Overview
overview
10Static
static
1008751be484...2d.dll
windows7_x64
1008751be484...2d.dll
windows10_x64
100a9f79abd4...51.exe
windows7_x64
30a9f79abd4...51.exe
windows10_x64
30di3x.bin.exe
windows7_x64
100di3x.bin.exe
windows10_x64
101.bin/1.exe
windows7_x64
101.bin/1.exe
windows10_x64
104a30275f14...ab.dll
windows7_x64
104a30275f14...ab.dll
windows10_x64
12019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
102b5e50bc30...ba.dll
windows7_x64
102b5e50bc30...ba.dll
windows10_x64
102c01b00772...eb.exe
windows7_x64
102c01b00772...eb.exe
windows10_x64
131.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
142f9729255...61.exe
windows7_x64
1042f9729255...61.exe
windows10_x64
1042f9729255...1).exe
windows7_x64
1042f9729255...1).exe
windows10_x64
105da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
869c56d12ed...6b.exe
windows7_x64
1069c56d12ed...6b.exe
windows10_x64
106a9e7107c9...91.exe
windows7_x64
106a9e7107c9...91.exe
windows10_x64
10905d572f23...50.exe
windows7_x64
1905d572f23...50.exe
windows10_x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
50s -
max time network
43s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 19:24
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
0di3x.bin.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
0di3x.bin.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
1.bin/1.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
1.bin/1.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
31.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
42f972925508a82236e8533567487761.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2792 cmd.exe -
Drops startup file 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Kills process with taskkill 47 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 416 taskkill.exe 1788 taskkill.exe 2848 taskkill.exe 840 taskkill.exe 820 taskkill.exe 364 taskkill.exe 1588 taskkill.exe 2172 taskkill.exe 2980 taskkill.exe 2184 taskkill.exe 1552 taskkill.exe 1208 taskkill.exe 1672 taskkill.exe 604 taskkill.exe 824 taskkill.exe 1020 taskkill.exe 740 taskkill.exe 1492 taskkill.exe 668 taskkill.exe 2104 taskkill.exe 792 taskkill.exe 1468 taskkill.exe 1712 taskkill.exe 728 taskkill.exe 936 taskkill.exe 1780 taskkill.exe 940 taskkill.exe 1692 taskkill.exe 1768 taskkill.exe 2908 taskkill.exe 1536 taskkill.exe 1804 taskkill.exe 1736 taskkill.exe 324 taskkill.exe 1388 taskkill.exe 2896 taskkill.exe 2940 taskkill.exe 3048 taskkill.exe 1772 taskkill.exe 1312 taskkill.exe 1484 taskkill.exe 1720 taskkill.exe 1632 taskkill.exe 1132 taskkill.exe 428 taskkill.exe 2140 taskkill.exe 2860 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 2712 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22684 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 1672 taskkill.exe Token: SeDebugPrivilege 1552 taskkill.exe Token: SeDebugPrivilege 936 taskkill.exe Token: SeDebugPrivilege 324 taskkill.exe Token: SeDebugPrivilege 1468 taskkill.exe Token: SeDebugPrivilege 364 taskkill.exe Token: SeDebugPrivilege 1736 taskkill.exe Token: SeDebugPrivilege 820 taskkill.exe Token: SeDebugPrivilege 840 taskkill.exe Token: SeDebugPrivilege 1312 taskkill.exe Token: SeDebugPrivilege 1632 taskkill.exe Token: SeDebugPrivilege 728 taskkill.exe Token: SeDebugPrivilege 1132 taskkill.exe Token: SeDebugPrivilege 740 taskkill.exe Token: SeDebugPrivilege 792 taskkill.exe Token: SeDebugPrivilege 940 taskkill.exe Token: SeDebugPrivilege 428 taskkill.exe Token: SeDebugPrivilege 2140 taskkill.exe Token: SeDebugPrivilege 416 taskkill.exe Token: SeDebugPrivilege 668 taskkill.exe Token: SeDebugPrivilege 1388 taskkill.exe Token: SeDebugPrivilege 1484 taskkill.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 1788 taskkill.exe Token: SeDebugPrivilege 1020 taskkill.exe Token: SeDebugPrivilege 1588 taskkill.exe Token: SeDebugPrivilege 1804 taskkill.exe Token: SeDebugPrivilege 1780 taskkill.exe Token: SeDebugPrivilege 2104 taskkill.exe Token: SeDebugPrivilege 604 taskkill.exe Token: SeDebugPrivilege 1720 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 1768 taskkill.exe Token: SeDebugPrivilege 824 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 1712 taskkill.exe Token: SeDebugPrivilege 2172 taskkill.exe Token: SeDebugPrivilege 2956 powershell.exe Token: SeDebugPrivilege 2184 taskkill.exe Token: SeDebugPrivilege 2940 taskkill.exe Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 2908 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 177 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription pid process target process PID 1036 wrote to memory of 1984 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1036 wrote to memory of 1984 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1036 wrote to memory of 1984 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1036 wrote to memory of 1968 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 1968 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 1968 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 668 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 668 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 668 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 592 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 592 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 592 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 912 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 912 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 912 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1036 wrote to memory of 792 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 792 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 792 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1804 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1804 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1804 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1692 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1692 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1692 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1720 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1720 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1720 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1772 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1772 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1772 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1672 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1672 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1672 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1468 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1468 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1468 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1208 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1208 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1208 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1312 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1312 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1312 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 604 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 604 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 604 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 824 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 824 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 824 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 840 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 840 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 840 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1020 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1020 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 1020 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 820 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 820 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 820 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 364 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 364 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 364 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 740 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 740 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 740 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1036 wrote to memory of 416 1036 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵
- Deletes itself
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
82d8a9ee8293fd002671397619273c62
SHA1ea835264b9ed1e7b0dedbc99456168ba99ad65ac
SHA2561de41f5a2adcfd7bf33fe0f00fdaff4d108753c1341e298e75e3c8470dfb9138
SHA512095474efadf52df9dd2f7df367676bec4a51de843baad8753521a7dbbad1b8a23d60ec413485bd7f91db5c6ac5328e52790f428ff08482bd0d1bbeb3278be496
-
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txtMD5
5cad4e10da6c84ff09bf1d96741b6b0b
SHA1d872c872d62a46257312a7ae4c34a7ef1514936e
SHA256ccd5416ae965a2cc49ab60ed2c5e9dde831151f23c4ce11784ccb6d3f1396747
SHA5129383fb7602cfb0aa11df91886c270d4ae12114de033d87f96f23ecdf2308389b6affe13a5afe2442e6c91df3004a3bb3df7d6ffc66e83bb4162a0c76b2fde530
-
memory/324-36-0x0000000000000000-mapping.dmp
-
memory/364-25-0x0000000000000000-mapping.dmp
-
memory/416-27-0x0000000000000000-mapping.dmp
-
memory/428-39-0x0000000000000000-mapping.dmp
-
memory/592-8-0x0000000000000000-mapping.dmp
-
memory/604-20-0x0000000000000000-mapping.dmp
-
memory/668-7-0x0000000000000000-mapping.dmp
-
memory/668-42-0x0000000000000000-mapping.dmp
-
memory/728-30-0x0000000000000000-mapping.dmp
-
memory/740-26-0x0000000000000000-mapping.dmp
-
memory/792-10-0x0000000000000000-mapping.dmp
-
memory/820-24-0x0000000000000000-mapping.dmp
-
memory/824-21-0x0000000000000000-mapping.dmp
-
memory/840-22-0x0000000000000000-mapping.dmp
-
memory/912-9-0x0000000000000000-mapping.dmp
-
memory/936-32-0x0000000000000000-mapping.dmp
-
memory/940-41-0x0000000000000000-mapping.dmp
-
memory/1020-23-0x0000000000000000-mapping.dmp
-
memory/1036-14-0x000000001AAD0000-0x000000001AAD2000-memory.dmpFilesize
8KB
-
memory/1036-3-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/1036-2-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmpFilesize
9.9MB
-
memory/1132-34-0x0000000000000000-mapping.dmp
-
memory/1208-73-0x0000000000000000-mapping.dmp
-
memory/1208-18-0x0000000000000000-mapping.dmp
-
memory/1312-19-0x0000000000000000-mapping.dmp
-
memory/1388-40-0x0000000000000000-mapping.dmp
-
memory/1468-17-0x0000000000000000-mapping.dmp
-
memory/1484-44-0x0000000000000000-mapping.dmp
-
memory/1492-31-0x0000000000000000-mapping.dmp
-
memory/1536-57-0x0000000000000000-mapping.dmp
-
memory/1552-33-0x0000000000000000-mapping.dmp
-
memory/1588-45-0x0000000000000000-mapping.dmp
-
memory/1632-35-0x0000000000000000-mapping.dmp
-
memory/1672-16-0x0000000000000000-mapping.dmp
-
memory/1692-12-0x0000000000000000-mapping.dmp
-
memory/1712-29-0x0000000000000000-mapping.dmp
-
memory/1720-13-0x0000000000000000-mapping.dmp
-
memory/1736-28-0x0000000000000000-mapping.dmp
-
memory/1768-38-0x0000000000000000-mapping.dmp
-
memory/1772-15-0x0000000000000000-mapping.dmp
-
memory/1780-37-0x0000000000000000-mapping.dmp
-
memory/1788-43-0x0000000000000000-mapping.dmp
-
memory/1804-11-0x0000000000000000-mapping.dmp
-
memory/1968-6-0x0000000000000000-mapping.dmp
-
memory/1984-5-0x0000000000000000-mapping.dmp
-
memory/2104-46-0x0000000000000000-mapping.dmp
-
memory/2140-47-0x0000000000000000-mapping.dmp
-
memory/2172-48-0x0000000000000000-mapping.dmp
-
memory/2184-56-0x0000000000000000-mapping.dmp
-
memory/2252-75-0x0000000000000000-mapping.dmp
-
memory/2480-72-0x0000000000000000-mapping.dmp
-
memory/2496-69-0x0000000000000000-mapping.dmp
-
memory/2712-68-0x0000000000000000-mapping.dmp
-
memory/2792-70-0x0000000000000000-mapping.dmp
-
memory/2848-49-0x0000000000000000-mapping.dmp
-
memory/2860-50-0x0000000000000000-mapping.dmp
-
memory/2896-51-0x0000000000000000-mapping.dmp
-
memory/2908-52-0x0000000000000000-mapping.dmp
-
memory/2940-53-0x0000000000000000-mapping.dmp
-
memory/2956-64-0x000000001A984000-0x000000001A986000-memory.dmpFilesize
8KB
-
memory/2956-65-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/2956-66-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/2956-63-0x000000001A980000-0x000000001A982000-memory.dmpFilesize
8KB
-
memory/2956-62-0x000000001AA00000-0x000000001AA01000-memory.dmpFilesize
4KB
-
memory/2956-61-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/2956-60-0x000007FEF60E0000-0x000007FEF6ACC000-memory.dmpFilesize
9.9MB
-
memory/2956-59-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmpFilesize
8KB
-
memory/2956-58-0x0000000000000000-mapping.dmp
-
memory/2980-54-0x0000000000000000-mapping.dmp
-
memory/3048-55-0x0000000000000000-mapping.dmp