Analysis
-
max time kernel
1216s -
max time network
1233s -
platform
windows10_x64 -
resource
win10-ja-20210920 -
submitted
21-10-2021 12:38
Static task
static1
Behavioral task
behavioral1
Sample
Tornado.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
Tornado.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
Tornado.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
Tornado.exe
Resource
win11
Behavioral task
behavioral5
Sample
Tornado.exe
Resource
win10-ja-20210920
Behavioral task
behavioral6
Sample
Tornado.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
Tornado.exe
Resource
win10-de-20210920
General
-
Target
Tornado.exe
-
Size
331.0MB
-
MD5
2acf755a8825894b837989ce1ae3db1d
-
SHA1
17d5590e64a1df1470e83f79eb935d78bc218c2d
-
SHA256
876dbe0fdf3f4ec70bd1985bf7c6f661b1105efd591407a6dd7ca7506bc61adf
-
SHA512
f5ca9da28f33097e92714f1e329d62fa8b98afe35bdaaf9e4941ad8f46c9350df74117b4712abc83c7bf44d6a1cb357b44bfb426d7ab0eeb88b3c813e99eef4b
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 8 IoCs
Processes:
tmpA6AC.tmp.exeNascondere.exe.comNascondere.exe.comRegAsm.exetmpA6AC.tmp.exeNascondere.exe.comNascondere.exe.comRegAsm.exepid process 1332 tmpA6AC.tmp.exe 2820 Nascondere.exe.com 3608 Nascondere.exe.com 2100 RegAsm.exe 2948 tmpA6AC.tmp.exe 3124 Nascondere.exe.com 1456 Nascondere.exe.com 3244 RegAsm.exe -
Drops startup file 1 IoCs
Processes:
Nascondere.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDUbsNmfa.url Nascondere.exe.com -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
tmpA6AC.tmp.exetmpA6AC.tmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmpA6AC.tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmpA6AC.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tmpA6AC.tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmpA6AC.tmp.exe -
Processes:
Tornado.exetmpA6AC.tmp.exetmpA6AC.tmp.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Tornado.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpA6AC.tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpA6AC.tmp.exe -
Drops file in System32 directory 4 IoCs
Processes:
OfficeC2RClient.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm OfficeC2RClient.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Nascondere.exe.comNascondere.exe.comdescription pid process target process PID 3608 set thread context of 2100 3608 Nascondere.exe.com RegAsm.exe PID 1456 set thread context of 3244 1456 Nascondere.exe.com RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 23 IoCs
Processes:
OfficeC2RClient.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeC2RClient.exe -
Modifies registry class 44 IoCs
Processes:
FileSyncConfig.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeRegAsm.exepid process 3204 powershell.exe 3204 powershell.exe 3204 powershell.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe 2100 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Tornado.exepowershell.exeRegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2392 Tornado.exe Token: SeDebugPrivilege 3204 powershell.exe Token: SeDebugPrivilege 2100 RegAsm.exe Token: SeDebugPrivilege 3244 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 356 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
Tornado.exetmpA6AC.tmp.execmd.execmd.exeNascondere.exe.comNascondere.exe.comtmpA6AC.tmp.execmd.execmd.exeNascondere.exe.comNascondere.exe.comdescription pid process target process PID 2392 wrote to memory of 3204 2392 Tornado.exe powershell.exe PID 2392 wrote to memory of 3204 2392 Tornado.exe powershell.exe PID 2392 wrote to memory of 3204 2392 Tornado.exe powershell.exe PID 2392 wrote to memory of 1332 2392 Tornado.exe tmpA6AC.tmp.exe PID 2392 wrote to memory of 1332 2392 Tornado.exe tmpA6AC.tmp.exe PID 2392 wrote to memory of 1332 2392 Tornado.exe tmpA6AC.tmp.exe PID 1332 wrote to memory of 3812 1332 tmpA6AC.tmp.exe dllhost.exe PID 1332 wrote to memory of 3812 1332 tmpA6AC.tmp.exe dllhost.exe PID 1332 wrote to memory of 3812 1332 tmpA6AC.tmp.exe dllhost.exe PID 1332 wrote to memory of 1700 1332 tmpA6AC.tmp.exe cmd.exe PID 1332 wrote to memory of 1700 1332 tmpA6AC.tmp.exe cmd.exe PID 1332 wrote to memory of 1700 1332 tmpA6AC.tmp.exe cmd.exe PID 1700 wrote to memory of 836 1700 cmd.exe cmd.exe PID 1700 wrote to memory of 836 1700 cmd.exe cmd.exe PID 1700 wrote to memory of 836 1700 cmd.exe cmd.exe PID 836 wrote to memory of 3076 836 cmd.exe findstr.exe PID 836 wrote to memory of 3076 836 cmd.exe findstr.exe PID 836 wrote to memory of 3076 836 cmd.exe findstr.exe PID 836 wrote to memory of 2820 836 cmd.exe Nascondere.exe.com PID 836 wrote to memory of 2820 836 cmd.exe Nascondere.exe.com PID 836 wrote to memory of 2820 836 cmd.exe Nascondere.exe.com PID 836 wrote to memory of 3084 836 cmd.exe PING.EXE PID 836 wrote to memory of 3084 836 cmd.exe PING.EXE PID 836 wrote to memory of 3084 836 cmd.exe PING.EXE PID 2820 wrote to memory of 3608 2820 Nascondere.exe.com Nascondere.exe.com PID 2820 wrote to memory of 3608 2820 Nascondere.exe.com Nascondere.exe.com PID 2820 wrote to memory of 3608 2820 Nascondere.exe.com Nascondere.exe.com PID 3608 wrote to memory of 2100 3608 Nascondere.exe.com RegAsm.exe PID 3608 wrote to memory of 2100 3608 Nascondere.exe.com RegAsm.exe PID 3608 wrote to memory of 2100 3608 Nascondere.exe.com RegAsm.exe PID 3608 wrote to memory of 2100 3608 Nascondere.exe.com RegAsm.exe PID 3608 wrote to memory of 2100 3608 Nascondere.exe.com RegAsm.exe PID 2392 wrote to memory of 2948 2392 Tornado.exe tmpA6AC.tmp.exe PID 2392 wrote to memory of 2948 2392 Tornado.exe tmpA6AC.tmp.exe PID 2392 wrote to memory of 2948 2392 Tornado.exe tmpA6AC.tmp.exe PID 2948 wrote to memory of 3880 2948 tmpA6AC.tmp.exe dllhost.exe PID 2948 wrote to memory of 3880 2948 tmpA6AC.tmp.exe dllhost.exe PID 2948 wrote to memory of 3880 2948 tmpA6AC.tmp.exe dllhost.exe PID 2948 wrote to memory of 2096 2948 tmpA6AC.tmp.exe cmd.exe PID 2948 wrote to memory of 2096 2948 tmpA6AC.tmp.exe cmd.exe PID 2948 wrote to memory of 2096 2948 tmpA6AC.tmp.exe cmd.exe PID 2096 wrote to memory of 1356 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 1356 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 1356 2096 cmd.exe cmd.exe PID 1356 wrote to memory of 2252 1356 cmd.exe findstr.exe PID 1356 wrote to memory of 2252 1356 cmd.exe findstr.exe PID 1356 wrote to memory of 2252 1356 cmd.exe findstr.exe PID 1356 wrote to memory of 3124 1356 cmd.exe Nascondere.exe.com PID 1356 wrote to memory of 3124 1356 cmd.exe Nascondere.exe.com PID 1356 wrote to memory of 3124 1356 cmd.exe Nascondere.exe.com PID 1356 wrote to memory of 3492 1356 cmd.exe PING.EXE PID 1356 wrote to memory of 3492 1356 cmd.exe PING.EXE PID 1356 wrote to memory of 3492 1356 cmd.exe PING.EXE PID 3124 wrote to memory of 1456 3124 Nascondere.exe.com Nascondere.exe.com PID 3124 wrote to memory of 1456 3124 Nascondere.exe.com Nascondere.exe.com PID 3124 wrote to memory of 1456 3124 Nascondere.exe.com Nascondere.exe.com PID 1456 wrote to memory of 3244 1456 Nascondere.exe.com RegAsm.exe PID 1456 wrote to memory of 3244 1456 Nascondere.exe.com RegAsm.exe PID 1456 wrote to memory of 3244 1456 Nascondere.exe.com RegAsm.exe PID 1456 wrote to memory of 3244 1456 Nascondere.exe.com RegAsm.exe PID 1456 wrote to memory of 3244 1456 Nascondere.exe.com RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tornado.exe"C:\Users\Admin\AppData\Local\Temp\Tornado.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAiAEMAOgBcACIA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Starne.mid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^kXhUbWhdyiSzQwKWBBZJjppRDRvuTjJfOgrsoBnWshULiZzcvfBNflRwOcsFmuvSnDFCYzOqeeaZfbKDnwKEL$" Sorte.mid5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comNascondere.exe.com W5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.com W6⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Starne.mid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^kXhUbWhdyiSzQwKWBBZJjppRDRvuTjJfOgrsoBnWshULiZzcvfBNflRwOcsFmuvSnDFCYzOqeeaZfbKDnwKEL$" Sorte.mid5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comNascondere.exe.com W5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.com W6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"1⤵
- Modifies registry class
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ambo.midMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ami.midMD5
c2a501f010bf7b1c7a9777c3b93e19ef
SHA1d00adfeb88b435786f32cf7f45c1aae141690600
SHA256312d9b0380e5d8fd0bbee92b5d7f22a09b9278cbd7457777a08e2df5a859aff9
SHA5122850ad61312adc4d059e62c7dfaebabaa74ac280773e24920b746a56884d8c490b1d5c6637d56c966ca284a9cd515330d38faff55cfe77a1bd11f54f2c82f6fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sorte.midMD5
ca6c6b8893411108280a0daf1a4d7d61
SHA1b791c3cdec5711baafa7be643d2d9a0a10ae0835
SHA25661b5e21e9798a8bf59a1c2e284d78d86706b4dc9bd6bef46bce54af95886bb46
SHA512c0f8c6e6c08a96d6bc9b77af1f300d45b011faa606c85b6220b89d890692d200230c16a206fa6c94a5f9e1568eb10181199a0d6b80b94f80706a5cd00f4fdbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Starne.midMD5
603011f56db8309b2d5c4ea0a1c57a47
SHA191ffdd8dbc6c5935c954f2764bec480ae32a1432
SHA2565e4c34d70260f9bc2ce9f44b8fdef503667493f8d7c9d13b659da3b270a053f0
SHA512b1d53112fb89fc755e3933e88bcabd1ce2a2aa0032c948530769d96d06ca066d106fcdf2127348e618c7aac8b24b21ddbbdbdfd5113a641dbcd2da217d9ebdbe
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ambo.midMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ami.midMD5
c2a501f010bf7b1c7a9777c3b93e19ef
SHA1d00adfeb88b435786f32cf7f45c1aae141690600
SHA256312d9b0380e5d8fd0bbee92b5d7f22a09b9278cbd7457777a08e2df5a859aff9
SHA5122850ad61312adc4d059e62c7dfaebabaa74ac280773e24920b746a56884d8c490b1d5c6637d56c966ca284a9cd515330d38faff55cfe77a1bd11f54f2c82f6fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sorte.midMD5
ca6c6b8893411108280a0daf1a4d7d61
SHA1b791c3cdec5711baafa7be643d2d9a0a10ae0835
SHA25661b5e21e9798a8bf59a1c2e284d78d86706b4dc9bd6bef46bce54af95886bb46
SHA512c0f8c6e6c08a96d6bc9b77af1f300d45b011faa606c85b6220b89d890692d200230c16a206fa6c94a5f9e1568eb10181199a0d6b80b94f80706a5cd00f4fdbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Starne.midMD5
603011f56db8309b2d5c4ea0a1c57a47
SHA191ffdd8dbc6c5935c954f2764bec480ae32a1432
SHA2565e4c34d70260f9bc2ce9f44b8fdef503667493f8d7c9d13b659da3b270a053f0
SHA512b1d53112fb89fc755e3933e88bcabd1ce2a2aa0032c948530769d96d06ca066d106fcdf2127348e618c7aac8b24b21ddbbdbdfd5113a641dbcd2da217d9ebdbe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
C:\Users\Admin\AppData\Local\Temp\tmpA6AC.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
memory/836-396-0x0000000000000000-mapping.dmp
-
memory/1332-390-0x0000000000000000-mapping.dmp
-
memory/1356-431-0x0000000000000000-mapping.dmp
-
memory/1456-443-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/1456-439-0x0000000000000000-mapping.dmp
-
memory/1700-394-0x0000000000000000-mapping.dmp
-
memory/2096-429-0x0000000000000000-mapping.dmp
-
memory/2100-419-0x0000000005850000-0x0000000005D4E000-memory.dmpFilesize
5.0MB
-
memory/2252-432-0x0000000000000000-mapping.dmp
-
memory/2392-118-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/2392-122-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/2392-123-0x00000000050A0000-0x000000000559E000-memory.dmpFilesize
5.0MB
-
memory/2392-121-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2392-124-0x00000000050A0000-0x000000000559E000-memory.dmpFilesize
5.0MB
-
memory/2392-120-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/2820-400-0x0000000000000000-mapping.dmp
-
memory/2948-426-0x0000000000000000-mapping.dmp
-
memory/3076-397-0x0000000000000000-mapping.dmp
-
memory/3084-402-0x0000000000000000-mapping.dmp
-
memory/3124-435-0x0000000000000000-mapping.dmp
-
memory/3204-139-0x0000000007EC0000-0x0000000007EC1000-memory.dmpFilesize
4KB
-
memory/3204-159-0x0000000009070000-0x00000000090A3000-memory.dmpFilesize
204KB
-
memory/3204-175-0x00000000094B0000-0x00000000094B1000-memory.dmpFilesize
4KB
-
memory/3204-138-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/3204-125-0x0000000000000000-mapping.dmp
-
memory/3204-172-0x0000000009370000-0x0000000009371000-memory.dmpFilesize
4KB
-
memory/3204-167-0x0000000009050000-0x0000000009051000-memory.dmpFilesize
4KB
-
memory/3204-137-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/3204-127-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/3204-147-0x0000000008EE0000-0x0000000008EE1000-memory.dmpFilesize
4KB
-
memory/3204-146-0x0000000009960000-0x0000000009961000-memory.dmpFilesize
4KB
-
memory/3204-142-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/3204-141-0x0000000008190000-0x0000000008191000-memory.dmpFilesize
4KB
-
memory/3204-136-0x0000000007880000-0x0000000007881000-memory.dmpFilesize
4KB
-
memory/3204-126-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/3204-176-0x00000000095A0000-0x00000000095A1000-memory.dmpFilesize
4KB
-
memory/3204-173-0x000000007F320000-0x000000007F321000-memory.dmpFilesize
4KB
-
memory/3204-174-0x0000000000CB3000-0x0000000000CB4000-memory.dmpFilesize
4KB
-
memory/3204-140-0x0000000008410000-0x0000000008411000-memory.dmpFilesize
4KB
-
memory/3204-135-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/3204-134-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/3204-128-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/3204-133-0x0000000006FF0000-0x0000000006FF1000-memory.dmpFilesize
4KB
-
memory/3204-129-0x0000000007000000-0x0000000007001000-memory.dmpFilesize
4KB
-
memory/3204-132-0x0000000000CB2000-0x0000000000CB3000-memory.dmpFilesize
4KB
-
memory/3204-131-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/3204-130-0x0000000006D40000-0x0000000006D41000-memory.dmpFilesize
4KB
-
memory/3244-459-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/3492-437-0x0000000000000000-mapping.dmp
-
memory/3608-408-0x0000000000A10000-0x0000000000B5A000-memory.dmpFilesize
1.3MB
-
memory/3608-404-0x0000000000000000-mapping.dmp
-
memory/3812-393-0x0000000000000000-mapping.dmp
-
memory/3880-428-0x0000000000000000-mapping.dmp