Analysis
-
max time kernel
214s -
max time network
225s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-05-2024 20:06
Static task
static1
Behavioral task
behavioral1
Sample
osurx.exe
Resource
win11-20240426-en
General
-
Target
osurx.exe
-
Size
20.1MB
-
MD5
3fcb67a0a6291be47899d929876320bf
-
SHA1
2210fc1708fe193911b80a469813effeeaf76203
-
SHA256
adc1bbfadcc79258c378134dc9f3fb65366df6d7bc81a3e1fe79d3d9d57cdab4
-
SHA512
9ba51e490f7bfd32f4edc5ee7ce10abf1d22f4914b64cff8bef22dd9513ada0c5a3c901c94548f24fb812a2d522ad4fda7dab0220d64296587985080fa1f8674
-
SSDEEP
393216:KWMzd6T5VDF/mshj0Ob93ZWXqa7V4LCHmr7crNMj:KWMh+5VB/mshHb93ZgR4L0eOMj
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
osu!install.exeosu!.exeim.exepid process 1944 osu!install.exe 4384 osu!.exe 3288 im.exe -
Loads dropped DLL 64 IoCs
Processes:
osurx.exeosu!.exepid process 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 4384 osu!.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/3388-1479-0x0000000016CE0000-0x0000000016CFC000-memory.dmp agile_net -
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs
Processes:
osurx.exepid process 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exefirefox.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2551177587-3778486488-1329702901-1000\{4C585455-8908-4AB6-9D1B-8C898A8E14DA} svchost.exe Key created \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\osu!install.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
osurx.exepid process 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe 3388 osurx.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
osurx.exefirefox.exeAUDIODG.EXEosu!install.exeosu!.exeim.exedescription pid process Token: SeDebugPrivilege 3388 osurx.exe Token: SeDebugPrivilege 3388 osurx.exe Token: SeDebugPrivilege 2176 firefox.exe Token: SeDebugPrivilege 2176 firefox.exe Token: 33 2568 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2568 AUDIODG.EXE Token: SeDebugPrivilege 2176 firefox.exe Token: SeDebugPrivilege 2176 firefox.exe Token: SeDebugPrivilege 2176 firefox.exe Token: SeDebugPrivilege 1944 osu!install.exe Token: SeDebugPrivilege 4384 osu!.exe Token: SeDebugPrivilege 3288 im.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
firefox.exepid process 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
firefox.exepid process 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
osurx.exefirefox.exeOpenWith.exepid process 3388 osurx.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 2176 firefox.exe 4428 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2076 wrote to memory of 2176 2076 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 3116 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe PID 2176 wrote to memory of 5004 2176 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\osurx.exe"C:\Users\Admin\AppData\Local\Temp\osurx.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\im.exe"C:\Users\Admin\AppData\Local\Temp\im.exe" 2856 4384 C:\Users\Admin\AppData\Local\Temp\\a.bin 33882⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.1572412321\2082300940" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af9e66b0-d7c7-404b-ab35-386c09bb7b52} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1848 2694c523758 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.1671238459\1907969765" -parentBuildID 20230214051806 -prefsHandle 2360 -prefMapHandle 2348 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {473ebeed-caa3-4de6-a75b-83d0af5cac9e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2372 2693f889f58 socket3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.2029644884\151884907" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 3020 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df28aa9f-e525-4fbe-b0d5-0ed7144e9692} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2912 2694f506b58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.1823874391\72992071" -childID 2 -isForBrowser -prefsHandle 3608 -prefMapHandle 3604 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dafb5c8a-6b09-4d8e-8063-ae9c3511e0bd} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3620 26952062e58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.981522523\1715763770" -childID 3 -isForBrowser -prefsHandle 5140 -prefMapHandle 5136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d498230-050c-4a22-8993-37765154b405} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5128 26953ecd258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.1226714183\354064512" -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5340 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1346ed53-b1e7-4edf-8193-b610bc62eeaf} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5324 26954b0e258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.658194681\395967034" -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5520 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af1b0427-dc5a-4d2c-9601-c05c694f1da8} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5500 26954bbb758 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.7.854484361\227521381" -childID 6 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dfc65f7-02c4-44d5-a25b-93488619d09c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5976 26955bdfc58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.8.157017601\1762029168" -parentBuildID 20230214051806 -prefsHandle 4416 -prefMapHandle 6172 -prefsLen 28096 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97c6e0c1-e864-469d-844a-8467be4155ae} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3916 269534edf58 rdd3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.9.67923013\300862050" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 4952 -prefMapHandle 4948 -prefsLen 28096 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9be518a9-1a66-4ea4-84ad-b4dfc04f5a5c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2976 269534ec158 utility3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.10.1237117324\1231306194" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 6220 -prefMapHandle 6172 -prefsLen 28096 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f9ad5b4-a998-4fba-95ef-a742aa33e346} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6232 26953e3f858 utility3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.11.1455227450\1578521950" -childID 7 -isForBrowser -prefsHandle 5228 -prefMapHandle 5240 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40249c86-83de-429e-a4d0-1b50f4ac15b5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5164 26953936258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.12.886316967\1635586287" -childID 8 -isForBrowser -prefsHandle 10736 -prefMapHandle 10748 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93d78469-3ef3-49f4-a4ac-211270dfb29c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10728 2695115a058 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.13.838515872\509575392" -childID 9 -isForBrowser -prefsHandle 10588 -prefMapHandle 10584 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2a9e4d-ed78-46d4-8e6a-9bc9c25c0cb0} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 10596 2695115b258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.14.813557557\1184854939" -childID 10 -isForBrowser -prefsHandle 6424 -prefMapHandle 6252 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc28340-24ca-4d19-8377-4921be012824} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 6420 269572bf258 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.15.1189989294\914511562" -childID 11 -isForBrowser -prefsHandle 6132 -prefMapHandle 6212 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cc610b0-15ee-4469-9834-dd3e3c4d90d4} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7956 269572bda58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.16.694391343\1105830172" -childID 12 -isForBrowser -prefsHandle 10740 -prefMapHandle 7084 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aba42adf-3f1a-4837-b20f-96d224e534b7} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 5692 26957799958 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.17.1001696673\885181471" -childID 13 -isForBrowser -prefsHandle 9220 -prefMapHandle 7440 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9174c2e2-0fe5-47e0-a9fa-025a7d24af1a} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7628 26958018a58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.18.2018276564\1548131556" -childID 14 -isForBrowser -prefsHandle 3636 -prefMapHandle 4876 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdb9aa87-f945-40b7-96fc-15b8ffeb6460} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4680 26958341158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.19.538658433\650234392" -childID 15 -isForBrowser -prefsHandle 10204 -prefMapHandle 10200 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7257613-2af4-4b53-b188-c48c0a2c0fd5} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 7452 26958341d58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.20.1914186614\2013741123" -childID 16 -isForBrowser -prefsHandle 4420 -prefMapHandle 3812 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a606a10b-4894-4ac5-abaf-6ea665947953} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4380 269582e3b58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.21.1261717604\2105204676" -childID 17 -isForBrowser -prefsHandle 7684 -prefMapHandle 7712 -prefsLen 28224 -prefMapSize 235121 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ace8bb-bab0-4218-9845-0c2d8fd68c08} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 8332 26954b9f158 tab3⤵
-
C:\Users\Admin\Downloads\osu!install.exe"C:\Users\Admin\Downloads\osu!install.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\osu!\osu!.exe"C:\Users\Admin\AppData\Local\osu!\osu!.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDBFilesize
765B
MD59f3f8403dd7890d14eeffa39807cc22b
SHA16fe7624cc861a07f86934c9eac6e725fdf855db2
SHA2562f647aba54d9fc4215cd907f22f716c6e23e5ced1e2c3d79e52d6823e867b301
SHA51226cfa2bd6f9b9578ac0524efe7e5ce39ba2eb10dfb6b9a9391f7eec64a4280ef726e0254b3c228fd91356c9d0ff2f5e306ee9da62748471172b15d316bb5034e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926Filesize
637B
MD5b0330f84b862b4690aca84cda7c77b5f
SHA1c3793e30b5e3f96d98cbcbbb7d67890ee252250c
SHA25685357b17915ea61d8cf64a21d6bfed2786ea5a401387e0c8cf4d6f95b8573f2a
SHA512091a5ab6f45a3740f8d04e8c9af265d1a69b9a2f8b8205035ec878d278199fd83429902acd16a42c7d60e6991399d6c9165bb665e619e00b8f0eceb30e11be31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
1KB
MD5e16854fbde5af5baa52f1fad5d78f019
SHA14880314a303ccd0c4fe465414e76ade84370cefe
SHA256fe33a7340cb794a32d3dcd1202f63c0ea261f7b117d7a5fd4b4382c73be2837c
SHA512017099968630c9dcb46dc69e56753ec768dd856797f65f5955285bd5c4998f24c8de7c985d82d2c4689392454d67d8cdb59e0d2c6074b01cc06a4775c9b31878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDBFilesize
484B
MD51b1019eeb2c841b99c977f3c83647a96
SHA11e541972e8977e2504fd6928a62da626731ed130
SHA2560d1c70a499f02f9cc15415b77326eefad8ba33157a68f4cadd11fa16c122315f
SHA51213469fcfafedae88ae1871e3d394fa73be91e8ec1d908ba463501bb9e3fdcb4d832e4c1c65bb9114cf27b376231cc4bf0de641e3ad81abd8874f66ee56c6d4e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_C99E84AF904BD8598CB3FED576528926Filesize
488B
MD5f0b3b2b2de449b48a30fe9ff2c6bbc63
SHA17bd529d1fe5d862039fe32ddaf40fcd702ab5965
SHA256d62f124caf785e82a7b4e3550ebb117ba7f467f21b57faab1171253d7bd94be0
SHA5122d8946eababf135aadb501f05039c0b506df0e622cdae723b7830e8073a9b82a9724f22873fe0b707aa33b3407437647a29b89a05fb76f1ec39a5a53c92244c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
482B
MD597fb425d11e210ad777ff2909eca69ef
SHA18de11e2c63d74e9fbad2660c981813bc03356633
SHA25600110144ebbba159c6bd32e88221e262ceeff8dd93745b03536374f13fd1c9c4
SHA512ef14b4efaf5e263f49d09a5e9938b0dc6d7306e2b7f7fccf0c5f6a7850ec047b6314c3924dbb710a37013667b044334cebfc305cb53d26768b2d733c596e01c2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\activity-stream.discovery_stream.json.tmpFilesize
23KB
MD5329eeea8d59fcfa74eb7aff1869569ea
SHA124dcfb1f89fea8fa1f5489af3beb75153c6f216a
SHA2561863dedbefdfc2bb2f61d18edc25403d1f97aaa8045d255ef29ab0d8fe4ecc73
SHA5126c11d48fdbea52c3efc3a8fa04f2e7725909efd12c13c1d4b6e84e8c76c8076270e5839dc5c144e5f4227eb1bef1fc227c11f325ee3212c2692c0a96c0f74f1f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\doomed\11044Filesize
20KB
MD51e8b2879ba7e3f5225491201fcfdbd7f
SHA1ebd80bafddbfdf960a77e0a483af07648efe934f
SHA2560eec004094968f465f2a269828e8496d12d170a1153c51950eb9605e7cdd0df0
SHA51213cc84e7b449a230c1f481427ad46f58c32ab00daf1fab2bb072aaa7654d81105a517bbb83f73e96ac3ad01a790bd785311baf8a68362ff8c3bde0aff7490782
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\186EC640AECE54B44244A4F358D6F84ED427BA9DFilesize
210KB
MD51fb426cfff468916bb4cfcb8ac6c84a6
SHA14ad000322e997c99408778bae512a209d903fdd5
SHA2566b3a3c29a48dd9e23fb02510c92f2ee1f205402d20ac6d243286c85fd6f725ec
SHA512a36c2db82d41707799402d7d49256488b13a588e365e8c8612a7d4c6ae154c8b83b71eab542d2335862c0703121f4023b4f83eaed74e3443abd442c17dd87205
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\1F4EE80161108BE95F29EBD42E65216A6DE85E3DFilesize
96KB
MD506681e4b03228fc1687f9931f5ce1c70
SHA126067f93cd66a631c5668c6ea34dd776dc191f36
SHA2562b383b5d6b549029a7e7b2a0a39dcf3ba43b731353b625a89cd532c0e3ef7004
SHA512b14ede14cef2d10898368565ce33f249324096e1c2c9e28120ea76daa39da3cbb76b646a1e29a592db9435d19e06a2de7a6779b52c59693aa1cd756f37daa313
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\3E60B1F6F25CFE891C65390EF158CF1420907CD8Filesize
60KB
MD55272400f92431b91bfcf6dd8540e5727
SHA198e2454e0dbd658ad3969210379f19a9561a7b4d
SHA256dbf6831cf227e773ae5a6391906f09370f2ccf3ff48290c6bf7a720baeb2f3e8
SHA512739b1cdb63e5edacceee2c7b74213de57bf0181c02a0d442805032622fb8d32fa8ccdcfb169fee4409bdb5e1cc46c0e3f8df5b0335ad320f95c3fca8edc3158f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4Filesize
1.1MB
MD5b68fe94a5b8edf71ceed41ba6cd3ab11
SHA12bb05a30fa6ef286883b6b205974961e3a396a38
SHA2564aedfd31540e4eddf108e4fc7df7aa3041798f95cd75bb9d65d425bca6f372fc
SHA512ef2a39df2a84e45fd678c50c08a0e4b8fa096ef3c2586a0ea264b106afe6d0b2b1f7146305ac38e1fe65208570a016e57308f1c1581c2620195f0e34bd1563c0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\5AE6D89F9E02E65CE57A707F37A56F985F9BE4BAFilesize
68KB
MD553aadf57a02f1bc8512fd3386cb440c2
SHA1684ab8205494222f7c3d024b612d1b871287b61d
SHA2566a034db77c88d9578cb006fb754ed85602fef3fb8e62cfb5a5d932cbe13f805b
SHA512dba0c8315915ee4f01a93c427e96d0c5d4b44f1cdb361918e3e15645d8787207cdd98668a4b4d977d4901d248fe584fa851d4e7f488a8bcad97fbfd5d852842f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\80BB96996C8133B0FE5E0D6E5EA21B26135E8EA2Filesize
110KB
MD53d689dd30a41d290eb70363a28733403
SHA1489ca02e267a8c3cde76838d3730c0c34e428e7d
SHA256aa2798c3859d01f18a97b31b350faffc70491d5f19c9f23e0c8b3f8f6e3d927d
SHA512d3e4194dbdf78eca54aed38c1000eda22a8cf93f59b1ade14f7d5c9df8cbc67f55d0609df42986d4f6f0b0c6460ad3b3a0b6661530582d5d904b460064cd9e97
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6Filesize
2.0MB
MD5517d817484cc03e96931435e9920ca6b
SHA1542c3289e6d0c65407b8c885c0b39cd03f213785
SHA256f5dc3bd579b41d820fa13afdbc930775612d8d56cb5e10634f2efb27c720e491
SHA512c1e55eaf96d0dbf555ac92f55e93a15c3fa19e40628193b8eba3807d930a17dbc4f56118f9dc4ee49facca4335e67256de52ac63d7854ac18a42533cddfc1609
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\cache2\entries\A18B323E560F819736EDD0F625CF420E81E8431EFilesize
47KB
MD5e63318c6ce4cc633cd2142bf0eae7cb8
SHA185850c379384d597fcf2c52a79f50034a3d65dcb
SHA2563001de42a6ca24fe5390a86639e73805af0a380059b179924e7b335a94348132
SHA512b78ce275c163b1bbce12e36b1176d5ec302bd4baea327f5badbe2abdd5234b82c543dc649b33b70834acae30c54eb3411908c05a6d483c33a3cb807bff3ee037
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\prbn7a8y.default-release\thumbnails\447c1d819532470f427483b5c2ad32a6.pngFilesize
70KB
MD5e83fe4d8787682f133869c1ac73592dd
SHA13abd202280c6f86cccc357c8ef2623baf368ed1d
SHA256798a45b75a5e8f2bc26c239693bfbb926117a57b77d85e95f06e36fac0fbdfcb
SHA5124a6a7ceaa6ac4c2bd6d45ca324ce0b612a9199ff182d3a7dca1c623cfae90410f30e11c23a63d87b344533838144183213f38c1df92b027d7ae8d6fbc6094bdd
-
C:\Users\Admin\AppData\Local\Temp\a.binFilesize
40KB
MD5af753d00642bbdb68d96020f515d21ed
SHA1088a992eb46190f9d7a5742ca0bf442f5975ee29
SHA256788074170b2f5ad79f00adf8254fc564ae3d7ab4217aa10ade4264462ad3519d
SHA512575fbd1ac2ed1fda9c73310422958317fc3c4f71ca675c873624ebca490b948b5a083bd796fad04fa83eac0fef589865c66b806b5b7cbbc7d37e0f9af8209d9d
-
C:\Users\Admin\AppData\Local\Temp\evb585A.tmpFilesize
1KB
MD5251e9ec6834f5c7a36a732f25a54fc75
SHA15a141dc35d5bfb97fe5a663e8868c83696173a88
SHA256f5aadbb31fd7e0cbbee98fa82135f569b966d4839bea6d148ff63b207174902f
SHA51273d0376aa9337e8c07b6840f76e5eca8967c14626627c3065ce0b77ab7319544c355c86caf81447e3cef8891cf4254c38b4c051eacb80791883735203ee094d5
-
C:\Users\Admin\AppData\Local\Temp\evb589A.tmpFilesize
1KB
MD55f9c731c58960a4dd5183702813d4574
SHA1580f37fbf290ce66ba0065d41f4d7c5bb0378549
SHA256d2f19945688a269f08efdd93dd61a9558415d145f04bb75d013446dff0e54d6e
SHA512cf2adb523ad2c28be1dd1809602fda6a54c89e4633cf3c964069613b20a458c91e0599170f425c73f4711f35b0956d4ab142eafa501ada17c8e7b0a02f1c3d50
-
C:\Users\Admin\AppData\Local\Temp\evb6293.tmpFilesize
1KB
MD5a23eb4d609a432cfee41221b2588794c
SHA15a2f467b8a42ddc6ecca0e3829f5bc64c20d0f85
SHA256d1f77741dd17220196fce44bff80f5264525bea3c9f9ea07a4ea14ab328a1cc2
SHA51227e69f6631d8bc651a7465a6e02e6f276d13b2bdb943760705725a0893e4c616f17b150ba993be0805359cadaf67b55397a8bc56295464035c833f56e420c9c6
-
C:\Users\Admin\AppData\Local\Temp\evb62C7.tmpFilesize
1KB
MD54e38c7b774dc14991614a36cb923536f
SHA13edc69841c239f6bc12ea40546558f293e021447
SHA256a39c8b9629fd354b0d15e8ea8811cfbe289e7090e0b10528c9117a1d2a859bb9
SHA512de2872f36eaa955feb42fcaeb260aa02d6ca6e1a16e6e341483c5a7899fd77c8ac56fe748800fecf7dbce933e219d3409eef04144de4509be4ad72655cfd24af
-
C:\Users\Admin\AppData\Local\Temp\evb6587.tmpFilesize
1KB
MD526fc5802d3da1539a5b4a4e9d1c0be94
SHA14451ad10ddd3a9910f3706e957ce32ae142fbf58
SHA256d1781882a8f4ed09d0f0237271a72522b7679aca3112755c75f9b60e5db18840
SHA5125dd81590049e6574e3e1325b637a4f2fb62bfc77635f8ad86b6125ff2a91f04a88182cc896e855b3054ed281545c6985e0db05c36ed55f0819ed5260ab27b44c
-
C:\Users\Admin\AppData\Local\Temp\evb6942.tmpFilesize
1KB
MD5a8d20389688eb5bb2217374daac56135
SHA184206edd4f55aeede510e916137c9f3c49a11ff5
SHA2565a1e88a2bcb9de8eab56724555cad7edf1c35f5a82782e7cd9d953b1e4206172
SHA512a1b5db7e0ddd8f354e1f4d1eb58f5b73af8e1028b7aa3dcf2802dd4359c3e0331a2a095d1e5bda1249c2869ad302175101401483b0fa2ff41246d6ed26ca8978
-
C:\Users\Admin\AppData\Local\Temp\evb6973.tmpFilesize
1KB
MD5f0425b8ed398010d2c94792f8f898715
SHA1430effc2cea89e3f888c62d1df06fe9fa5d858cd
SHA2564c56ed6a4fc6c769f4e9df43bbc3fec94170f6451f55b946cf7449ec217ae495
SHA512f0489d7e62b9c779daa546f3d18266a3aef0d37ef752dfa082b9294b5fe98e6154b666a7e488e4c8c5576e8c800f0ea06c3b90e038628301e840dcee3c0ac26f
-
C:\Users\Admin\AppData\Local\Temp\evb69D3.tmpFilesize
1KB
MD5fe682cb37293e5b74db6c033ed169a4a
SHA16944ffda86656a542881eb6133cec42c6f376216
SHA256326a7920c0f6c80013bbf22b61b3767b3478a6d00f9fa587d9b816e0d20c74c3
SHA51223c780847eb9225526193d23152bb1bc1e3a94475076546c57f4731adef45b28e053ec6cfe14d151ea7e264467d9d029191766a4c35482f19a3d776d530eadc7
-
C:\Users\Admin\AppData\Local\Temp\evb6A42.tmpFilesize
1KB
MD5e67e1b46e10f426c16970df0e8efae58
SHA15c1aa2c31fc1b178851707baa2bf3dd457c347ba
SHA256667e13563ae447a53e7ab9b03e76e190cc91a4578fc3cbd912c5533c9f770b6a
SHA512f36d5bbd29469003ec109132c6a113ff7064195bc27399a2d0f873933011b7595f8fdb00c4eb83feacaa391d7115d5f2d8da8544ebc8bcdbdc5f2a219d6ef86b
-
C:\Users\Admin\AppData\Local\Temp\evb7214.tmpFilesize
1KB
MD5132b75f62813ba25fe493185a108d10a
SHA11f4eef1b5e2047afeba3ff6bf7dcfedaa8ad004b
SHA2567be8262e0bd4f1fb6b10c622322820307304f391a31191b892224c0ac2c27903
SHA51248d3c8232b99fd086424564d7b946d46255e57e085dc13afa069fc182fc75022a82d022207fd0a9830ebaf2966e856f99613abde801981c37c50ed309b90619d
-
C:\Users\Admin\AppData\Local\Temp\evb7226.tmpFilesize
1KB
MD5e5cb65f3af8aa02347029d440230bcc0
SHA1bf2e43b6c9909fcfbe8cba529f7c15697d0596b5
SHA25674c23a45997ab20761d96faef2b79520b1091399214666f624545efd99798cfb
SHA512a234402b64962c58a3a9e6660f0b67cd4b0437517507b239bf11493cdf8348921264c3ca79307a510dfad4ac50563ffd6d4a927536afcf54a0a194b80dbc92dc
-
C:\Users\Admin\AppData\Local\Temp\im.exeFilesize
457KB
MD513af4fab3355023d0f14b1f72b6934b3
SHA11095ce66f3c73683f5aa81cda438cb01f9aaa1f7
SHA2561fb0a49932cfcd8def83be1746eaea84fe5351fc016d00a0e7c7208c243a14d8
SHA5124c232cd15b417f34f088163b0bcef8ad4c3f99b51a295308dd8becca330a096f29d70a1fec0a37ef0dccea0d21a303651cc401eaffb18f7e192408aeadd53fb0
-
C:\Users\Admin\AppData\Local\osu!\Logs\update.logFilesize
370B
MD5816a53efc790f1803c18cdf171eec4d8
SHA10dd75eb0f6bb91b543450a48a17c21c6ad34edfe
SHA2567b92cec4d22289b8ee37064eecdfafcd7345d84e3b2a01dd56b6bd7ad77fde9a
SHA5122a3e2a4b9a5fe6f65ab931eb6cbc89a4ea71ee5e9c00a1467f2ce655956e6dc3d16df33322a56adf1c84652be954bdee03e46dbd1bee9f277db00a3038e668d8
-
C:\Users\Admin\AppData\Local\osu!\Logs\update.logFilesize
2KB
MD593ef91a6a7e07e30a8c67e6f862cec5d
SHA13146ad1d454ce555f20166d39b42ca55b93c89a1
SHA256b9fddf013fde76d42b1f1d3ec227dbbbc06dea8062d3fc981f9eb8c6006709a0
SHA5128d954350e9448dad73a4bccf944e8cbbaff4bb9d09f1ffadc26ae66be5878ec1e62614a1334b1f8a830ca1948e2354b1a432699fe0a612d11e3afd024a1932fc
-
C:\Users\Admin\AppData\Local\osu!\Logs\update.logFilesize
3KB
MD581b458ea24811c0d73eb0f555302bba2
SHA1d1d4e2710eb0c29dc4bc872e44604d35bdc5b467
SHA256adbc14dcde22f4ff93b22c3e6459602aa642e320680516ea326a0e339e8baa8f
SHA5127d675c2deb49eefa10e77e4c3f28206a9c17d11f4425c83f7cfd15e7fb980b9d1698086045e8bde97cf6a151e56b7fd455976f3d10782ad6d4e92b4793184778
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.jsFilesize
6KB
MD5761b0772f28dcd32844012233ed7cefd
SHA10397ac87fe7d4aeb91cfc2b8f54b2cc558e50f55
SHA2561d0583bc49223e15769f853ab1108bdbed3cc30439191087858c340c7efb5dfc
SHA51297d854fe3f9ef3c843a440b86634f75031d30e40da999a6ddb882051495e7a510b234382b42c997e042e2b8c7d50c74a7cc2b246872b898f7e80f18d5bb3d6ac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.jsFilesize
7KB
MD5bca1e66afda3a1fb8bb05aebd7d279f9
SHA1ff7cebf3e61f670bf130a5919dd2a549c07fb89a
SHA256214fc8424b2dd828540ff72044e6cd3418e167c721ed37c5fa7ffe7f8b36f3c5
SHA51253e1a173fe5b88ac4b194376940850cbc4bef3ecfec352cdba304078bdd3a781d765ea5a9259cc2f595f008a36367710a2e78238ec85bce1beba21b8d4188bc0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\prefs-1.jsFilesize
7KB
MD51d20e3e0018b9c5e28541bd72c542ef4
SHA12bd4f5731db044006f7b5f9a0161523e903952c2
SHA2562c16b9404bbf3e55950dfb6460f3aa8dc56df5710db61d7e58793e3a291b3690
SHA5128e550528246608e8869b0514cee7ff0b7f7e6ddb0c791c9e634db09476bb01f5142afd25d591a7c9c4b7ada4b3339631313aaec31d405b08e538dfb061ea103a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
4KB
MD5cf295ecd8e2055ebcc0c6057ee135ce8
SHA10d214ba0e8cae853fdabd75ea25256ad1df4b402
SHA25680f3c4a3ed93bb69516f02b661507c7c53f89a9fbbbb3e20a4fd6be6b7d083f2
SHA512c24c7f301a776e4aa2df3801be5579ecf62d1d38734faea6fb260357f12cbd1e841c4cd3dc933643b6fa9efe7bdd6366124652bfd75c17d595d07f8eb297b4ec
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
7KB
MD5793fb9913b3142d8e23235ced593907a
SHA123e0042ef1bcec7c3d215cd133faa97ec6c24b6d
SHA256e4683249c6bebbde50f82e7a081584bf3a60cb3d3bf0eebddc91b3b728938109
SHA5122d500b0c1f791b7546cabe19537bf55c43b42e2d210069c803b1c6e0c711da7ff7792d6518e9c1e72d7c7f120a8f128305e9cd89c0931a98eb2445fcf5260787
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD5266deba2874834fa246b1fc74b8b7131
SHA1a8cb93847443dfd891f0a4a31a2fe19fd6d115f3
SHA256a0bff770f432c0cfa794e365e21db0e90280f78e8ad56b066eb8ff602c03ceb2
SHA5129959fe920f45652f0b2ebaf2f1f5f147eaa7f61262dc13cc7f5977f71706062f97a44d9f22b01380608a049100536967d68fcf10f87444936fe3047d41ad1eba
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
7KB
MD5dbcd63e8bc46e008a92869f2560086a0
SHA14fc6006e27823e873ec42e1581829fa9d521790b
SHA256f067533d1d16c2648fb0bb21fa53435f3e69688939762ff0c208b957ee9cb6d6
SHA512ca9550951c0cc7f2390e7dbe1f3652a9bde67f0ced6cf8436e908df1aebebe3d530c3e9158e2ef2ee9850acddcf6fdb8147309eba5e7e9ae3fe78d808ddd896e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD500be482c15c7afcb4f9c8b89a3020aed
SHA13fc753d54675cc85ade0bf562de8216a9d042f85
SHA256d09e3ea2134d31753b568ba78f02a29e23c2ae12a92122bbbb4f0008b9143d8e
SHA512526ce93255249371a5c01f131b96aee4e5644f2e5f70888d9419ffe49aeb875035027e0275f87eaadb97a6eb0c7b31a238b4adbbfb3bdbbf4a0f3063f694aa6b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
7KB
MD5a8fd4a4e0d248d5dce35a4b1327b9ebd
SHA19e056e5d8f81347f1e642137858eda5328ce0b63
SHA256c17aebedfa6c9d2e2b7bf559d2b4a8162f6cf7350955095529917df59b3e5011
SHA5124975f3dda43f813956a2efaa507fd40f7e3a5b36bebf908257c0b2ba48fc6ed028bc401f18a849b68b9685118e81a1ca02d4d6fd69afaf9d0b2f55b14e148579
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\prbn7a8y.default-release\sessionstore-backups\recovery.jsonlz4Filesize
7KB
MD5b27578fdc2205e216510d33d7d1b89ad
SHA16c958cfac8b2e11bab95a21f74576d009cf087e3
SHA2569baddd18765261d94ffbff7c5dc3e84ca1a822580608e6e615e0347da7b4dd26
SHA5129d4a4c859d0affbef379b4b9f63b540bca71380043f8fc6be7228fc5587e771ef266a485a6054ddd1dff8bc4ebcf61f287986ca9cd362c6850466b95ad340b25
-
C:\Users\Admin\Downloads\osu!install.MRf_wOcz.exe.partFilesize
63KB
MD57db21c5233bce99f9bb4e70c6f05bd7a
SHA170d2785895441280a7f4193bbf112eef274bad25
SHA256c94f98d5ccd21dc8d864e1b89a7d4763a1e9bc930e73ceadae61e42a08b6e6d9
SHA5127021f05607ee80719228f0acf547a842978496ff0ae568f2f3297e82412a2517fd1845bde12ecf475c3639895e5e9fa0e5cd5786b4868d1ebdcc314cb3f8b7b4
-
C:\Users\Admin\Downloads\osu!install.exeFilesize
4.3MB
MD54cb6bf06b9475ca78e7920bb08f72279
SHA1fec977049df3a47082f8c88c825d433f3b769c95
SHA256c1f75dcd74cc6dbee961905532fa4132cfa3c4316d57c9c582a512c8e908ffd6
SHA512f1a736b16e3bf6381811758605e01ad17e0ff3d4f6c7caf4925b2d6caee8634226551f5330dfe9dc73b71092b1a88b27ff9fe084da7b092797f4532090e2c06a
-
C:\Users\Admin\Downloads\osu!install.exe:Zone.IdentifierFilesize
104B
MD5fcd2f00a73b3871def085b9b92f5f6e9
SHA11c246b61f507c306d9cac22ae2d76171183bd37a
SHA2568122bfd79ff36783cf35903c2662af26f004473d706c33a86e54b3dfed1585f2
SHA512d2e1ac9898f3f97539eb73210aebf6f101e64c031b0ca9f919c7d50765148b053e009492171e3f6101a300ff7f776b85d633cb836fc8ce20f3bac740264b65c2
-
C:\Users\Admin\Videos\Captures\desktop.iniFilesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
memory/1944-1429-0x0000000006B80000-0x0000000006BBC000-memory.dmpFilesize
240KB
-
memory/1944-1422-0x0000000000F70000-0x00000000013BC000-memory.dmpFilesize
4.3MB
-
memory/3288-1652-0x0000000004E00000-0x0000000004EBC000-memory.dmpFilesize
752KB
-
memory/3288-1650-0x0000000002500000-0x0000000002550000-memory.dmpFilesize
320KB
-
memory/3288-1651-0x0000000004C30000-0x0000000004CEC000-memory.dmpFilesize
752KB
-
memory/3288-1649-0x0000000000200000-0x0000000000278000-memory.dmpFilesize
480KB
-
memory/3388-89-0x000000001EB30000-0x000000001EBCC000-memory.dmpFilesize
624KB
-
memory/3388-1560-0x000000001D280000-0x000000001D3F6000-memory.dmpFilesize
1.5MB
-
memory/3388-245-0x000000001EA50000-0x000000001EBC6000-memory.dmpFilesize
1.5MB
-
memory/3388-262-0x00000000198B0000-0x00000000198BE000-memory.dmpFilesize
56KB
-
memory/3388-252-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-195-0x000000001E330000-0x000000001E34E000-memory.dmpFilesize
120KB
-
memory/3388-278-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-132-0x000000001E280000-0x000000001E28A000-memory.dmpFilesize
40KB
-
memory/3388-95-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-112-0x00000000198B0000-0x00000000198BE000-memory.dmpFilesize
56KB
-
memory/3388-116-0x0000000019960000-0x0000000019A0B000-memory.dmpFilesize
684KB
-
memory/3388-126-0x00000000195E0000-0x0000000019606000-memory.dmpFilesize
152KB
-
memory/3388-127-0x0000000019AE0000-0x0000000019B8B000-memory.dmpFilesize
684KB
-
memory/3388-124-0x0000000019AE0000-0x0000000019B8B000-memory.dmpFilesize
684KB
-
memory/3388-93-0x00000000198B0000-0x00000000198BE000-memory.dmpFilesize
56KB
-
memory/3388-88-0x000000001EA60000-0x000000001EA92000-memory.dmpFilesize
200KB
-
memory/3388-0-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-87-0x000000001EBF0000-0x000000001ED66000-memory.dmpFilesize
1.5MB
-
memory/3388-85-0x0000000012230000-0x00000000122B0000-memory.dmpFilesize
512KB
-
memory/3388-80-0x000000001EA50000-0x000000001EBC6000-memory.dmpFilesize
1.5MB
-
memory/3388-81-0x000000001EA50000-0x000000001EBC6000-memory.dmpFilesize
1.5MB
-
memory/3388-76-0x000000001E490000-0x000000001E49A000-memory.dmpFilesize
40KB
-
memory/3388-75-0x0000000012170000-0x000000001219A000-memory.dmpFilesize
168KB
-
memory/3388-69-0x000000001E3E0000-0x000000001E49C000-memory.dmpFilesize
752KB
-
memory/3388-70-0x000000001E3E0000-0x000000001E49C000-memory.dmpFilesize
752KB
-
memory/3388-65-0x00000000FF9D0000-0x00000000FFDA1000-memory.dmpFilesize
3.8MB
-
memory/3388-60-0x000000001E330000-0x000000001E34E000-memory.dmpFilesize
120KB
-
memory/3388-56-0x000000001E2B0000-0x000000001E2BA000-memory.dmpFilesize
40KB
-
memory/3388-49-0x00000000195C0000-0x00000000195C8000-memory.dmpFilesize
32KB
-
memory/3388-48-0x000000001D760000-0x000000001E216000-memory.dmpFilesize
10.7MB
-
memory/3388-43-0x00000000195E0000-0x0000000019606000-memory.dmpFilesize
152KB
-
memory/3388-39-0x0000000012350000-0x00000000126A7000-memory.dmpFilesize
3.3MB
-
memory/3388-38-0x0000000012350000-0x00000000123D0000-memory.dmpFilesize
512KB
-
memory/3388-37-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-36-0x0000000012250000-0x0000000012270000-memory.dmpFilesize
128KB
-
memory/3388-35-0x0000000012270000-0x0000000012292000-memory.dmpFilesize
136KB
-
memory/3388-1480-0x0000000016CA0000-0x0000000016CBC000-memory.dmpFilesize
112KB
-
memory/3388-1490-0x0000000016D80000-0x0000000016EBE000-memory.dmpFilesize
1.2MB
-
memory/3388-1489-0x0000000018990000-0x0000000018ACE000-memory.dmpFilesize
1.2MB
-
memory/3388-26-0x0000000012230000-0x00000000122B0000-memory.dmpFilesize
512KB
-
memory/3388-1479-0x0000000016CE0000-0x0000000016CFC000-memory.dmpFilesize
112KB
-
memory/3388-1491-0x0000000018C90000-0x0000000018D9A000-memory.dmpFilesize
1.0MB
-
memory/3388-19-0x0000000012170000-0x000000001219A000-memory.dmpFilesize
168KB
-
memory/3388-1791-0x000000001D2E0000-0x000000001D360000-memory.dmpFilesize
512KB
-
memory/3388-25-0x00000000122D0000-0x0000000012350000-memory.dmpFilesize
512KB
-
memory/3388-1561-0x000000001D280000-0x000000001D3F6000-memory.dmpFilesize
1.5MB
-
memory/3388-11-0x0000000012170000-0x000000001219A000-memory.dmpFilesize
168KB
-
memory/3388-1564-0x000000001D280000-0x000000001D29C000-memory.dmpFilesize
112KB
-
memory/3388-7-0x0000000010730000-0x0000000010796000-memory.dmpFilesize
408KB
-
memory/3388-1563-0x000000001D280000-0x000000001D2A6000-memory.dmpFilesize
152KB
-
memory/3388-1562-0x000000001D270000-0x000000001D3E6000-memory.dmpFilesize
1.5MB
-
memory/3388-213-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-1559-0x000000001D280000-0x000000001D2A6000-memory.dmpFilesize
152KB
-
memory/3388-1558-0x000000001D270000-0x000000001D2F0000-memory.dmpFilesize
512KB
-
memory/3388-1557-0x000000001D280000-0x000000001D2AA000-memory.dmpFilesize
168KB
-
memory/3388-6-0x0000000015930000-0x00000000159C2000-memory.dmpFilesize
584KB
-
memory/3388-5-0x0000000015EE0000-0x0000000016486000-memory.dmpFilesize
5.6MB
-
memory/3388-4-0x0000000012A70000-0x0000000013442000-memory.dmpFilesize
9.8MB
-
memory/3388-3-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-2-0x00000000003F0000-0x0000000002254000-memory.dmpFilesize
30.4MB
-
memory/3388-1-0x00000000FF9D0000-0x00000000FFDA1000-memory.dmpFilesize
3.8MB
-
memory/3388-1792-0x000000001D250000-0x000000001D276000-memory.dmpFilesize
152KB
-
memory/3388-1669-0x000000001D250000-0x000000001D27A000-memory.dmpFilesize
168KB
-
memory/3388-1670-0x000000001D2E0000-0x000000001D360000-memory.dmpFilesize
512KB
-
memory/3388-1704-0x000000001D280000-0x000000001D2AA000-memory.dmpFilesize
168KB
-
memory/3388-1767-0x000000001D2E0000-0x000000001D41E000-memory.dmpFilesize
1.2MB
-
memory/3388-1778-0x000000001D250000-0x000000001D276000-memory.dmpFilesize
152KB
-
memory/3388-1777-0x000000001D2E0000-0x000000001D360000-memory.dmpFilesize
512KB
-
memory/3388-1776-0x000000001D2E0000-0x000000001D41E000-memory.dmpFilesize
1.2MB
-
memory/3388-1774-0x000000001D2E0000-0x000000001D41E000-memory.dmpFilesize
1.2MB
-
memory/3388-1773-0x000000001D2E0000-0x000000001D360000-memory.dmpFilesize
512KB
-
memory/3388-1771-0x000000001D250000-0x000000001D27A000-memory.dmpFilesize
168KB
-
memory/3388-1765-0x000000001D2E0000-0x000000001D30A000-memory.dmpFilesize
168KB
-
memory/3388-1761-0x000000001D2E0000-0x000000001D41E000-memory.dmpFilesize
1.2MB
-
memory/3388-1759-0x000000001D250000-0x000000001D26C000-memory.dmpFilesize
112KB
-
memory/3388-1758-0x000000001D250000-0x000000001D26C000-memory.dmpFilesize
112KB
-
memory/3388-1757-0x0000000019790000-0x000000001979E000-memory.dmpFilesize
56KB
-
memory/3388-1756-0x0000000019790000-0x000000001979E000-memory.dmpFilesize
56KB
-
memory/3388-1740-0x000000001D2E0000-0x000000001D456000-memory.dmpFilesize
1.5MB
-
memory/3388-1737-0x000000001D2E0000-0x000000001D456000-memory.dmpFilesize
1.5MB
-
memory/3388-1793-0x000000001D250000-0x000000001D26E000-memory.dmpFilesize
120KB
-
memory/3388-1732-0x000000001D280000-0x000000001D29C000-memory.dmpFilesize
112KB
-
memory/3388-1727-0x000000001D280000-0x000000001D2A6000-memory.dmpFilesize
152KB
-
memory/3388-1726-0x000000001D2E0000-0x000000001D39C000-memory.dmpFilesize
752KB
-
memory/3388-1725-0x000000001D270000-0x000000001D3E6000-memory.dmpFilesize
1.5MB
-
memory/3388-1717-0x000000001D280000-0x000000001D3F6000-memory.dmpFilesize
1.5MB
-
memory/3388-1715-0x000000001D280000-0x000000001D3F6000-memory.dmpFilesize
1.5MB
-
memory/3388-1710-0x000000001D280000-0x000000001D2A6000-memory.dmpFilesize
152KB
-
memory/3388-1709-0x000000001D270000-0x000000001D2F0000-memory.dmpFilesize
512KB
-
memory/3388-1708-0x000000001D250000-0x000000001D26E000-memory.dmpFilesize
120KB
-
memory/3388-1702-0x0000000019790000-0x000000001979A000-memory.dmpFilesize
40KB
-
memory/3388-1697-0x0000000019790000-0x000000001979A000-memory.dmpFilesize
40KB
-
memory/3388-1696-0x000000001D250000-0x000000001D26E000-memory.dmpFilesize
120KB
-
memory/3388-1695-0x0000000016D80000-0x0000000016EBE000-memory.dmpFilesize
1.2MB
-
memory/3388-1685-0x000000001D250000-0x000000001D276000-memory.dmpFilesize
152KB
-
memory/3388-1684-0x0000000016CA0000-0x0000000016CBC000-memory.dmpFilesize
112KB
-
memory/3388-1683-0x000000001D250000-0x000000001D276000-memory.dmpFilesize
152KB
-
memory/3388-1788-0x000000001D2E0000-0x000000001D30A000-memory.dmpFilesize
168KB
-
memory/4384-1738-0x000000006CB70000-0x000000006CB90000-memory.dmpFilesize
128KB
-
memory/4384-1656-0x000000006CB70000-0x000000006CB90000-memory.dmpFilesize
128KB
-
memory/4384-1500-0x0000000009130000-0x000000000965C000-memory.dmpFilesize
5.2MB