5bf4360d76b38ed71a8ec2391f1985a5f
SHA157d28dc8fd4ac052d0ae32ca22143e7b57733003
SHA2564ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf
SHA5127b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd
-
C:\Program Files (x86)\GameServerClient\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameServerClient\installg.batFilesize
238B
MD5b6b57c523f3733580d973f0f79d5c609
SHA12cc30cfd66817274c84f71d46f60d9e578b7bf95
SHA256d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570
SHA512d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
460KB
MD5b22521fb370921bb5d69bf8deecce59e
SHA13d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA5121f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
850KB
MD5021b6c96fe692e2bb8d4b0d02e9133b0
SHA14ff05288024aef4f289c22e4e6985f82c29e49d5
SHA256ff477a862bd6e5acebe92887a6f221418da1995dfb0abed8527e21fda9b8950b
SHA512afc29e105225f8f92c74b8ead1df10bedbf6c795cad72c53a6ce6237b71d3f73e346cd6e0116c6a380f7d07e79fa5007e63df8dfe414d0c7816aaf5828cea482
-
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exeFilesize
2.4MB
MD555f780ea4dc5a5401b80915d69a55481
SHA15ebdde7f87637493de0a5e7a4ffcd59839672c4e
SHA256c3014a898f63fab694a759d56bb0b3c979484eedd32708e1467e566b4f3dfa70
SHA512680ca9d6f5aa4d53e7083858bfd4d3fc71f567993968edc83ddf262e15b2ed06f07c5a4c47e65f4874074213adf3cd978b8eaa658563694caf013fb126948697
-
C:\Users\Admin\AppData\Local\Temp\1000218001\ISetup8.exeFilesize
461KB
MD534096787163f2dee47afc23ef12f40d6
SHA169fe2f9a70098f2f83c2e93dc989d7488009674e
SHA2565f06bd948d9faee86dd14590306a6040ad998658464ece376232c60608f6f95d
SHA512f1ff93c2a7ed982b42ec1f23c547441c5a69258ad4c16ce8020c50cdd2dbc1055b082ba399ca7024a29c3fe2d967d6fefd816c89185d4f5a381a0c5e2a16c3bf
-
C:\Users\Admin\AppData\Local\Temp\1000219001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000220001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD52af77f8ec96e690ca5166d8ff270cf79
SHA19c2492b43b1d84e95e89cca9da2b83d961083163
SHA25633aad789427d2bd907ae0f67ba6dd4d361c1acb3d24cfb055a5990db423ef2e1
SHA512e08e8fc854b6323be920f41a0f8d23919ec1aa0e6c748797fc75ccde865bd34ed65835992aa66cc236b070c5c2bcaeff03dc6187d50314167ff307e6982eaacf
-
C:\Users\Admin\AppData\Local\Temp\1000221001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD5932173eb2519fcf155a5a29c06974def
SHA16b629bfa325583031d4bceb1b1b795a796873d3b
SHA256b7b3195a54bcde368dc15f8b7fe17d7e2b8dbbee7bb212ff6fae54ed08993f25
SHA51233e060c8f6f4473821904cf68d9f487ed38ea05728151455f84393f5be539819e08231981c673d2dcb39f9af0fadcb2572ab760030c0e8db0b12322d1664cf56
-
C:\Users\Admin\AppData\Local\Temp\5531b2bcFilesize
6.8MB
MD515fe0c4c282df938f0ae415334fc8d11
SHA10b97fa302ed3f3c2b5dbb2dc8f0386e578ebc14d
SHA256ee44025db5ad03b33944bf734f6f256d8b996e89f2ec22197c1767fbae70853d
SHA512fae66f89bc0007d59570a87ef815295a9499299086bbd2418dd17176c814a9ffc4559fc99b9fa2a1ec14e9d18b4206ce406cc483f04691f3a644cb6a84f932b5
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404231401293875548.dllFilesize
4.6MB
MD5cb9f8ac8c123de6ef018cd36e39d4a61
SHA130733f7b86743531636affc6e0394f9c3189b3d0
SHA256ea03fe24040a07d65144d51bc06535b2d5104cfc761934e8d2e6c12887f11481
SHA51211d4b2f2eb43258d26dbcb6e0f11a941685491e42eda38a3a628e31d278f346b559f7b407ab658163d01a7576e57a49462b156073c71d8eb6621bf25dbd7b1ae
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
8.1MB
MD554d53f5bdb925b3ed005a84b5492447f
SHA1e3f63366d0cc19d48a727abf1954b5fc4e69035a
SHA2564d97e95f172cf1821ec078a6a66d78369b45876abe5e89961e39c5c4e5568d68
SHA512f6a5b88e02e8f4cb45f8aae16a6297d6f0f355a5e5eaf2cbbe7c313009e8778d1a36631122c6d2bcfea4833c2f22dfd488142b6391b9266c32d3205575a8ff72
-
C:\Users\Admin\AppData\Local\Temp\RES501F.tmpFilesize
1KB
MD5e1b7570209288f5a506def5e2f019e02
SHA19c89169ff04c03a1e838aebb74bc86a21b6b41ce
SHA25633a2ac9988e6fe50c3416e76e6530c2dc2cfbd36165f060abd3333ec81501cac
SHA51215468b10bdd39914a4f8a82d239f041874c44e69bb7a3b7b6d7cf06666ac462e2de9be90c5c6aa48153b4040f2014e9666365f1b54c1f9d796445af7b167ca16
-
C:\Users\Admin\AppData\Local\Temp\Tmp2A66.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0rslfqww.mik.psm1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD557bfb832931d944811ea952994a599a6
SHA1c270b8a8957c34b4a721295acc021eaabb695fcc
SHA256a1e82193e7bdb73a68915c0df1e82cd1a804a045e9e5a4a8edaa25bdb8b1dffc
SHA512e301dd53ada9841479fc5a999fda5b9dcc09d9df402ba7ed4bdffadf1033d777f2cb7a047c924d20f9e59b17ad2157d0242b060ce1cf9d85056f14303cc0e912
-
C:\Users\Admin\AppData\Local\Temp\pc15n3mk\pc15n3mk.dllFilesize
6KB
MD56666c5c231dab148358c37a229b6fe00
SHA18af026ab122fa5e721ad28c251d94f0fe8acd212
SHA25647a3e63274e389a6e6fbb681ed2286b8944b3142af1e4f3ce1bb19e33fa9b34a
SHA5128c6b70f475151d80168e5d3f58f778289f107972c289e1aff0690f97a9191bff21389f8c0b0fbf88463aeadd1bc8aba49f14d63310e4c8aee8254f451eb99c2d
-
C:\Users\Admin\AppData\Local\Temp\tmp4822.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp48F0.tmpFilesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
C:\Users\Admin\AppData\Local\Temp\u1js.0.exeFilesize
317KB
MD5f4e3f20f4efd7763376238cca5f08f37
SHA157754365c9da15b5b17f9e491aaaf76692543f0f
SHA256548b531842ea7e853cab55046954a3c3173a71ccf5792ac0bdf8e0c5b40357c8
SHA5125314ddeaf5e51afeb20131190e466d0ee23130fb6790ced8e231aa67d85cf7b89b11b9f74936b9df598e0cc5ea46da9ec2e0678dcf39af3d69481ae65d62df06
-
C:\Users\Admin\AppData\Local\Temp\u1js.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-801765966-3955847401-2235691403-1000\76b53b3ec448f7ccdda2063b15d2bfc3_46facfa6-6cf2-4847-999f-1119d7ee97f4Filesize
2KB
MD5ce02ea2a3f39faae93395235bc25ca4f
SHA1f0965534ccaf890b6f2acb02ba5cc004eefa2f19
SHA2561e9ddee429da4a16996af98f5af96a5695024c4490080f09d53fbadeddbb7709
SHA51212df01337501721062498c754710d133a689aafe608990a2841a5976d49f44ff285308b591680c5b923516e690310850b50321d5ec4c8dfb7529e1c73843b8a2
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5e616e802c7c321c0f3b5af7c3f302fad
SHA16816a8b855036529e51b93b3b4f351ff035c5033
SHA256683458e127a2906bf57c930872539c719ff648242fb13fc917511984d6769806
SHA512440da6fb1b59e7e3a828144688086fcb1009f27410ec65a208a8a9cd084375f9a9e4533259addc80c524eb12227d4136f9c8c3cc50f35cdba13ea63641e709f3
-
C:\Users\Admin\Pictures\0rBtLEBslFq4ZgEjUBBIBmOZ.exeFilesize
5.1MB
MD58b257bb1fcf58b09d5e1fcaa1ad34b2d
SHA12f6170882dc02b79b72c1f8acdfd3306c4753ba2
SHA25661b2d2bc02577247df9631494e21f438cf0171b54a4379decd2f64ac0a26bdc5
SHA5120876e31b284c1bb43849673616659e3b7d4866ef2a4bc0b1e6d26006bbca36060f69db66a08282c3899adc1d8af9e721e5d9467bb00fa6b1aca0ebb8eafe482b
-
C:\Users\Admin\Pictures\DAjSSsSxQHnBzUH5B7eR65uu.exeFilesize
461KB
MD54331154c78895260f828671c5e618207
SHA116a8371d2dd052f154786c223839e5863cd2a1c3
SHA256fd6dde79363793f8992a5878727db5f72c504fb67f07f2cd04c23acff3a86692
SHA5121cc52f07c3ae90302616067c13c10f4c40008846e005bc2682d82e3fa68be57c0493bc270898c3a59e759b562e600b57d70c30326a117f6b1f50ea3c1ecccefa
-
C:\Users\Admin\Pictures\LNo2XzCd6giBj6q1jJ66dJwW.exeFilesize
4.2MB
MD5275c528d464e32e28829e44120e8ef81
SHA112415443bd9ff68aff934eaeabec730de19469c8
SHA256d378a92fae120b725634f69a615c3e706d6c21b107dc4b1bd514a254a1b0d640
SHA51242ee3b35f07db97496e9cab4398a4b0d9cd7794bdfa069a7fd2814f1cd2173b8c836ea0305b397eae7051ce29320edc49115a7dc4057ef2025f99d7525920f99
-
C:\Users\Admin\Pictures\n9znw7pres4tUbsyhxyqgiA3.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\scsOnnsio5PDPoT5V1vLIB2s.exeFilesize
4.2MB
MD53953bbad77cdcb9d5af2694eed7e6688
SHA1f965b69eb36d1fbdfb7dfa8c26ba959f395b3223
SHA25662206e7cb02b4fe03c535aa4daaecfa46b42dbd28a756471e50784b7622cecaf
SHA51294a5033ede92683e063829c5a8f2d720c919d1320bf4db18cc9a2e2a69387530b4afacc73cf987695a01c09acba1169eea77a0ff269b41698147cd64e64a7d38
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5ded923608e0c1a64ee39b7a09b7f8629
SHA19140fc51e1cfa580941accabb9586622c278dab3
SHA25615df7e8886dbb0f7e43f792416d5f8122e276a1b50a3f9ca4c5e326dc2eac62b
SHA51206b4d11ba1a218f654679adb5fd0753b85213bb6b035b1ca3d57cd5735017b830c17a4858b9287bb28928ecddeb412c91952d148406679f10e06e1958d1788a5
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\Temp\631914.exeFilesize
2.0MB
MD55c9e996ee95437c15b8d312932e72529
SHA1eb174c76a8759f4b85765fa24d751846f4a2d2ef
SHA2560eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
SHA512935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b
-
C:\Windows\Temp\cudart64_101.dllFilesize
398KB
MD51d7955354884a9058e89bb8ea34415c9
SHA162c046984afd51877ecadad1eca209fda74c8cb1
SHA256111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
SHA5127eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2
-
\??\c:\Users\Admin\AppData\Local\Temp\pc15n3mk\CSCE3E6E7B8B6E4847A4BAE4413E96D248.TMPFilesize
652B
MD517316bfaf9e2555957cd64e63d00eafb
SHA130c8595cf0a98594373a4031db4b523bc526dadb
SHA256ed20b2e6f5d44401de0bd9ac0de88838aa3543236f27f3394d1626abc667a83d
SHA512b1c82e2f91876b37e2e59ba9debe49ed820d92c195b73652c76dff1c3fe821ce2726dfe64e8ffdad39959c9c4760dd314da57dfd5c3099670d5b032613faeb19
-
\??\c:\Users\Admin\AppData\Local\Temp\pc15n3mk\pc15n3mk.0.csFilesize
4KB
MD5d784666bd143ad91647f8e799749e071
SHA1706389c04825f2e12a24d00f67ea7140cdccf4ef
SHA2563bd5920de953fb49e0aec7994f20bcd50d304acf5a3f4f3b23d7408a6cb41ac6
SHA512c5a4c8817e19df8ad88aae8b9caa243235b23c31bf493704cddcb46e88df203b5fc5b03b535b06bade9816782828b7ba8c5fe247384c344677e570a15bcd07ac
-
\??\c:\Users\Admin\AppData\Local\Temp\pc15n3mk\pc15n3mk.cmdlineFilesize
366B
MD52ab50a3b6c0578292b3ab0cf4890eb95
SHA15b1c2450c0c8b14690004200d0524f0179f74105
SHA256a99e255fb5c390fe19d08e883ba44bb4e2299b0928ae184792be18ff1b538f60
SHA512145a5f1cf5e40ffe5d34a318c905f64be12f5e670f9a700702965af42df59a1134935457808030cc696e3a75872a1c6845fa77d5ebcc3e76a0a10705b592a2a4
-
memory/8-500-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/488-736-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/488-932-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/612-291-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/612-364-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/612-288-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/748-49-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/748-54-0x0000000001290000-0x0000000001291000-memory.dmpFilesize
4KB
-
memory/748-55-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/748-52-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1188-90-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/1188-81-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/1188-89-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/1188-266-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/1480-0-0x00000000003F0000-0x00000000008B2000-memory.dmpFilesize
4.8MB
-
memory/1480-2-0x00000000003F0000-0x00000000008B2000-memory.dmpFilesize
4.8MB
-
memory/1480-4-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/1480-3-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1480-8-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/1480-5-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/1480-1-0x0000000077BC6000-0x0000000077BC8000-memory.dmpFilesize
8KB
-
memory/1480-7-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/1480-14-0x00000000003F0000-0x00000000008B2000-memory.dmpFilesize
4.8MB
-
memory/1480-6-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/1480-9-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/1716-77-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/1716-87-0x00000000035A0000-0x00000000055A0000-memory.dmpFilesize
32.0MB
-
memory/1716-84-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/1716-221-0x00000000035A0000-0x00000000055A0000-memory.dmpFilesize
32.0MB
-
memory/1716-76-0x0000000000E60000-0x000000000101C000-memory.dmpFilesize
1.7MB
-
memory/1716-78-0x0000000005A50000-0x0000000005A60000-memory.dmpFilesize
64KB
-
memory/2008-575-0x0000000000400000-0x0000000004067000-memory.dmpFilesize
60.4MB
-
memory/2008-208-0x0000000005DF0000-0x0000000005E5E000-memory.dmpFilesize
440KB
-
memory/2008-207-0x00000000043D0000-0x00000000044D0000-memory.dmpFilesize
1024KB
-
memory/2008-807-0x0000000000400000-0x0000000004067000-memory.dmpFilesize
60.4MB
-
memory/2204-929-0x0000000000400000-0x0000000004043000-memory.dmpFilesize
60.3MB
-
memory/2204-878-0x0000000000400000-0x0000000004043000-memory.dmpFilesize
60.3MB
-
memory/2240-219-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/2240-220-0x0000000000BB0000-0x0000000000C02000-memory.dmpFilesize
328KB
-
memory/2240-222-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/2384-53-0x00000000029F0000-0x00000000049F0000-memory.dmpFilesize
32.0MB
-
memory/2384-45-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2384-46-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/2384-56-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/2784-102-0x0000000000520000-0x0000000000572000-memory.dmpFilesize
328KB
-
memory/2784-147-0x0000000005A50000-0x0000000005AC6000-memory.dmpFilesize
472KB
-
memory/2784-154-0x0000000006210000-0x000000000622E000-memory.dmpFilesize
120KB
-
memory/2784-160-0x00000000065E0000-0x00000000066EA000-memory.dmpFilesize
1.0MB
-
memory/2784-104-0x0000000004EF0000-0x0000000004F82000-memory.dmpFilesize
584KB
-
memory/2784-103-0x00000000053A0000-0x0000000005946000-memory.dmpFilesize
5.6MB
-
memory/2784-158-0x0000000006A90000-0x00000000070A8000-memory.dmpFilesize
6.1MB
-
memory/2784-114-0x0000000004FA0000-0x0000000004FAA000-memory.dmpFilesize
40KB
-
memory/2784-125-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/2784-163-0x0000000006580000-0x00000000065BC000-memory.dmpFilesize
240KB
-
memory/2784-162-0x0000000006520000-0x0000000006532000-memory.dmpFilesize
72KB
-
memory/2784-164-0x00000000066F0000-0x000000000673C000-memory.dmpFilesize
304KB
-
memory/2784-101-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/2932-152-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2932-148-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2932-151-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2968-824-0x0000000000400000-0x0000000004067000-memory.dmpFilesize
60.4MB
-
memory/3092-149-0x0000000000810000-0x0000000000884000-memory.dmpFilesize
464KB
-
memory/3448-242-0x000000001D730000-0x000000001D83A000-memory.dmpFilesize
1.0MB
-
memory/3448-161-0x000000001B1E0000-0x000000001B1F0000-memory.dmpFilesize
64KB
-
memory/3448-159-0x00007FFD45150000-0x00007FFD45C12000-memory.dmpFilesize
10.8MB
-
memory/3448-253-0x000000001C060000-0x000000001C09C000-memory.dmpFilesize
240KB
-
memory/3448-157-0x0000000000340000-0x00000000003CC000-memory.dmpFilesize
560KB
-
memory/3448-243-0x000000001B090000-0x000000001B0A2000-memory.dmpFilesize
72KB
-
memory/3680-729-0x0000000140000000-0x0000000140AA0000-memory.dmpFilesize
10.6MB
-
memory/3680-731-0x0000000140000000-0x0000000140AA0000-memory.dmpFilesize
10.6MB
-
memory/3680-724-0x0000000140000000-0x0000000140AA0000-memory.dmpFilesize
10.6MB
-
memory/3680-726-0x0000000140000000-0x0000000140AA0000-memory.dmpFilesize
10.6MB
-
memory/3688-847-0x000000006AA60000-0x000000006ABDD000-memory.dmpFilesize
1.5MB
-
memory/3688-934-0x000000006AA60000-0x000000006ABDD000-memory.dmpFilesize
1.5MB
-
memory/3688-734-0x0000000000400000-0x0000000000C2C000-memory.dmpFilesize
8.2MB
-
memory/3688-836-0x00007FFD66040000-0x00007FFD66249000-memory.dmpFilesize
2.0MB
-
memory/3688-818-0x000000006AA60000-0x000000006ABDD000-memory.dmpFilesize
1.5MB
-
memory/3924-854-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4464-264-0x0000000000640000-0x000000000066E000-memory.dmpFilesize
184KB
-
memory/4464-277-0x0000000073580000-0x0000000073D31000-memory.dmpFilesize
7.7MB
-
memory/4816-865-0x0000000000400000-0x0000000004426000-memory.dmpFilesize
64.1MB
-
memory/4908-808-0x0000000000400000-0x0000000004043000-memory.dmpFilesize
60.3MB
-
memory/4908-670-0x0000000000400000-0x0000000004043000-memory.dmpFilesize
60.3MB
-
memory/5080-19-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/5080-18-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-22-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/5080-821-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-21-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/5080-24-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/5080-25-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/5080-20-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/5080-88-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-23-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/5080-115-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-265-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-17-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5080-613-0x0000000000940000-0x0000000000E02000-memory.dmpFilesize
4.8MB
-
memory/5244-870-0x00007FFD66040000-0x00007FFD66249000-memory.dmpFilesize
2.0MB
-
memory/5244-866-0x000000006AA60000-0x000000006ABDD000-memory.dmpFilesize
1.5MB
-
memory/5548-913-0x00007FFD66040000-0x00007FFD66249000-memory.dmpFilesize
2.0MB
-
memory/5548-911-0x000000006AA60000-0x000000006ABDD000-memory.dmpFilesize
1.5MB