Analysis
-
max time kernel
12s -
max time network
188s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:54
Static task
static1
Behavioral task
behavioral1
Sample
ddb25c6d3894be202a4ee4b061ce010d.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ddb25c6d3894be202a4ee4b061ce010d.exe
Resource
win10-en
General
-
Target
ddb25c6d3894be202a4ee4b061ce010d.exe
-
Size
893KB
-
MD5
ddb25c6d3894be202a4ee4b061ce010d
-
SHA1
5e87d177b7ca71c46f7c37d13a2de5e04b97549d
-
SHA256
8035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
-
SHA512
b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
Malware Config
Extracted
warzonerat
severdops.ddns.net:3311
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Nirsoft 14 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exe1F44AD0C.exepid process 892 AdvancedRun.exe 1408 AdvancedRun.exe 900 1F44AD0C.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ddb25c6d3894be202a4ee4b061ce010d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ddb25c6d3894be202a4ee4b061ce010d.exe -
Drops startup file 2 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe ddb25c6d3894be202a4ee4b061ce010d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe ddb25c6d3894be202a4ee4b061ce010d.exe -
Loads dropped DLL 6 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exeAdvancedRun.exepid process 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 892 AdvancedRun.exe 892 AdvancedRun.exe 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1852 ddb25c6d3894be202a4ee4b061ce010d.exe -
Uses the VBS compiler for execution 1 TTPs
-
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe = "0" ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe = "0" ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\A454A08C\svchost.exe = "0" ddb25c6d3894be202a4ee4b061ce010d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" ddb25c6d3894be202a4ee4b061ce010d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features ddb25c6d3894be202a4ee4b061ce010d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection ddb25c6d3894be202a4ee4b061ce010d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\1F44AD0C = "C:\\Windows\\Resources\\Themes\\A454A08C\\svchost.exe" ddb25c6d3894be202a4ee4b061ce010d.exe -
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ddb25c6d3894be202a4ee4b061ce010d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddb25c6d3894be202a4ee4b061ce010d.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ddb25c6d3894be202a4ee4b061ce010d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ddb25c6d3894be202a4ee4b061ce010d.exe -
Drops file in Windows directory 1 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process File created C:\Windows\Resources\Themes\A454A08C\svchost.exe ddb25c6d3894be202a4ee4b061ce010d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2200 1852 WerFault.exe ddb25c6d3894be202a4ee4b061ce010d.exe 2904 900 WerFault.exe 1F44AD0C.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 892 AdvancedRun.exe 892 AdvancedRun.exe 1408 AdvancedRun.exe 1408 AdvancedRun.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeddb25c6d3894be202a4ee4b061ce010d.exedescription pid process Token: SeDebugPrivilege 892 AdvancedRun.exe Token: SeImpersonatePrivilege 892 AdvancedRun.exe Token: SeDebugPrivilege 1408 AdvancedRun.exe Token: SeImpersonatePrivilege 1408 AdvancedRun.exe Token: SeDebugPrivilege 1852 ddb25c6d3894be202a4ee4b061ce010d.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exeAdvancedRun.exedescription pid process target process PID 1852 wrote to memory of 892 1852 ddb25c6d3894be202a4ee4b061ce010d.exe AdvancedRun.exe PID 1852 wrote to memory of 892 1852 ddb25c6d3894be202a4ee4b061ce010d.exe AdvancedRun.exe PID 1852 wrote to memory of 892 1852 ddb25c6d3894be202a4ee4b061ce010d.exe AdvancedRun.exe PID 1852 wrote to memory of 892 1852 ddb25c6d3894be202a4ee4b061ce010d.exe AdvancedRun.exe PID 892 wrote to memory of 1408 892 AdvancedRun.exe AdvancedRun.exe PID 892 wrote to memory of 1408 892 AdvancedRun.exe AdvancedRun.exe PID 892 wrote to memory of 1408 892 AdvancedRun.exe AdvancedRun.exe PID 892 wrote to memory of 1408 892 AdvancedRun.exe AdvancedRun.exe PID 1852 wrote to memory of 1384 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1384 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1384 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1384 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 316 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 316 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 316 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 316 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1088 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1088 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1088 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1088 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1696 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1696 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1696 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1696 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1504 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1504 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1504 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1504 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 900 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1F44AD0C.exe PID 1852 wrote to memory of 900 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1F44AD0C.exe PID 1852 wrote to memory of 900 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1F44AD0C.exe PID 1852 wrote to memory of 900 1852 ddb25c6d3894be202a4ee4b061ce010d.exe 1F44AD0C.exe PID 1852 wrote to memory of 1564 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1564 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1564 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1564 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1608 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1608 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1608 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 1608 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 848 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 848 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 848 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe PID 1852 wrote to memory of 848 1852 ddb25c6d3894be202a4ee4b061ce010d.exe powershell.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
ddb25c6d3894be202a4ee4b061ce010d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ddb25c6d3894be202a4ee4b061ce010d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe"C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exe" /SpecialRun 4101d8 8923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe" -Force2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exe" /SpecialRun 4101d8 22724⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\A454A08C\svchost.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\A454A08C\svchost.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 9243⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\A454A08C\svchost.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ddb25c6d3894be202a4ee4b061ce010d.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\A454A08C\svchost.exe" -Force2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 6602⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
6Disabling Security Tools
4Bypass User Account Control
1Virtualization/Sandbox Evasion
2Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
dee4a8a83252a38293ceff081d3b6344
SHA122184995aabbcee89a07767abbe238b0001a4bdd
SHA256c1067f4d5644cf3534f93a922620b5f7c572c3fdeaf34142fe579fa00fa0acc0
SHA512306ce36d2d6e4922a06f11b52892e2978b4a76b14b17f86cbd9cb6c1ad94053f2d910b3ae8363457423bdef231c0d5ec8989d5eeb1aa5e292780d9960e7e0a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\211c6604-fe6e-4df4-ac69-63876141b9b5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\2d4699c0-0f50-4809-b900-c390427a8287\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1F44AD0C.exeMD5
ddb25c6d3894be202a4ee4b061ce010d
SHA15e87d177b7ca71c46f7c37d13a2de5e04b97549d
SHA2568035847afc188fc0c7f878b148ffae82d22f6594386539255cdfc4b5d5deb8c0
SHA512b8e5caeb723f259c30cb34f2049e4051e0b7f3b4b4cd599a8729501875adf97b0c600e694c811f0909d2af84eb240cd6f01fd55a368a698f70dced6f410d78f2
-
memory/316-75-0x0000000000000000-mapping.dmp
-
memory/316-91-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/316-101-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/316-114-0x0000000004972000-0x0000000004973000-memory.dmpFilesize
4KB
-
memory/848-143-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/848-138-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/848-139-0x0000000004912000-0x0000000004913000-memory.dmpFilesize
4KB
-
memory/848-94-0x0000000000000000-mapping.dmp
-
memory/892-67-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/892-65-0x0000000000000000-mapping.dmp
-
memory/900-111-0x0000000004AC5000-0x0000000004AD6000-memory.dmpFilesize
68KB
-
memory/900-106-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/900-83-0x0000000000000000-mapping.dmp
-
memory/900-90-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/1020-118-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1020-120-0x0000000000405E28-mapping.dmp
-
memory/1020-135-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-105-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1088-113-0x0000000000EE2000-0x0000000000EE3000-memory.dmpFilesize
4KB
-
memory/1088-112-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/1088-77-0x0000000000000000-mapping.dmp
-
memory/1384-115-0x00000000049E2000-0x00000000049E3000-memory.dmpFilesize
4KB
-
memory/1384-104-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1384-74-0x0000000000000000-mapping.dmp
-
memory/1408-71-0x0000000000000000-mapping.dmp
-
memory/1504-133-0x00000000026C0000-0x000000000330A000-memory.dmpFilesize
12.3MB
-
memory/1504-190-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1504-186-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/1504-80-0x0000000000000000-mapping.dmp
-
memory/1564-140-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1564-141-0x0000000004A42000-0x0000000004A43000-memory.dmpFilesize
4KB
-
memory/1564-88-0x0000000000000000-mapping.dmp
-
memory/1608-137-0x00000000026C0000-0x000000000330A000-memory.dmpFilesize
12.3MB
-
memory/1608-134-0x00000000026C0000-0x000000000330A000-memory.dmpFilesize
12.3MB
-
memory/1608-93-0x0000000000000000-mapping.dmp
-
memory/1696-79-0x0000000000000000-mapping.dmp
-
memory/1696-162-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/1696-110-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1696-103-0x00000000049D2000-0x00000000049D3000-memory.dmpFilesize
4KB
-
memory/1852-60-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/1852-126-0x0000000000510000-0x0000000000513000-memory.dmpFilesize
12KB
-
memory/1852-62-0x0000000000D20000-0x0000000000D82000-memory.dmpFilesize
392KB
-
memory/1852-61-0x00000000049B5000-0x00000000049C6000-memory.dmpFilesize
68KB
-
memory/1852-59-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/2112-231-0x0000000000000000-mapping.dmp
-
memory/2200-170-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/2200-142-0x0000000000000000-mapping.dmp
-
memory/2272-153-0x0000000000000000-mapping.dmp
-
memory/2320-159-0x0000000000000000-mapping.dmp
-
memory/2492-171-0x0000000000000000-mapping.dmp
-
memory/2492-200-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/2492-203-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/2516-194-0x0000000001192000-0x0000000001193000-memory.dmpFilesize
4KB
-
memory/2516-172-0x0000000000000000-mapping.dmp
-
memory/2516-211-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/2536-212-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/2536-173-0x0000000000000000-mapping.dmp
-
memory/2536-197-0x00000000047A2000-0x00000000047A3000-memory.dmpFilesize
4KB
-
memory/2584-175-0x0000000000000000-mapping.dmp
-
memory/2636-180-0x0000000000000000-mapping.dmp
-
memory/2636-210-0x00000000049C2000-0x00000000049C3000-memory.dmpFilesize
4KB
-
memory/2636-206-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/2752-196-0x0000000000405E28-mapping.dmp
-
memory/2904-219-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/2904-209-0x0000000000000000-mapping.dmp
-
memory/2976-220-0x0000000000000000-mapping.dmp