Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-06-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
Resource
win10v2004-20240611-en
General
-
Target
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
-
Size
221KB
-
MD5
6621fcab4de5fab7eac4d8d03c87f233
-
SHA1
70dd77e26e803239877b30439eb123454bc137cc
-
SHA256
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
-
SHA512
d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
SSDEEP
6144:WdwDpybdvNg134Gnq2YZstYaGaqjWq9441D/Kv+I:/cE134GiZ4Ya7mWq9441D/Kvj
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exepid process 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 1764 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 3968 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2488 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 3716 set thread context of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 set thread context of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 set thread context of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 set thread context of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 set thread context of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 set thread context of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2428 2024 WerFault.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2004 1764 WerFault.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2512 3968 WerFault.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process Token: SeDebugPrivilege 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe Token: SeDebugPrivilege 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 2024 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 4384 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3716 wrote to memory of 1988 3716 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 4384 wrote to memory of 3944 4384 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 4384 wrote to memory of 3944 4384 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 4384 wrote to memory of 3944 4384 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 1764 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 2488 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 3944 wrote to memory of 3968 3944 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1988 wrote to memory of 2964 1988 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 1988 wrote to memory of 2964 1988 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 1988 wrote to memory of 2964 1988 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 925⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5724.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1764 -ip 17641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3968 -ip 39681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe.logFilesize
706B
MD580305b9a250a27091f46fa147674ffb3
SHA181b485761494618e4c8bba9af56c29b2ea8e8a07
SHA256d9febc24cdfe2a616fff0e891fb055951aad00be6d57b0bc3cf8f4f643c5f6ae
SHA51252544d526e83ae2a71d63768457435dbe79843a76146f60b7e41ec7b53ddb620323592325e19d6776b92b7e1fbb8dc79db85e94a30d970f0983563456ccd7a19
-
C:\Users\Admin\AppData\Local\Temp\tmp5724.tmpFilesize
1KB
MD583d6e89b8754d25b433641acaa2a66eb
SHA1f89d5bdae947ac5cb70fc2ab675b48081d9b0732
SHA2565616a5762d790c9d6f881095099a0adae1b5f2dee34ec1909e823d851a28f5d0
SHA512fb805ced008dc025a0e851ed0075fbc7f9f65a667e82fe68a8f434490f476d1a5bceebaadedf726ac5447f7ccfbd91ef19669ef499150960c9d4b0204cbef97f
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeFilesize
221KB
MD56621fcab4de5fab7eac4d8d03c87f233
SHA170dd77e26e803239877b30439eb123454bc137cc
SHA256ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
SHA512d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
memory/1988-16-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/1988-36-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/1988-24-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/3716-8-0x00000000050B0000-0x00000000050B6000-memory.dmpFilesize
24KB
-
memory/3716-7-0x0000000006490000-0x0000000006522000-memory.dmpFilesize
584KB
-
memory/3716-0-0x000000007519E000-0x000000007519F000-memory.dmpFilesize
4KB
-
memory/3716-6-0x0000000006A40000-0x0000000006FE6000-memory.dmpFilesize
5.6MB
-
memory/3716-14-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/3716-5-0x00000000063F0000-0x000000000648C000-memory.dmpFilesize
624KB
-
memory/3716-4-0x0000000005060000-0x000000000509A000-memory.dmpFilesize
232KB
-
memory/3716-3-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/3716-2-0x00000000029A0000-0x00000000029A6000-memory.dmpFilesize
24KB
-
memory/3716-1-0x0000000000520000-0x000000000055C000-memory.dmpFilesize
240KB
-
memory/4384-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4384-15-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB
-
memory/4384-29-0x0000000075190000-0x0000000075941000-memory.dmpFilesize
7.7MB