Analysis
-
max time kernel
151s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 00:10
Static task
static1
General
-
Target
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe
-
Size
335KB
-
MD5
9af7c644224929ee52dedb5137f08367
-
SHA1
00e7379eb5e58c6e66dcc968ebedca40d843ee2f
-
SHA256
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c
-
SHA512
048dfd169139bcf09ffa94fc3c08c96de9c0310b65242835df47fd1b5e0cf57f00861cd74b68f0dee7343c9d86db9068a19e5701b6dde9d2127d45cc20eaaa07
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
amadey
2.70
185.215.113.45/g4MbvE/index.php
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-133-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1244-134-0x0000000000418D06-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
Processes:
3F76.exe3F76.exe5A23.exe5A23.exe6DAC.exeFBD4.exeFBD4.exeFBD4.exesqtvvs.exesqtvvs.exepid process 3496 3F76.exe 1352 3F76.exe 1748 5A23.exe 1244 5A23.exe 1276 6DAC.exe 3428 FBD4.exe 3580 FBD4.exe 3532 FBD4.exe 3852 sqtvvs.exe 3168 sqtvvs.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6DAC.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6DAC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6DAC.exe -
Deletes itself 1 IoCs
Processes:
pid process 3000 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\6DAC.exe themida behavioral1/memory/1276-149-0x0000000000BA0000-0x0000000000BA1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
6DAC.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6DAC.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
6DAC.exepid process 1276 6DAC.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe3F76.exe5A23.exeFBD4.exesqtvvs.exedescription pid process target process PID 3760 set thread context of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3496 set thread context of 1352 3496 3F76.exe 3F76.exe PID 1748 set thread context of 1244 1748 5A23.exe 5A23.exe PID 3428 set thread context of 3532 3428 FBD4.exe FBD4.exe PID 3852 set thread context of 3168 3852 sqtvvs.exe sqtvvs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe3F76.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3F76.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3F76.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3F76.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1688 schtasks.exe 2552 schtasks.exe 1724 schtasks.exe -
Processes:
FBD4.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C FBD4.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e FBD4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 FBD4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 FBD4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 FBD4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exepid process 3552 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe 3552 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 3000 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3000 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe3F76.exepid process 3552 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe 1352 3F76.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
Processes:
5A23.exe6DAC.exeFBD4.exepowershell.exesqtvvs.exepowershell.exedescription pid process Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeDebugPrivilege 1244 5A23.exe Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeDebugPrivilege 1276 6DAC.exe Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeDebugPrivilege 3428 FBD4.exe Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 3852 sqtvvs.exe Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeDebugPrivilege 1764 powershell.exe Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 Token: SeShutdownPrivilege 3000 Token: SeCreatePagefilePrivilege 3000 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe3F76.exe5A23.exeFBD4.exeFBD4.exesqtvvs.exedescription pid process target process PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3760 wrote to memory of 3552 3760 f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe PID 3000 wrote to memory of 3496 3000 3F76.exe PID 3000 wrote to memory of 3496 3000 3F76.exe PID 3000 wrote to memory of 3496 3000 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3496 wrote to memory of 1352 3496 3F76.exe 3F76.exe PID 3000 wrote to memory of 1748 3000 5A23.exe PID 3000 wrote to memory of 1748 3000 5A23.exe PID 3000 wrote to memory of 1748 3000 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 1748 wrote to memory of 1244 1748 5A23.exe 5A23.exe PID 3000 wrote to memory of 1276 3000 6DAC.exe PID 3000 wrote to memory of 1276 3000 6DAC.exe PID 3000 wrote to memory of 1276 3000 6DAC.exe PID 3000 wrote to memory of 3428 3000 FBD4.exe PID 3000 wrote to memory of 3428 3000 FBD4.exe PID 3000 wrote to memory of 3428 3000 FBD4.exe PID 3428 wrote to memory of 832 3428 FBD4.exe powershell.exe PID 3428 wrote to memory of 832 3428 FBD4.exe powershell.exe PID 3428 wrote to memory of 832 3428 FBD4.exe powershell.exe PID 3428 wrote to memory of 1688 3428 FBD4.exe schtasks.exe PID 3428 wrote to memory of 1688 3428 FBD4.exe schtasks.exe PID 3428 wrote to memory of 1688 3428 FBD4.exe schtasks.exe PID 3428 wrote to memory of 3580 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3580 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3580 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3428 wrote to memory of 3532 3428 FBD4.exe FBD4.exe PID 3532 wrote to memory of 3852 3532 FBD4.exe sqtvvs.exe PID 3532 wrote to memory of 3852 3532 FBD4.exe sqtvvs.exe PID 3532 wrote to memory of 3852 3532 FBD4.exe sqtvvs.exe PID 3852 wrote to memory of 1764 3852 sqtvvs.exe powershell.exe PID 3852 wrote to memory of 1764 3852 sqtvvs.exe powershell.exe PID 3852 wrote to memory of 1764 3852 sqtvvs.exe powershell.exe PID 3852 wrote to memory of 2552 3852 sqtvvs.exe schtasks.exe PID 3852 wrote to memory of 2552 3852 sqtvvs.exe schtasks.exe PID 3852 wrote to memory of 2552 3852 sqtvvs.exe schtasks.exe PID 3852 wrote to memory of 3168 3852 sqtvvs.exe sqtvvs.exe PID 3852 wrote to memory of 3168 3852 sqtvvs.exe sqtvvs.exe PID 3852 wrote to memory of 3168 3852 sqtvvs.exe sqtvvs.exe PID 3852 wrote to memory of 3168 3852 sqtvvs.exe sqtvvs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe"C:\Users\Admin\AppData\Local\Temp\f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe"C:\Users\Admin\AppData\Local\Temp\f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3F76.exeC:\Users\Admin\AppData\Local\Temp\3F76.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F76.exeC:\Users\Admin\AppData\Local\Temp\3F76.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5A23.exeC:\Users\Admin\AppData\Local\Temp\5A23.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5A23.exeC:\Users\Admin\AppData\Local\Temp\5A23.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6DAC.exeC:\Users\Admin\AppData\Local\Temp\6DAC.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exeC:\Users\Admin\AppData\Local\Temp\FBD4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FBD4.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp938C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exe"C:\Users\Admin\AppData\Local\Temp\FBD4.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C06.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exe"C:\Users\Admin\AppData\Local\Temp\FBD4.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
e76686fec5c2554e4d517cea97b70ee0
SHA19a5e81d94c3178afae9d4cabf99b4e5159bfc02c
SHA2564d122af86946dd3f99b7eca4af8151f420db21c627eb6883bac5f12abcdf101b
SHA51261d8cd211e41e73be4d3c7a3966cd2e8e949f11fdd4f3bd4a42b2a476273f1680eb6c7640ecb0cec3e399c25799d150e2631e0ffb6c2b9c6b7c9961d084e7eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
9413c455af38f14ff664bb49b151903c
SHA19bc0ff597c433f911746eefeb64454e01e1cab50
SHA25695a28fa5a61fd0dbd19799b2ea321bc9a90b56e0a1abe2020e0bbb50339b77c3
SHA512dfcce638b4a8ea8c4c0ea7d69642673df44f18b1fe9c946b9c2e68b04a86243848590b4a444294109467f9e3f0ae71f417c7588592f022093ce441b7cf5c3878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5MD5
94da6c15cc23816fac1a5331975520c6
SHA11c2f27116ea9ad7e07755bde829e8d53dde9524f
SHA2565cfe8050df1262ab5baa79c255213f711910095dec19872a0e2998a23fecc7a9
SHA51216b7744f3d202b9d0fe7297d86fbfb7ba1b0595a075dbcf25f88a6b3e403d5912c278afeee40e250923314bef8f6d62f4e45c40681c26a6037301dddf2d95228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0MD5
04ec303f82240c776806a3f8807905f7
SHA1e0ae613eb468fb515d2b9f583b38ce0efc6acf75
SHA256cd7e53fc379f4836351f3b41bfb1113a408c59a530300b3a7095216a24c96048
SHA512548c00b81511da5b02d8402e2c20091c4cf1dbc26188fe513de220c8fa6776debc9f6f26a4c2f020625fe87effadf445ddf79c17d354a9353f5fc1efbd9ea47c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5A23.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
450125c6fdc4e8678da305c8a1df939e
SHA1a5008c513daefb3ae3b470d7eb43f19477d7dea3
SHA2563a8f4d8706c023631894f61e1b61666897ef6d82b16d03e213a1c2fc92b13010
SHA512de5dc5cdd79b19cf99fcf31f960e38faffa07420c63a8e96d5f2c69c85391e0dc01f9f05bc38ff62e3db3d3d3d707d5301bde3b6b0148cf54205eeb665094fd1
-
C:\Users\Admin\AppData\Local\Temp\15212481030822282825MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\3F76.exeMD5
9af7c644224929ee52dedb5137f08367
SHA100e7379eb5e58c6e66dcc968ebedca40d843ee2f
SHA256f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c
SHA512048dfd169139bcf09ffa94fc3c08c96de9c0310b65242835df47fd1b5e0cf57f00861cd74b68f0dee7343c9d86db9068a19e5701b6dde9d2127d45cc20eaaa07
-
C:\Users\Admin\AppData\Local\Temp\3F76.exeMD5
9af7c644224929ee52dedb5137f08367
SHA100e7379eb5e58c6e66dcc968ebedca40d843ee2f
SHA256f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c
SHA512048dfd169139bcf09ffa94fc3c08c96de9c0310b65242835df47fd1b5e0cf57f00861cd74b68f0dee7343c9d86db9068a19e5701b6dde9d2127d45cc20eaaa07
-
C:\Users\Admin\AppData\Local\Temp\3F76.exeMD5
9af7c644224929ee52dedb5137f08367
SHA100e7379eb5e58c6e66dcc968ebedca40d843ee2f
SHA256f830fb8657076351912107e53878b2eaa4a755bebcc7f6c90323c13fee8fe00c
SHA512048dfd169139bcf09ffa94fc3c08c96de9c0310b65242835df47fd1b5e0cf57f00861cd74b68f0dee7343c9d86db9068a19e5701b6dde9d2127d45cc20eaaa07
-
C:\Users\Admin\AppData\Local\Temp\5A23.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5A23.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5A23.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\6DAC.exeMD5
d0c332dd942a7b680063c4eca607f2c4
SHA1d57b7c95c258c968e7e2f5cd39bf52928cd587fd
SHA256756f3dc3ceb0db783e3f1cabd10ee6a3af4688147adde714cdea6f226e5f0024
SHA51270abbdaedfbc7ff4fb06ccd619ad812cb2731e7448d5055a414a609d048fc95067594e2ee74f35284d671b8d618d1914232e20d5cc7d862726a3138c4ec61019
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
C:\Users\Admin\AppData\Local\Temp\FBD4.exeMD5
89064b763c28aee6acd46af84406077e
SHA182c03a9a0e097c3eda89fb34615837c1bc2f7415
SHA25621eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9
SHA5125554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32
-
memory/832-204-0x0000000007B90000-0x0000000007B91000-memory.dmpFilesize
4KB
-
memory/832-186-0x0000000006840000-0x0000000006841000-memory.dmpFilesize
4KB
-
memory/832-198-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/832-196-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/832-195-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/832-202-0x0000000006882000-0x0000000006883000-memory.dmpFilesize
4KB
-
memory/832-205-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/832-208-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/832-187-0x0000000006EC0000-0x0000000006EC1000-memory.dmpFilesize
4KB
-
memory/832-199-0x0000000007840000-0x0000000007841000-memory.dmpFilesize
4KB
-
memory/832-183-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/832-215-0x0000000008F80000-0x0000000008FB3000-memory.dmpFilesize
204KB
-
memory/832-222-0x0000000008F40000-0x0000000008F41000-memory.dmpFilesize
4KB
-
memory/832-182-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/832-178-0x0000000000000000-mapping.dmp
-
memory/832-297-0x000000007E750000-0x000000007E751000-memory.dmpFilesize
4KB
-
memory/832-298-0x0000000006883000-0x0000000006884000-memory.dmpFilesize
4KB
-
memory/1244-161-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/1244-144-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/1244-160-0x0000000005D30000-0x0000000005D31000-memory.dmpFilesize
4KB
-
memory/1244-143-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/1244-141-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1244-140-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/1244-169-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/1244-168-0x0000000006A30000-0x0000000006A31000-memory.dmpFilesize
4KB
-
memory/1244-139-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/1244-159-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1244-142-0x0000000004DF0000-0x00000000053F6000-memory.dmpFilesize
6.0MB
-
memory/1244-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1244-162-0x0000000005DF0000-0x0000000005DF1000-memory.dmpFilesize
4KB
-
memory/1244-158-0x0000000005F10000-0x0000000005F11000-memory.dmpFilesize
4KB
-
memory/1244-134-0x0000000000418D06-mapping.dmp
-
memory/1276-145-0x0000000000000000-mapping.dmp
-
memory/1276-156-0x00000000773A0000-0x000000007752E000-memory.dmpFilesize
1.6MB
-
memory/1276-157-0x0000000005E80000-0x0000000005E81000-memory.dmpFilesize
4KB
-
memory/1276-149-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/1352-125-0x0000000000402E0C-mapping.dmp
-
memory/1516-455-0x0000000000000000-mapping.dmp
-
memory/1688-179-0x0000000000000000-mapping.dmp
-
memory/1724-456-0x0000000000000000-mapping.dmp
-
memory/1748-131-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/1748-128-0x0000000000000000-mapping.dmp
-
memory/1764-444-0x0000000000000000-mapping.dmp
-
memory/1764-491-0x0000000006533000-0x0000000006534000-memory.dmpFilesize
4KB
-
memory/1764-489-0x000000007E540000-0x000000007E541000-memory.dmpFilesize
4KB
-
memory/1764-466-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB
-
memory/1764-467-0x0000000006532000-0x0000000006533000-memory.dmpFilesize
4KB
-
memory/2112-459-0x0000000000000000-mapping.dmp
-
memory/2552-445-0x0000000000000000-mapping.dmp
-
memory/3000-127-0x0000000002690000-0x00000000026A6000-memory.dmpFilesize
88KB
-
memory/3000-119-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/3168-465-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3168-447-0x0000000000410AEC-mapping.dmp
-
memory/3428-175-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/3428-172-0x0000000000000000-mapping.dmp
-
memory/3428-177-0x0000000002981000-0x0000000002982000-memory.dmpFilesize
4KB
-
memory/3428-176-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3496-120-0x0000000000000000-mapping.dmp
-
memory/3532-181-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3532-201-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3532-184-0x0000000000410AEC-mapping.dmp
-
memory/3552-118-0x0000000000402E0C-mapping.dmp
-
memory/3552-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3760-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3852-188-0x0000000000000000-mapping.dmp
-
memory/3852-207-0x0000000002E51000-0x0000000002E52000-memory.dmpFilesize
4KB
-
memory/3852-203-0x0000000002E50000-0x0000000002E51000-memory.dmpFilesize
4KB
-
memory/3852-200-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB