Analysis
-
max time kernel
104s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
02-01-2021 08:17
Static task
static1
Behavioral task
behavioral1
Sample
877dc825c00e79e1150d80d8308b2839.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
877dc825c00e79e1150d80d8308b2839.exe
Resource
win10v20201028
General
-
Target
877dc825c00e79e1150d80d8308b2839.exe
-
Size
1.1MB
-
MD5
877dc825c00e79e1150d80d8308b2839
-
SHA1
729b79644b48169917bb3edc128c54ade150d14e
-
SHA256
b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
-
SHA512
9171d18cdf4834417ddd9dc076aca77d68ebedd731583c3869b01181ff80739448efc8e0e0b0197fa5866592684efe1563a20a86ccd5c7ba645487198af8fd07
Malware Config
Extracted
raccoon
e18a70bfe8ead99f8f3ef1f22fb8040f2b9acc85
-
url4cnc
https://telete.in/brikitiki
Extracted
azorult
http://195.245.112.115/index.php
Extracted
asyncrat
0.5.7B
agentttt.ac.ug:6970
agentpurple.ac.ug:6970
AsyncMutex_6SI8OkPnk
-
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
agentttt.ac.ug,agentpurple.ac.ug
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6970
-
version
0.5.7B
Extracted
oski
malscxa.ac.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 6 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2568-99-0x0000000000400000-0x000000000040C000-memory.dmp disable_win_def behavioral2/memory/2568-101-0x000000000040616E-mapping.dmp disable_win_def behavioral2/memory/2348-132-0x0000000000400000-0x0000000000408000-memory.dmp disable_win_def behavioral2/memory/2348-133-0x0000000000403BEE-mapping.dmp disable_win_def C:\Windows\temp\v3xsrgrd.exe disable_win_def C:\Windows\Temp\v3xsrgrd.exe disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-134-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1712-136-0x000000000040C76E-mapping.dmp asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
Processes:
aghkdfgh.exesMMulpGKYL.exeIofD66hwVt.exeaYKN9d0AFc.exehR7n0iutIC.exeoghkdfgh.exeaghkdfgh.exeaghkdfgh.exeaYKN9d0AFc.exehR7n0iutIC.exesMMulpGKYL.exepid process 2664 aghkdfgh.exe 3924 sMMulpGKYL.exe 2424 IofD66hwVt.exe 3124 aYKN9d0AFc.exe 1052 hR7n0iutIC.exe 3660 oghkdfgh.exe 3592 aghkdfgh.exe 3952 aghkdfgh.exe 2568 aYKN9d0AFc.exe 2348 hR7n0iutIC.exe 1712 sMMulpGKYL.exe -
Loads dropped DLL 8 IoCs
Processes:
877dc825c00e79e1150d80d8308b2839.exepid process 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe 4080 877dc825c00e79e1150d80d8308b2839.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
hR7n0iutIC.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features hR7n0iutIC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" hR7n0iutIC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IofD66hwVt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\rpyW = "C:\\Users\\Admin\\AppData\\Local\\rpyW.url" IofD66hwVt.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
877dc825c00e79e1150d80d8308b2839.exedescription ioc process File created C:\Users\Admin\AppData\LocalLow\vC2bB3rC0zU4vO4n\desktop.ini 877dc825c00e79e1150d80d8308b2839.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
877dc825c00e79e1150d80d8308b2839.exeaghkdfgh.exeaYKN9d0AFc.exehR7n0iutIC.exesMMulpGKYL.exedescription pid process target process PID 3372 set thread context of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 2664 set thread context of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 3124 set thread context of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 1052 set thread context of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe PID 3924 set thread context of 1712 3924 sMMulpGKYL.exe sMMulpGKYL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1276 2424 WerFault.exe IofD66hwVt.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3020 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1876 taskkill.exe -
Processes:
IofD66hwVt.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 IofD66hwVt.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e IofD66hwVt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aghkdfgh.exeWerFault.exeaYKN9d0AFc.exepid process 2664 aghkdfgh.exe 2664 aghkdfgh.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 1276 WerFault.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
877dc825c00e79e1150d80d8308b2839.exeaghkdfgh.exeWerFault.exeaYKN9d0AFc.exepowershell.exedescription pid process Token: SeDebugPrivilege 3372 877dc825c00e79e1150d80d8308b2839.exe Token: SeDebugPrivilege 2664 aghkdfgh.exe Token: SeRestorePrivilege 1276 WerFault.exe Token: SeBackupPrivilege 1276 WerFault.exe Token: SeDebugPrivilege 1276 WerFault.exe Token: SeDebugPrivilege 2568 aYKN9d0AFc.exe Token: SeDebugPrivilege 68 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aYKN9d0AFc.exepid process 2568 aYKN9d0AFc.exe 2568 aYKN9d0AFc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
877dc825c00e79e1150d80d8308b2839.exe877dc825c00e79e1150d80d8308b2839.execmd.exeaghkdfgh.exeaYKN9d0AFc.exesMMulpGKYL.exeaYKN9d0AFc.exehR7n0iutIC.exedescription pid process target process PID 3372 wrote to memory of 2664 3372 877dc825c00e79e1150d80d8308b2839.exe aghkdfgh.exe PID 3372 wrote to memory of 2664 3372 877dc825c00e79e1150d80d8308b2839.exe aghkdfgh.exe PID 3372 wrote to memory of 2664 3372 877dc825c00e79e1150d80d8308b2839.exe aghkdfgh.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 3372 wrote to memory of 4080 3372 877dc825c00e79e1150d80d8308b2839.exe 877dc825c00e79e1150d80d8308b2839.exe PID 4080 wrote to memory of 3924 4080 877dc825c00e79e1150d80d8308b2839.exe sMMulpGKYL.exe PID 4080 wrote to memory of 3924 4080 877dc825c00e79e1150d80d8308b2839.exe sMMulpGKYL.exe PID 4080 wrote to memory of 3924 4080 877dc825c00e79e1150d80d8308b2839.exe sMMulpGKYL.exe PID 4080 wrote to memory of 2424 4080 877dc825c00e79e1150d80d8308b2839.exe IofD66hwVt.exe PID 4080 wrote to memory of 2424 4080 877dc825c00e79e1150d80d8308b2839.exe IofD66hwVt.exe PID 4080 wrote to memory of 2424 4080 877dc825c00e79e1150d80d8308b2839.exe IofD66hwVt.exe PID 4080 wrote to memory of 3124 4080 877dc825c00e79e1150d80d8308b2839.exe aYKN9d0AFc.exe PID 4080 wrote to memory of 3124 4080 877dc825c00e79e1150d80d8308b2839.exe aYKN9d0AFc.exe PID 4080 wrote to memory of 3124 4080 877dc825c00e79e1150d80d8308b2839.exe aYKN9d0AFc.exe PID 4080 wrote to memory of 1052 4080 877dc825c00e79e1150d80d8308b2839.exe hR7n0iutIC.exe PID 4080 wrote to memory of 1052 4080 877dc825c00e79e1150d80d8308b2839.exe hR7n0iutIC.exe PID 4080 wrote to memory of 1052 4080 877dc825c00e79e1150d80d8308b2839.exe hR7n0iutIC.exe PID 4080 wrote to memory of 1984 4080 877dc825c00e79e1150d80d8308b2839.exe cmd.exe PID 4080 wrote to memory of 1984 4080 877dc825c00e79e1150d80d8308b2839.exe cmd.exe PID 4080 wrote to memory of 1984 4080 877dc825c00e79e1150d80d8308b2839.exe cmd.exe PID 1984 wrote to memory of 3020 1984 cmd.exe timeout.exe PID 1984 wrote to memory of 3020 1984 cmd.exe timeout.exe PID 1984 wrote to memory of 3020 1984 cmd.exe timeout.exe PID 2664 wrote to memory of 3660 2664 aghkdfgh.exe oghkdfgh.exe PID 2664 wrote to memory of 3660 2664 aghkdfgh.exe oghkdfgh.exe PID 2664 wrote to memory of 3660 2664 aghkdfgh.exe oghkdfgh.exe PID 2664 wrote to memory of 3592 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3592 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3592 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 2664 wrote to memory of 3952 2664 aghkdfgh.exe aghkdfgh.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3124 wrote to memory of 2568 3124 aYKN9d0AFc.exe aYKN9d0AFc.exe PID 3924 wrote to memory of 3252 3924 sMMulpGKYL.exe schtasks.exe PID 3924 wrote to memory of 3252 3924 sMMulpGKYL.exe schtasks.exe PID 3924 wrote to memory of 3252 3924 sMMulpGKYL.exe schtasks.exe PID 2568 wrote to memory of 2256 2568 aYKN9d0AFc.exe cmstp.exe PID 2568 wrote to memory of 2256 2568 aYKN9d0AFc.exe cmstp.exe PID 2568 wrote to memory of 2256 2568 aYKN9d0AFc.exe cmstp.exe PID 1052 wrote to memory of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe PID 1052 wrote to memory of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe PID 1052 wrote to memory of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe PID 1052 wrote to memory of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe PID 1052 wrote to memory of 2348 1052 hR7n0iutIC.exe hR7n0iutIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\877dc825c00e79e1150d80d8308b2839.exe"C:\Users\Admin\AppData\Local\Temp\877dc825c00e79e1150d80d8308b2839.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exe"C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exe"C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exe"{path}"4⤵
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exe"{path}"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exe"{path}"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\877dc825c00e79e1150d80d8308b2839.exe"{path}"2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exe"C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IAapkDPBpUFkb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9154.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exe"{path}"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IofD66hwVt.exe"C:\Users\Admin\AppData\Local\Temp\IofD66hwVt.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 12684⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exe"C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exe"{path}"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\quegpzal.inf5⤵
-
C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exe"C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exe"{path}"4⤵
- Executes dropped EXE
- Windows security modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\877dc825c00e79e1150d80d8308b2839.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\Windows\temp\v3xsrgrd.exe2⤵
-
C:\Windows\temp\v3xsrgrd.exeC:\Windows\temp\v3xsrgrd.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 64⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 04⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 64⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 64⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 24⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
8592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aYKN9d0AFc.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
313df3fecb1b2f8752484d2c810e4351
SHA1dc8421e4da325696e0e1e0f92936e5b933fb1ebf
SHA256b03fed22d74e7b0c103edbd8d7c1156edc9ad7c12c2f0557697a72650e397cd9
SHA5127039ffe64717ee7e30c073aa73c3a49d3dab6100eeb413ca02eb47b14573acd2d9a26636716c509bc93ce3179c79b0aa269a8a08d93b8edc813f4d4e55a0195e
-
C:\Users\Admin\AppData\Local\Temp\IofD66hwVt.exeMD5
54a4be7037ecdb031563998906a365cd
SHA1e19e35a43087696fc4e7ac0dfeea4ea19fed8f28
SHA256248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189
SHA512515c6edb804b85cdaa610a275cfda7490884a42dc5c1585681d13d644c0e5b2ef363dff586e24e1a44410db85e49ee3e2c9737b865f1f9e84271dc5800dbd60d
-
C:\Users\Admin\AppData\Local\Temp\IofD66hwVt.exeMD5
54a4be7037ecdb031563998906a365cd
SHA1e19e35a43087696fc4e7ac0dfeea4ea19fed8f28
SHA256248eabc9c97d8c4994c26c88cf1806ea9274eb187e3eb0bae7ae8035c7f3b189
SHA512515c6edb804b85cdaa610a275cfda7490884a42dc5c1585681d13d644c0e5b2ef363dff586e24e1a44410db85e49ee3e2c9737b865f1f9e84271dc5800dbd60d
-
C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exeMD5
75ce299ceb045c97ab990e27b0e71f41
SHA1ea88df32d7f2ea3731ce3beb1c0d5303abc2a242
SHA256cc342d3fb1fb6dc231e75e877076be7edd370c31f82ee062f21cc1c43385fbcc
SHA5120be2ea302323587f9f58d0daf0842d31fcea87989d4e8f9293b3faa7c36461346e62d79dc62d321c1f2f8d843648de320d143261c21b020ad7d5cf7369a82b5c
-
C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exeMD5
75ce299ceb045c97ab990e27b0e71f41
SHA1ea88df32d7f2ea3731ce3beb1c0d5303abc2a242
SHA256cc342d3fb1fb6dc231e75e877076be7edd370c31f82ee062f21cc1c43385fbcc
SHA5120be2ea302323587f9f58d0daf0842d31fcea87989d4e8f9293b3faa7c36461346e62d79dc62d321c1f2f8d843648de320d143261c21b020ad7d5cf7369a82b5c
-
C:\Users\Admin\AppData\Local\Temp\aYKN9d0AFc.exeMD5
75ce299ceb045c97ab990e27b0e71f41
SHA1ea88df32d7f2ea3731ce3beb1c0d5303abc2a242
SHA256cc342d3fb1fb6dc231e75e877076be7edd370c31f82ee062f21cc1c43385fbcc
SHA5120be2ea302323587f9f58d0daf0842d31fcea87989d4e8f9293b3faa7c36461346e62d79dc62d321c1f2f8d843648de320d143261c21b020ad7d5cf7369a82b5c
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exeMD5
170faeb45ecbd3499349403e53573a5f
SHA1db9b93e719fb25b9621930ad03581b8ff0bf418f
SHA2563df00736cd98aedc6145d6163a1cf28117c4402736e004d574c3fb3a7f036357
SHA512a23f9e1d0f09a979e8b7abacbb3b1fa320e2598b399ac6e9e831845dec1151fa5640f4dd376736f334517de675f6b6e9117e151371d58f7fbaeb85d24a64c8ff
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exeMD5
170faeb45ecbd3499349403e53573a5f
SHA1db9b93e719fb25b9621930ad03581b8ff0bf418f
SHA2563df00736cd98aedc6145d6163a1cf28117c4402736e004d574c3fb3a7f036357
SHA512a23f9e1d0f09a979e8b7abacbb3b1fa320e2598b399ac6e9e831845dec1151fa5640f4dd376736f334517de675f6b6e9117e151371d58f7fbaeb85d24a64c8ff
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exeMD5
170faeb45ecbd3499349403e53573a5f
SHA1db9b93e719fb25b9621930ad03581b8ff0bf418f
SHA2563df00736cd98aedc6145d6163a1cf28117c4402736e004d574c3fb3a7f036357
SHA512a23f9e1d0f09a979e8b7abacbb3b1fa320e2598b399ac6e9e831845dec1151fa5640f4dd376736f334517de675f6b6e9117e151371d58f7fbaeb85d24a64c8ff
-
C:\Users\Admin\AppData\Local\Temp\aghkdfgh.exeMD5
170faeb45ecbd3499349403e53573a5f
SHA1db9b93e719fb25b9621930ad03581b8ff0bf418f
SHA2563df00736cd98aedc6145d6163a1cf28117c4402736e004d574c3fb3a7f036357
SHA512a23f9e1d0f09a979e8b7abacbb3b1fa320e2598b399ac6e9e831845dec1151fa5640f4dd376736f334517de675f6b6e9117e151371d58f7fbaeb85d24a64c8ff
-
C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exeMD5
662e1f5caa7b550c5a83411e3685e10e
SHA1925c31f6db67bebfc92044fc4b43ebaf4c2f837a
SHA25686cd50d9e36e50a4e915cc3fd4919eb4aed7ad268033286086c715cface64b8b
SHA5124885fe5be6b4fef99b0d66a2886a25c3fad6cff987817374aa01abe0d1af3cacaf7053bd506b2e8e2ecac742fd956945a1d5250f092e454fb32c865e267b8733
-
C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exeMD5
662e1f5caa7b550c5a83411e3685e10e
SHA1925c31f6db67bebfc92044fc4b43ebaf4c2f837a
SHA25686cd50d9e36e50a4e915cc3fd4919eb4aed7ad268033286086c715cface64b8b
SHA5124885fe5be6b4fef99b0d66a2886a25c3fad6cff987817374aa01abe0d1af3cacaf7053bd506b2e8e2ecac742fd956945a1d5250f092e454fb32c865e267b8733
-
C:\Users\Admin\AppData\Local\Temp\hR7n0iutIC.exeMD5
662e1f5caa7b550c5a83411e3685e10e
SHA1925c31f6db67bebfc92044fc4b43ebaf4c2f837a
SHA25686cd50d9e36e50a4e915cc3fd4919eb4aed7ad268033286086c715cface64b8b
SHA5124885fe5be6b4fef99b0d66a2886a25c3fad6cff987817374aa01abe0d1af3cacaf7053bd506b2e8e2ecac742fd956945a1d5250f092e454fb32c865e267b8733
-
C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exeMD5
593eea90e533ed14757d62b4f2c7d969
SHA10c7deb4ac306dac893c6ba30f81d9519a3f409a6
SHA2566d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
SHA512c069f0c550724a5b509ad9c8d94f037a3e0a4758df8c4bb5b7c265a350a14d541fb111c72dda9a0f4b736d71236bb9192d9b9fc03de7647c24cdfc428bd8b678
-
C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exeMD5
593eea90e533ed14757d62b4f2c7d969
SHA10c7deb4ac306dac893c6ba30f81d9519a3f409a6
SHA2566d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
SHA512c069f0c550724a5b509ad9c8d94f037a3e0a4758df8c4bb5b7c265a350a14d541fb111c72dda9a0f4b736d71236bb9192d9b9fc03de7647c24cdfc428bd8b678
-
C:\Users\Admin\AppData\Local\Temp\oghkdfgh.exeMD5
593eea90e533ed14757d62b4f2c7d969
SHA10c7deb4ac306dac893c6ba30f81d9519a3f409a6
SHA2566d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
SHA512c069f0c550724a5b509ad9c8d94f037a3e0a4758df8c4bb5b7c265a350a14d541fb111c72dda9a0f4b736d71236bb9192d9b9fc03de7647c24cdfc428bd8b678
-
C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exeMD5
68aebe67b9ab7f84a4d0520a41de005c
SHA1aeef03bc26334beb3a92ca7f991772cdf8dd79f4
SHA256e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9
SHA512ce173574ceedf7bb672cdbaa69f81e05b659a62d1131f930740d25c56e58db1efdbe70817db84096596274d067153ebcbaedf12bf817a7531ddd8d2f6ccc7546
-
C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exeMD5
68aebe67b9ab7f84a4d0520a41de005c
SHA1aeef03bc26334beb3a92ca7f991772cdf8dd79f4
SHA256e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9
SHA512ce173574ceedf7bb672cdbaa69f81e05b659a62d1131f930740d25c56e58db1efdbe70817db84096596274d067153ebcbaedf12bf817a7531ddd8d2f6ccc7546
-
C:\Users\Admin\AppData\Local\Temp\sMMulpGKYL.exeMD5
68aebe67b9ab7f84a4d0520a41de005c
SHA1aeef03bc26334beb3a92ca7f991772cdf8dd79f4
SHA256e12b535ca73d6e7f185422701dbacce05ca928257baab9ff1fa725d1e32abfd9
SHA512ce173574ceedf7bb672cdbaa69f81e05b659a62d1131f930740d25c56e58db1efdbe70817db84096596274d067153ebcbaedf12bf817a7531ddd8d2f6ccc7546
-
C:\Users\Admin\AppData\Local\Temp\tmp9154.tmpMD5
44ea970e3b3f6b24c21caeee0f485459
SHA1793e598eb5fe7061e9916e4191eca17e3aa3bd92
SHA25677e77adffa3a8b58651557f7d8d39358e4760e83fb00035e2e5c8138634b9b91
SHA5126ef61dfda6889afe9d73b6f08f1b710114bd29c7ee6ad1a6639fe2612214f2f03758dfbae57ac35f3114eb82ead942d032cccf3b97b18a3af33930caddc45de4
-
C:\Windows\Temp\v3xsrgrd.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
C:\Windows\temp\quegpzal.infMD5
94c548114ace1739a20819f604713f9d
SHA1d7e03b6696e17618fe438b983f540c774692284b
SHA25643c53468756eb6e204a2ff8366f68dd501f7678d354a02298a4436b259452cf7
SHA512f7dd2cb002697990dc26e4f34980b269f61212dd53babc9520c8124f296bcc9a6834428c5cd271955d6911cee3e58cdb43cc438b729e061cc2556eed8ace4cdc
-
C:\Windows\temp\v3xsrgrd.exeMD5
f4b5c1ebf4966256f52c4c4ceae87fb1
SHA1ca70ec96d1a65cb2a4cbf4db46042275dc75813b
SHA25688e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03
SHA51202a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\mozglue.dllMD5
eae9273f8cdcf9321c6c37c244773139
SHA18378e2a2f3635574c106eea8419b5eb00b8489b0
SHA256a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc
SHA51206e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\softokn3.dllMD5
4e8df049f3459fa94ab6ad387f3561ac
SHA106ed392bc29ad9d5fc05ee254c2625fd65925114
SHA25625a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA5123dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6
-
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\softokn3.dllMD5
4e8df049f3459fa94ab6ad387f3561ac
SHA106ed392bc29ad9d5fc05ee254c2625fd65925114
SHA25625a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA5123dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
memory/68-176-0x00000000097B0000-0x00000000097E3000-memory.dmpFilesize
204KB
-
memory/68-152-0x0000000007740000-0x0000000007741000-memory.dmpFilesize
4KB
-
memory/68-165-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/68-236-0x00000000099B0000-0x00000000099B1000-memory.dmpFilesize
4KB
-
memory/68-158-0x0000000008100000-0x0000000008101000-memory.dmpFilesize
4KB
-
memory/68-157-0x0000000007F90000-0x0000000007F91000-memory.dmpFilesize
4KB
-
memory/68-166-0x0000000008860000-0x0000000008861000-memory.dmpFilesize
4KB
-
memory/68-233-0x00000000099C0000-0x00000000099C1000-memory.dmpFilesize
4KB
-
memory/68-156-0x0000000007E20000-0x0000000007E21000-memory.dmpFilesize
4KB
-
memory/68-155-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/68-189-0x0000000009AB0000-0x0000000009AB1000-memory.dmpFilesize
4KB
-
memory/68-144-0x0000000000000000-mapping.dmp
-
memory/68-171-0x00000000088B0000-0x00000000088B1000-memory.dmpFilesize
4KB
-
memory/68-186-0x0000000009770000-0x0000000009771000-memory.dmpFilesize
4KB
-
memory/68-188-0x00000000098E0000-0x00000000098E1000-memory.dmpFilesize
4KB
-
memory/68-151-0x0000000007020000-0x0000000007021000-memory.dmpFilesize
4KB
-
memory/68-149-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/204-160-0x0000000000000000-mapping.dmp
-
memory/204-167-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/204-164-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/204-161-0x0000000000000000-mapping.dmp
-
memory/1044-213-0x0000000000000000-mapping.dmp
-
memory/1044-225-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/1052-61-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/1052-126-0x0000000006CB0000-0x0000000006CEC000-memory.dmpFilesize
240KB
-
memory/1052-53-0x0000000000000000-mapping.dmp
-
memory/1052-58-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/1276-91-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/1276-89-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/1432-159-0x0000000000000000-mapping.dmp
-
memory/1712-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1712-136-0x000000000040C76E-mapping.dmp
-
memory/1712-139-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/1876-169-0x0000000000000000-mapping.dmp
-
memory/1956-147-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/1956-146-0x0000000000000000-mapping.dmp
-
memory/1956-145-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/1956-148-0x0000000000000000-mapping.dmp
-
memory/1956-180-0x0000000000000000-mapping.dmp
-
memory/1956-185-0x0000000003210000-0x0000000003211000-memory.dmpFilesize
4KB
-
memory/1956-187-0x0000000000000000-mapping.dmp
-
memory/1984-54-0x0000000000000000-mapping.dmp
-
memory/2256-112-0x0000000000000000-mapping.dmp
-
memory/2256-128-0x0000000004520000-0x0000000004621000-memory.dmpFilesize
1.0MB
-
memory/2348-133-0x0000000000403BEE-mapping.dmp
-
memory/2348-137-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/2348-132-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2424-100-0x0000000000000000-mapping.dmp
-
memory/2424-92-0x0000000000000000-mapping.dmp
-
memory/2424-96-0x0000000000000000-mapping.dmp
-
memory/2424-97-0x0000000000000000-mapping.dmp
-
memory/2424-124-0x0000000000000000-mapping.dmp
-
memory/2424-122-0x0000000000000000-mapping.dmp
-
memory/2424-120-0x0000000000000000-mapping.dmp
-
memory/2424-127-0x0000000000000000-mapping.dmp
-
memory/2424-131-0x0000000000000000-mapping.dmp
-
memory/2424-129-0x0000000000000000-mapping.dmp
-
memory/2424-114-0x0000000000000000-mapping.dmp
-
memory/2424-119-0x0000000000000000-mapping.dmp
-
memory/2424-117-0x0000000000000000-mapping.dmp
-
memory/2424-113-0x0000000000000000-mapping.dmp
-
memory/2424-105-0x0000000000000000-mapping.dmp
-
memory/2424-98-0x0000000000000000-mapping.dmp
-
memory/2424-94-0x0000000000000000-mapping.dmp
-
memory/2424-95-0x0000000000000000-mapping.dmp
-
memory/2424-37-0x0000000000000000-mapping.dmp
-
memory/2424-107-0x0000000000000000-mapping.dmp
-
memory/2424-93-0x0000000000000000-mapping.dmp
-
memory/2424-103-0x0000000000000000-mapping.dmp
-
memory/2568-99-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2568-104-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/2568-101-0x000000000040616E-mapping.dmp
-
memory/2664-18-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2664-71-0x0000000007CA0000-0x0000000007CEF000-memory.dmpFilesize
316KB
-
memory/2664-15-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/2664-11-0x0000000000000000-mapping.dmp
-
memory/2924-173-0x0000024D9A170000-0x0000024D9A171000-memory.dmpFilesize
4KB
-
memory/2924-172-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/2924-170-0x0000000000000000-mapping.dmp
-
memory/2924-174-0x0000024DB48A0000-0x0000024DB48A1000-memory.dmpFilesize
4KB
-
memory/3020-68-0x0000000000000000-mapping.dmp
-
memory/3124-49-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/3124-46-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/3124-42-0x0000000000000000-mapping.dmp
-
memory/3124-90-0x0000000008830000-0x0000000008869000-memory.dmpFilesize
228KB
-
memory/3252-106-0x0000000000000000-mapping.dmp
-
memory/3268-226-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/3268-216-0x0000000000000000-mapping.dmp
-
memory/3372-8-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/3372-10-0x00000000088B0000-0x0000000008975000-memory.dmpFilesize
788KB
-
memory/3372-5-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/3372-3-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/3372-2-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/3372-6-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3372-7-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/3372-9-0x0000000008550000-0x000000000855E000-memory.dmpFilesize
56KB
-
memory/3660-75-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/3660-81-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/3660-190-0x0000000008370000-0x00000000083D3000-memory.dmpFilesize
396KB
-
memory/3660-72-0x0000000000000000-mapping.dmp
-
memory/3924-36-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/3924-33-0x0000000000000000-mapping.dmp
-
memory/3924-88-0x00000000083E0000-0x0000000008420000-memory.dmpFilesize
256KB
-
memory/3924-40-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/3952-80-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3952-78-0x000000000041A684-mapping.dmp
-
memory/3952-77-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4044-218-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4044-222-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4044-220-0x0000000000417A8B-mapping.dmp
-
memory/4080-16-0x000000000043FF06-mapping.dmp
-
memory/4080-14-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB
-
memory/4080-17-0x0000000000400000-0x0000000000494000-memory.dmpFilesize
592KB
-
memory/4296-195-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4296-191-0x0000000000000000-mapping.dmp
-
memory/4332-197-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4332-192-0x0000000000000000-mapping.dmp
-
memory/4384-193-0x0000000000000000-mapping.dmp
-
memory/4384-199-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4452-201-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4452-196-0x0000000000000000-mapping.dmp
-
memory/4532-203-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4532-198-0x0000000000000000-mapping.dmp
-
memory/4624-206-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4624-200-0x0000000000000000-mapping.dmp
-
memory/4716-209-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4716-202-0x0000000000000000-mapping.dmp
-
memory/4808-204-0x0000000000000000-mapping.dmp
-
memory/4808-212-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4908-215-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB
-
memory/4908-207-0x0000000000000000-mapping.dmp
-
memory/5020-210-0x0000000000000000-mapping.dmp
-
memory/5020-219-0x00007FF897580000-0x00007FF897F6C000-memory.dmpFilesize
9.9MB