Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
13-11-2021 23:53
Static task
static1
Behavioral task
behavioral1
Sample
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe
Resource
win10-en-20211104
General
-
Target
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe
-
Size
315KB
-
MD5
839fe7599fb992911978dffdbc92885a
-
SHA1
e7108362f287155863b2c846bd5185a23595bf53
-
SHA256
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60
-
SHA512
67159fe50d68b6ba17e39eb5a1572939481aa182224ad621b0b1e04a66d09d1d40409e8e22fa45e4162887ecf5ddcc7e8d228c88b07d17aa857045287de6adb9
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
redline
imbest
45.153.186.153:56675
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3100-152-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3100-153-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/1332-170-0x00000000020E0000-0x00000000020FC000-memory.dmp family_redline behavioral1/memory/1332-172-0x0000000004920000-0x000000000493B000-memory.dmp family_redline behavioral1/memory/320-238-0x0000000004890000-0x00000000048BD000-memory.dmp family_redline behavioral1/memory/320-240-0x0000000004C70000-0x0000000004C9C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2660 created 816 2660 WerFault.exe FB0.exe -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
FACC.exeFF51.exe240.exe83C.exeFACC.exeFB0.exeFF51.exe83C.exe221F.exe788D.exeSIOFYL_.eXE82CF.exepid process 520 FACC.exe 380 FF51.exe 3140 240.exe 4192 83C.exe 536 FACC.exe 816 FB0.exe 3100 FF51.exe 1332 83C.exe 1808 221F.exe 1304 788D.exe 4632 SIOFYL_.eXE 320 82CF.exe -
Deletes itself 1 IoCs
Processes:
pid process 2436 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1188 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exeFACC.exeFF51.exe83C.exedescription pid process target process PID 2124 set thread context of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 520 set thread context of 536 520 FACC.exe FACC.exe PID 380 set thread context of 3100 380 FF51.exe FF51.exe PID 4192 set thread context of 1332 4192 83C.exe 83C.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2660 816 WerFault.exe FB0.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe240.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 240.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 240.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4620 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exepid process 4028 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 4028 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2436 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe240.exepid process 4028 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 3140 240.exe 2436 2436 2436 2436 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeFF51.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeRestorePrivilege 2660 WerFault.exe Token: SeBackupPrivilege 2660 WerFault.exe Token: SeDebugPrivilege 2660 WerFault.exe Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeDebugPrivilege 3100 FF51.exe Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeDebugPrivilege 4620 taskkill.exe Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exeFF51.exeFACC.exe83C.exe788D.exemshta.execmd.exeSIOFYL_.eXEdescription pid process target process PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2124 wrote to memory of 4028 2124 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe 74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe PID 2436 wrote to memory of 520 2436 FACC.exe PID 2436 wrote to memory of 520 2436 FACC.exe PID 2436 wrote to memory of 520 2436 FACC.exe PID 2436 wrote to memory of 380 2436 FF51.exe PID 2436 wrote to memory of 380 2436 FF51.exe PID 2436 wrote to memory of 380 2436 FF51.exe PID 2436 wrote to memory of 3140 2436 240.exe PID 2436 wrote to memory of 3140 2436 240.exe PID 2436 wrote to memory of 3140 2436 240.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 2436 wrote to memory of 4192 2436 83C.exe PID 2436 wrote to memory of 4192 2436 83C.exe PID 2436 wrote to memory of 4192 2436 83C.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 520 wrote to memory of 536 520 FACC.exe FACC.exe PID 2436 wrote to memory of 816 2436 FB0.exe PID 2436 wrote to memory of 816 2436 FB0.exe PID 2436 wrote to memory of 816 2436 FB0.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 380 wrote to memory of 3100 380 FF51.exe FF51.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 4192 wrote to memory of 1332 4192 83C.exe 83C.exe PID 2436 wrote to memory of 1808 2436 221F.exe PID 2436 wrote to memory of 1808 2436 221F.exe PID 2436 wrote to memory of 1808 2436 221F.exe PID 2436 wrote to memory of 1304 2436 788D.exe PID 2436 wrote to memory of 1304 2436 788D.exe PID 2436 wrote to memory of 1304 2436 788D.exe PID 1304 wrote to memory of 1260 1304 788D.exe mshta.exe PID 1304 wrote to memory of 1260 1304 788D.exe mshta.exe PID 1304 wrote to memory of 1260 1304 788D.exe mshta.exe PID 1260 wrote to memory of 4916 1260 mshta.exe cmd.exe PID 1260 wrote to memory of 4916 1260 mshta.exe cmd.exe PID 1260 wrote to memory of 4916 1260 mshta.exe cmd.exe PID 4916 wrote to memory of 4632 4916 cmd.exe SIOFYL_.eXE PID 4916 wrote to memory of 4632 4916 cmd.exe SIOFYL_.eXE PID 4916 wrote to memory of 4632 4916 cmd.exe SIOFYL_.eXE PID 4916 wrote to memory of 4620 4916 cmd.exe taskkill.exe PID 4916 wrote to memory of 4620 4916 cmd.exe taskkill.exe PID 4916 wrote to memory of 4620 4916 cmd.exe taskkill.exe PID 4632 wrote to memory of 2784 4632 SIOFYL_.eXE mshta.exe PID 4632 wrote to memory of 2784 4632 SIOFYL_.eXE mshta.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe"C:\Users\Admin\AppData\Local\Temp\74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe"C:\Users\Admin\AppData\Local\Temp\74b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FACC.exeC:\Users\Admin\AppData\Local\Temp\FACC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FACC.exeC:\Users\Admin\AppData\Local\Temp\FACC.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FF51.exeC:\Users\Admin\AppData\Local\Temp\FF51.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FF51.exeC:\Users\Admin\AppData\Local\Temp\FF51.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\240.exeC:\Users\Admin\AppData\Local\Temp\240.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\83C.exeC:\Users\Admin\AppData\Local\Temp\83C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\83C.exeC:\Users\Admin\AppData\Local\Temp\83C.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FB0.exeC:\Users\Admin\AppData\Local\Temp\FB0.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 6762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\221F.exeC:\Users\Admin\AppData\Local\Temp\221F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\788D.exeC:\Users\Admin\AppData\Local\Temp\788D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\788D.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\788D.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\788D.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\788D.exe" ) do taskkill -f /iM "%~NXS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "788D.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\82CF.exeC:\Users\Admin\AppData\Local\Temp\82CF.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FF51.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\221F.exeMD5
ffbb7bec9668b5e0496d59b209feebad
SHA1090542335b499fa8a618e6fec6dd62772710996c
SHA25630a2b243996af346243dacf92e14caf4fc7d2fefaabdc900797f4d5c700be730
SHA51284dcc00651a3172c6749aea0dccaa0a66d63c3c320c9aad71ebcf6f24a0ff1d0f2063675b41cdc8b594c2a235dcba569e357a8767028320ec9d605fedbdd1284
-
C:\Users\Admin\AppData\Local\Temp\221F.exeMD5
ffbb7bec9668b5e0496d59b209feebad
SHA1090542335b499fa8a618e6fec6dd62772710996c
SHA25630a2b243996af346243dacf92e14caf4fc7d2fefaabdc900797f4d5c700be730
SHA51284dcc00651a3172c6749aea0dccaa0a66d63c3c320c9aad71ebcf6f24a0ff1d0f2063675b41cdc8b594c2a235dcba569e357a8767028320ec9d605fedbdd1284
-
C:\Users\Admin\AppData\Local\Temp\240.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\240.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\788D.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\788D.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\82CF.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\82CF.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\83C.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\83C.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\83C.exeMD5
99f2718e43c7dd72454247eeb62293c1
SHA150b99c43edc80fe00b337da36824cf41b9f805d1
SHA2561d445744c48ab5c42c6debade8ac246f53e7bf29c59b11c94e38808917eac264
SHA51238b0c27da0892fcff952260ce4328e9748f799b96a0d8bc8210c49868d113660b5641516ae019e2048437c1c56f474b2ed00fac2b19441572328c7dc577ee419
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\FACC.exeMD5
839fe7599fb992911978dffdbc92885a
SHA1e7108362f287155863b2c846bd5185a23595bf53
SHA25674b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60
SHA51267159fe50d68b6ba17e39eb5a1572939481aa182224ad621b0b1e04a66d09d1d40409e8e22fa45e4162887ecf5ddcc7e8d228c88b07d17aa857045287de6adb9
-
C:\Users\Admin\AppData\Local\Temp\FACC.exeMD5
839fe7599fb992911978dffdbc92885a
SHA1e7108362f287155863b2c846bd5185a23595bf53
SHA25674b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60
SHA51267159fe50d68b6ba17e39eb5a1572939481aa182224ad621b0b1e04a66d09d1d40409e8e22fa45e4162887ecf5ddcc7e8d228c88b07d17aa857045287de6adb9
-
C:\Users\Admin\AppData\Local\Temp\FACC.exeMD5
839fe7599fb992911978dffdbc92885a
SHA1e7108362f287155863b2c846bd5185a23595bf53
SHA25674b7f4a2a43055b2810a8cd5aa3474b170ab62982e081edaeaaa4d6a37b05a60
SHA51267159fe50d68b6ba17e39eb5a1572939481aa182224ad621b0b1e04a66d09d1d40409e8e22fa45e4162887ecf5ddcc7e8d228c88b07d17aa857045287de6adb9
-
C:\Users\Admin\AppData\Local\Temp\FB0.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\FB0.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\FF51.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\FF51.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\FF51.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Yg_aN9.gRpMD5
646fb393fff5b974da129da2dcde1aa1
SHA1639efe5f008ddffb9b4c0bd06773b198b833ebd9
SHA2567b63f960869ad11639f85d4695af6f88f40228395f3002e433f4ca81b4066c74
SHA512bd79d041a96b316fe956afdd33a836f9a8295c82ade486bad31039642d2a053433dc75791f13a8d992ec83f1dcba1bb77702f8cb28b56a4d528c033b94978c81
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\bprOiu.zBMD5
86dc79cb9031fb1e291bf2091a69ab6f
SHA117a9fe0b846e8693a61e4aa511a045fe098d0272
SHA2563f3563a59114f06564bbfcaa430fe3877d3ad3a4d08718f4276837cf77013fc4
SHA512018d3938639cf3588953ff51af4732a1b9f3552af7a6c9d636603843f6af3aeae847f63721611ea4ce5d058ff3b327d064097180c224fe2fb1dd963b3741d355
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\owfJ6vgN.CMD5
bdca5b52db43179994feba7b4d5311b2
SHA1624070067704b92f86a4c66a3a9e2d1d27640ec8
SHA25649412aec14728ea100c65dfe310b69f3d6195e87eb775396389fb99d2851412f
SHA5127f8ca5bf448a838c2ab6ef4935b52e1024ff1b073a393dbbab54eaad3f214c8d40a26bc47eb13088357a254a9913dadd1f906cfffbf801703bd17355b937c3b6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wX0cjy.AMD5
1afc9659205fcc0c5d64a0f684c46ac9
SHA1e9f2a975a447a3e45f6b7daed001dd87bfc0965d
SHA256c4b04f412a7c17722f28e4ee34df10051d94ebd055589668c9e602e18fc411bb
SHA512e41efb16fbf4027abde654c7a9ca7a198ef1d40721f0d44530ba2b07eda6d758ccd22675da66baf81f2b64d56acea2db46d8c178b0c30d6fbb1311c62fa1de5f
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/320-218-0x0000000000000000-mapping.dmp
-
memory/320-251-0x0000000004724000-0x0000000004726000-memory.dmpFilesize
8KB
-
memory/320-250-0x0000000004723000-0x0000000004724000-memory.dmpFilesize
4KB
-
memory/320-238-0x0000000004890000-0x00000000048BD000-memory.dmpFilesize
180KB
-
memory/320-240-0x0000000004C70000-0x0000000004C9C000-memory.dmpFilesize
176KB
-
memory/320-246-0x00000000046A0000-0x00000000046D9000-memory.dmpFilesize
228KB
-
memory/320-249-0x0000000004722000-0x0000000004723000-memory.dmpFilesize
4KB
-
memory/320-248-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/320-247-0x0000000000400000-0x0000000002B61000-memory.dmpFilesize
39.4MB
-
memory/380-131-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/380-133-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/380-129-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/380-126-0x0000000000000000-mapping.dmp
-
memory/380-136-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/380-137-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/520-148-0x0000000002780000-0x00000000028CA000-memory.dmpFilesize
1.3MB
-
memory/520-123-0x0000000000000000-mapping.dmp
-
memory/520-144-0x0000000002A36000-0x0000000002A47000-memory.dmpFilesize
68KB
-
memory/536-146-0x0000000000402DD8-mapping.dmp
-
memory/688-214-0x0000000000000000-mapping.dmp
-
memory/816-186-0x00000000047F0000-0x000000000487F000-memory.dmpFilesize
572KB
-
memory/816-185-0x0000000002C96000-0x0000000002CE6000-memory.dmpFilesize
320KB
-
memory/816-149-0x0000000000000000-mapping.dmp
-
memory/816-187-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/1188-234-0x0000000004F70000-0x0000000005024000-memory.dmpFilesize
720KB
-
memory/1188-226-0x0000000000000000-mapping.dmp
-
memory/1188-257-0x00000000050E0000-0x0000000005179000-memory.dmpFilesize
612KB
-
memory/1188-256-0x0000000005030000-0x00000000050DD000-memory.dmpFilesize
692KB
-
memory/1188-233-0x0000000004DF0000-0x0000000004EA5000-memory.dmpFilesize
724KB
-
memory/1260-204-0x0000000000000000-mapping.dmp
-
memory/1284-217-0x0000000000000000-mapping.dmp
-
memory/1304-202-0x0000000002E40000-0x0000000002E41000-memory.dmpFilesize
4KB
-
memory/1304-201-0x0000000002E40000-0x0000000002E41000-memory.dmpFilesize
4KB
-
memory/1304-199-0x0000000000000000-mapping.dmp
-
memory/1332-172-0x0000000004920000-0x000000000493B000-memory.dmpFilesize
108KB
-
memory/1332-183-0x0000000004AB3000-0x0000000004AB4000-memory.dmpFilesize
4KB
-
memory/1332-170-0x00000000020E0000-0x00000000020FC000-memory.dmpFilesize
112KB
-
memory/1332-169-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1332-166-0x000000000040CD2F-mapping.dmp
-
memory/1332-181-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/1332-184-0x0000000004AB4000-0x0000000004AB6000-memory.dmpFilesize
8KB
-
memory/1332-165-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1332-182-0x0000000004AB2000-0x0000000004AB3000-memory.dmpFilesize
4KB
-
memory/1476-216-0x0000000000000000-mapping.dmp
-
memory/1612-230-0x0000000003320000-0x0000000003394000-memory.dmpFilesize
464KB
-
memory/1612-229-0x0000000000000000-mapping.dmp
-
memory/1612-231-0x00000000032B0000-0x000000000331B000-memory.dmpFilesize
428KB
-
memory/1620-236-0x0000000000E90000-0x0000000000E9C000-memory.dmpFilesize
48KB
-
memory/1620-235-0x0000000000EA0000-0x0000000000EA7000-memory.dmpFilesize
28KB
-
memory/1620-232-0x0000000000000000-mapping.dmp
-
memory/1808-195-0x0000000000400000-0x00000000027B5000-memory.dmpFilesize
35.7MB
-
memory/1808-194-0x0000000004450000-0x00000000044DF000-memory.dmpFilesize
572KB
-
memory/1808-193-0x00000000029C6000-0x0000000002A16000-memory.dmpFilesize
320KB
-
memory/1808-178-0x0000000000000000-mapping.dmp
-
memory/1980-213-0x0000000000000000-mapping.dmp
-
memory/2124-118-0x0000000002AE6000-0x0000000002AF6000-memory.dmpFilesize
64KB
-
memory/2124-119-0x0000000002780000-0x00000000028CA000-memory.dmpFilesize
1.3MB
-
memory/2436-163-0x00000000033F0000-0x0000000003406000-memory.dmpFilesize
88KB
-
memory/2436-122-0x0000000001320000-0x0000000001336000-memory.dmpFilesize
88KB
-
memory/2784-212-0x0000000000000000-mapping.dmp
-
memory/3100-196-0x00000000070C0000-0x00000000070C1000-memory.dmpFilesize
4KB
-
memory/3100-158-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/3100-157-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/3100-153-0x0000000000418EEA-mapping.dmp
-
memory/3100-152-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3100-188-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3100-159-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/3100-160-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/3100-161-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/3100-162-0x0000000005480000-0x0000000005A86000-memory.dmpFilesize
6.0MB
-
memory/3100-197-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/3100-190-0x0000000006450000-0x0000000006451000-memory.dmpFilesize
4KB
-
memory/3140-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3140-132-0x0000000000000000-mapping.dmp
-
memory/3140-141-0x0000000000630000-0x0000000000638000-memory.dmpFilesize
32KB
-
memory/3140-142-0x0000000000640000-0x0000000000649000-memory.dmpFilesize
36KB
-
memory/4028-121-0x0000000000402DD8-mapping.dmp
-
memory/4028-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4192-138-0x0000000000000000-mapping.dmp
-
memory/4192-167-0x0000000004360000-0x0000000004390000-memory.dmpFilesize
192KB
-
memory/4620-209-0x0000000000000000-mapping.dmp
-
memory/4632-210-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/4632-206-0x0000000000000000-mapping.dmp
-
memory/4632-208-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/4664-215-0x0000000000000000-mapping.dmp
-
memory/4916-205-0x0000000000000000-mapping.dmp