Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
13-11-2021 18:31
Static task
static1
Behavioral task
behavioral1
Sample
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe
Resource
win10-en-20211014
General
-
Target
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe
-
Size
316KB
-
MD5
3dc595617d7ce3860c1234d26fc65f35
-
SHA1
7c162129a02bcf0fd6716fb9dc1c96cb9374db66
-
SHA256
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca
-
SHA512
fe369912394988c04d73259d64d7d86c3e657ddf7f65b066c8f3ed29e1767e7613ddf18df1fad13782608fee91599c6062d81a52fbbf861c5b8e88404911e6b3
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
8dec62c1db2959619dca43e02fa46ad7bd606400
-
url4cnc
http://telegin.top/capibar
http://ttmirror.top/capibar
http://teletele.top/capibar
http://telegalive.top/capibar
http://toptelete.top/capibar
http://telegraf.top/capibar
https://t.me/capibar
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
redline
almZ
50.18.71.252:12081
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-150-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2804-151-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/3192-168-0x0000000002390000-0x00000000023AC000-memory.dmp family_redline behavioral1/memory/3192-170-0x00000000023E0000-0x00000000023FB000-memory.dmp family_redline behavioral1/memory/3616-238-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3616-239-0x0000000000418EF6-mapping.dmp family_redline behavioral1/memory/3616-249-0x0000000005700000-0x0000000005D06000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 1424 created 2164 1424 WerFault.exe 5362.exe PID 3480 created 2760 3480 WerFault.exe 3529.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
2120.exe25E4.exe28E3.exe2EFE.exe2120.exe3529.exe25E4.exe2EFE.exe3529.exe4F59.exe5362.exeRadiophony.exeRadiophony.exeRadiophony.exeB931.exeSIOFYL_.eXEpid process 3944 2120.exe 3456 25E4.exe 2652 28E3.exe 2376 2EFE.exe 3508 2120.exe 3576 3529.exe 2804 25E4.exe 3192 2EFE.exe 2760 3529.exe 2028 4F59.exe 2164 5362.exe 3320 Radiophony.exe 2664 Radiophony.exe 3616 Radiophony.exe 2608 B931.exe 1268 SIOFYL_.eXE -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4F59.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4F59.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4F59.exe -
Deletes itself 1 IoCs
Processes:
pid process 3020 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3040 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\4F59.exe themida behavioral1/memory/2028-193-0x0000000000EE0000-0x0000000000EE1000-memory.dmp themida -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
4F59.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4F59.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
4F59.exepid process 2028 4F59.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe2120.exe25E4.exe2EFE.exe3529.exeRadiophony.exedescription pid process target process PID 2724 set thread context of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 3944 set thread context of 3508 3944 2120.exe 2120.exe PID 3456 set thread context of 2804 3456 25E4.exe 25E4.exe PID 2376 set thread context of 3192 2376 2EFE.exe 2EFE.exe PID 3576 set thread context of 2760 3576 3529.exe 3529.exe PID 3320 set thread context of 3616 3320 Radiophony.exe Radiophony.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1424 2164 WerFault.exe 5362.exe 3480 2760 WerFault.exe 3529.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
28E3.exe471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28E3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28E3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 28E3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1132 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exepid process 3312 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 3312 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3020 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe28E3.exepid process 3312 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 2652 28E3.exe 3020 3020 3020 3020 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exe4F59.exe25E4.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeRestorePrivilege 1424 WerFault.exe Token: SeBackupPrivilege 1424 WerFault.exe Token: SeDebugPrivilege 2028 4F59.exe Token: SeDebugPrivilege 1424 WerFault.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 2804 25E4.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 1132 taskkill.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe2120.exe25E4.exe2EFE.exe3529.exe25E4.exeRadiophony.exedescription pid process target process PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 2724 wrote to memory of 3312 2724 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe 471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe PID 3020 wrote to memory of 3944 3020 2120.exe PID 3020 wrote to memory of 3944 3020 2120.exe PID 3020 wrote to memory of 3944 3020 2120.exe PID 3020 wrote to memory of 3456 3020 25E4.exe PID 3020 wrote to memory of 3456 3020 25E4.exe PID 3020 wrote to memory of 3456 3020 25E4.exe PID 3020 wrote to memory of 2652 3020 28E3.exe PID 3020 wrote to memory of 2652 3020 28E3.exe PID 3020 wrote to memory of 2652 3020 28E3.exe PID 3020 wrote to memory of 2376 3020 2EFE.exe PID 3020 wrote to memory of 2376 3020 2EFE.exe PID 3020 wrote to memory of 2376 3020 2EFE.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3944 wrote to memory of 3508 3944 2120.exe 2120.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3020 wrote to memory of 3576 3020 3529.exe PID 3020 wrote to memory of 3576 3020 3529.exe PID 3020 wrote to memory of 3576 3020 3529.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 3456 wrote to memory of 2804 3456 25E4.exe 25E4.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 2376 wrote to memory of 3192 2376 2EFE.exe 2EFE.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3576 wrote to memory of 2760 3576 3529.exe 3529.exe PID 3020 wrote to memory of 2028 3020 4F59.exe PID 3020 wrote to memory of 2028 3020 4F59.exe PID 3020 wrote to memory of 2028 3020 4F59.exe PID 3020 wrote to memory of 2164 3020 5362.exe PID 3020 wrote to memory of 2164 3020 5362.exe PID 3020 wrote to memory of 2164 3020 5362.exe PID 2804 wrote to memory of 3320 2804 25E4.exe Radiophony.exe PID 2804 wrote to memory of 3320 2804 25E4.exe Radiophony.exe PID 2804 wrote to memory of 3320 2804 25E4.exe Radiophony.exe PID 3320 wrote to memory of 2664 3320 Radiophony.exe Radiophony.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe"C:\Users\Admin\AppData\Local\Temp\471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe"C:\Users\Admin\AppData\Local\Temp\471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2120.exeC:\Users\Admin\AppData\Local\Temp\2120.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2120.exeC:\Users\Admin\AppData\Local\Temp\2120.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\25E4.exeC:\Users\Admin\AppData\Local\Temp\25E4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25E4.exeC:\Users\Admin\AppData\Local\Temp\25E4.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exe"C:\Users\Admin\AppData\Local\Temp\Radiophony.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeC:\Users\Admin\AppData\Local\Temp\Radiophony.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeC:\Users\Admin\AppData\Local\Temp\Radiophony.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\28E3.exeC:\Users\Admin\AppData\Local\Temp\28E3.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2EFE.exeC:\Users\Admin\AppData\Local\Temp\2EFE.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2EFE.exeC:\Users\Admin\AppData\Local\Temp\2EFE.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3529.exeC:\Users\Admin\AppData\Local\Temp\3529.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3529.exeC:\Users\Admin\AppData\Local\Temp\3529.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 12163⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4F59.exeC:\Users\Admin\AppData\Local\Temp\4F59.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5362.exeC:\Users\Admin\AppData\Local\Temp\5362.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\B931.exeC:\Users\Admin\AppData\Local\Temp\B931.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\B931.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\B931.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\B931.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\B931.exe" ) do taskkill -f /iM "%~NXS"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "B931.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\25E4.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Radiophony.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\2120.exeMD5
3dc595617d7ce3860c1234d26fc65f35
SHA17c162129a02bcf0fd6716fb9dc1c96cb9374db66
SHA256471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca
SHA512fe369912394988c04d73259d64d7d86c3e657ddf7f65b066c8f3ed29e1767e7613ddf18df1fad13782608fee91599c6062d81a52fbbf861c5b8e88404911e6b3
-
C:\Users\Admin\AppData\Local\Temp\2120.exeMD5
3dc595617d7ce3860c1234d26fc65f35
SHA17c162129a02bcf0fd6716fb9dc1c96cb9374db66
SHA256471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca
SHA512fe369912394988c04d73259d64d7d86c3e657ddf7f65b066c8f3ed29e1767e7613ddf18df1fad13782608fee91599c6062d81a52fbbf861c5b8e88404911e6b3
-
C:\Users\Admin\AppData\Local\Temp\2120.exeMD5
3dc595617d7ce3860c1234d26fc65f35
SHA17c162129a02bcf0fd6716fb9dc1c96cb9374db66
SHA256471d43827ff96112bb7948bac3492ecb9389583413cb708ce7b3a62891d601ca
SHA512fe369912394988c04d73259d64d7d86c3e657ddf7f65b066c8f3ed29e1767e7613ddf18df1fad13782608fee91599c6062d81a52fbbf861c5b8e88404911e6b3
-
C:\Users\Admin\AppData\Local\Temp\25E4.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\25E4.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\25E4.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\28E3.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\28E3.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\2EFE.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\2EFE.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\2EFE.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\3529.exeMD5
84dd06d1e6237944e337d213947e1949
SHA1ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5
SHA25672f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SHA51213f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb
-
C:\Users\Admin\AppData\Local\Temp\3529.exeMD5
84dd06d1e6237944e337d213947e1949
SHA1ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5
SHA25672f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SHA51213f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb
-
C:\Users\Admin\AppData\Local\Temp\3529.exeMD5
84dd06d1e6237944e337d213947e1949
SHA1ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5
SHA25672f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30
SHA51213f6ff60279e089f3aefb6c57f760bc1377d0452baff33c707be5ff502df01258b5ed6527e729084549a0f50c0af95a412b583abc1779841d9c072f21bea32fb
-
C:\Users\Admin\AppData\Local\Temp\4F59.exeMD5
a70df5f0cab9a6a58d218fb4f2ef9aec
SHA1d90bf3b4493e6ad834293ea1549e26e10325479d
SHA2560384bc178166e6c703d82b4b0c976a697c6ccc9e9c679ec8c5485f45bc4e057b
SHA5124d9e9bf1f97efd2e1c870d8bdaf2dfe783856ab7845a2a0d1de889efad97fb087abe6eea1d30d4c9145e0302e860330895cea50dcdb179ab473fb2874a07731f
-
C:\Users\Admin\AppData\Local\Temp\5362.exeMD5
ee45056503a95c6fe8992f739225a3db
SHA1a2450dd669389c43ca3c88afc5738ffaa6918d03
SHA256d5151ae2398b510107975a3744e0a4321d53d09eca55c9f64aeaca226d5fcce7
SHA51246b288f74865411d59a6db857e0ff06bc513a5dd48acd03f2d69e9dbdad3fc0ac5d06e81a200f712dd2759fbb532c4901c06683691f309f26166887de49d43c9
-
C:\Users\Admin\AppData\Local\Temp\5362.exeMD5
ee45056503a95c6fe8992f739225a3db
SHA1a2450dd669389c43ca3c88afc5738ffaa6918d03
SHA256d5151ae2398b510107975a3744e0a4321d53d09eca55c9f64aeaca226d5fcce7
SHA51246b288f74865411d59a6db857e0ff06bc513a5dd48acd03f2d69e9dbdad3fc0ac5d06e81a200f712dd2759fbb532c4901c06683691f309f26166887de49d43c9
-
C:\Users\Admin\AppData\Local\Temp\B931.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\B931.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeMD5
e639300660165b56b26ae9e713bd2ccd
SHA15adad051d0ba86205809c645d18b2beb956da656
SHA256d25b9fd890934c9c49a43526314e53ec784c0e2cbb54c158bd134aba50de686e
SHA512792ea87cce0929bbf03d9c8775067124298f4fd83405b562ddcd2a0b69e0c0579b14a33508ba4b972f40c8dca8bd84df05ae5fa220f25cb933e7be738e11ce1e
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeMD5
e639300660165b56b26ae9e713bd2ccd
SHA15adad051d0ba86205809c645d18b2beb956da656
SHA256d25b9fd890934c9c49a43526314e53ec784c0e2cbb54c158bd134aba50de686e
SHA512792ea87cce0929bbf03d9c8775067124298f4fd83405b562ddcd2a0b69e0c0579b14a33508ba4b972f40c8dca8bd84df05ae5fa220f25cb933e7be738e11ce1e
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeMD5
e639300660165b56b26ae9e713bd2ccd
SHA15adad051d0ba86205809c645d18b2beb956da656
SHA256d25b9fd890934c9c49a43526314e53ec784c0e2cbb54c158bd134aba50de686e
SHA512792ea87cce0929bbf03d9c8775067124298f4fd83405b562ddcd2a0b69e0c0579b14a33508ba4b972f40c8dca8bd84df05ae5fa220f25cb933e7be738e11ce1e
-
C:\Users\Admin\AppData\Local\Temp\Radiophony.exeMD5
e639300660165b56b26ae9e713bd2ccd
SHA15adad051d0ba86205809c645d18b2beb956da656
SHA256d25b9fd890934c9c49a43526314e53ec784c0e2cbb54c158bd134aba50de686e
SHA512792ea87cce0929bbf03d9c8775067124298f4fd83405b562ddcd2a0b69e0c0579b14a33508ba4b972f40c8dca8bd84df05ae5fa220f25cb933e7be738e11ce1e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Yg_aN9.gRpMD5
646fb393fff5b974da129da2dcde1aa1
SHA1639efe5f008ddffb9b4c0bd06773b198b833ebd9
SHA2567b63f960869ad11639f85d4695af6f88f40228395f3002e433f4ca81b4066c74
SHA512bd79d041a96b316fe956afdd33a836f9a8295c82ade486bad31039642d2a053433dc75791f13a8d992ec83f1dcba1bb77702f8cb28b56a4d528c033b94978c81
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\bprOiu.zBMD5
86dc79cb9031fb1e291bf2091a69ab6f
SHA117a9fe0b846e8693a61e4aa511a045fe098d0272
SHA2563f3563a59114f06564bbfcaa430fe3877d3ad3a4d08718f4276837cf77013fc4
SHA512018d3938639cf3588953ff51af4732a1b9f3552af7a6c9d636603843f6af3aeae847f63721611ea4ce5d058ff3b327d064097180c224fe2fb1dd963b3741d355
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\owfJ6vgN.CMD5
bdca5b52db43179994feba7b4d5311b2
SHA1624070067704b92f86a4c66a3a9e2d1d27640ec8
SHA25649412aec14728ea100c65dfe310b69f3d6195e87eb775396389fb99d2851412f
SHA5127f8ca5bf448a838c2ab6ef4935b52e1024ff1b073a393dbbab54eaad3f214c8d40a26bc47eb13088357a254a9913dadd1f906cfffbf801703bd17355b937c3b6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wX0cjy.AMD5
1afc9659205fcc0c5d64a0f684c46ac9
SHA1e9f2a975a447a3e45f6b7daed001dd87bfc0965d
SHA256c4b04f412a7c17722f28e4ee34df10051d94ebd055589668c9e602e18fc411bb
SHA512e41efb16fbf4027abde654c7a9ca7a198ef1d40721f0d44530ba2b07eda6d758ccd22675da66baf81f2b64d56acea2db46d8c178b0c30d6fbb1311c62fa1de5f
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/956-264-0x0000000000000000-mapping.dmp
-
memory/1132-269-0x0000000000000000-mapping.dmp
-
memory/1208-261-0x0000000000000000-mapping.dmp
-
memory/1208-272-0x0000000000860000-0x00000000008CB000-memory.dmpFilesize
428KB
-
memory/1208-270-0x00000000008D0000-0x0000000000944000-memory.dmpFilesize
464KB
-
memory/1268-265-0x0000000000000000-mapping.dmp
-
memory/1336-281-0x0000000000000000-mapping.dmp
-
memory/2028-224-0x0000000006680000-0x0000000006681000-memory.dmpFilesize
4KB
-
memory/2028-186-0x0000000000000000-mapping.dmp
-
memory/2028-204-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/2028-193-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/2028-199-0x00000000772E0000-0x000000007746E000-memory.dmpFilesize
1.6MB
-
memory/2164-194-0x0000000000000000-mapping.dmp
-
memory/2164-217-0x00000000046B0000-0x000000000473F000-memory.dmpFilesize
572KB
-
memory/2164-218-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/2376-135-0x0000000000000000-mapping.dmp
-
memory/2376-163-0x0000000002E16000-0x0000000002E39000-memory.dmpFilesize
140KB
-
memory/2376-174-0x0000000002C40000-0x0000000002C70000-memory.dmpFilesize
192KB
-
memory/2540-260-0x0000000000000000-mapping.dmp
-
memory/2608-255-0x0000000000000000-mapping.dmp
-
memory/2652-133-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/2652-136-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2652-126-0x0000000000000000-mapping.dmp
-
memory/2652-134-0x00000000004C0000-0x000000000060A000-memory.dmpFilesize
1.3MB
-
memory/2664-280-0x0000000000000000-mapping.dmp
-
memory/2724-116-0x0000000004860000-0x0000000004869000-memory.dmpFilesize
36KB
-
memory/2760-206-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2760-182-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2760-189-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2760-183-0x0000000000402998-mapping.dmp
-
memory/2760-209-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2760-208-0x0000000000770000-0x00000000007FE000-memory.dmpFilesize
568KB
-
memory/2760-207-0x00000000004A0000-0x00000000004EE000-memory.dmpFilesize
312KB
-
memory/2804-155-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/2804-214-0x00000000068C0000-0x00000000068C1000-memory.dmpFilesize
4KB
-
memory/2804-162-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/2804-205-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/2804-157-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/2804-167-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/2804-151-0x0000000000418EEA-mapping.dmp
-
memory/2804-150-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2804-212-0x0000000005EE0000-0x0000000005EE1000-memory.dmpFilesize
4KB
-
memory/2804-156-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/2804-215-0x0000000006FC0000-0x0000000006FC1000-memory.dmpFilesize
4KB
-
memory/2804-161-0x0000000004E90000-0x0000000005496000-memory.dmpFilesize
6.0MB
-
memory/2964-274-0x0000000000000000-mapping.dmp
-
memory/3020-160-0x0000000002970000-0x0000000002986000-memory.dmpFilesize
88KB
-
memory/3020-119-0x0000000000820000-0x0000000000836000-memory.dmpFilesize
88KB
-
memory/3040-290-0x0000000004CB0000-0x0000000004D65000-memory.dmpFilesize
724KB
-
memory/3040-291-0x0000000004E30000-0x0000000004EE4000-memory.dmpFilesize
720KB
-
memory/3040-287-0x0000000000000000-mapping.dmp
-
memory/3192-176-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/3192-168-0x0000000002390000-0x00000000023AC000-memory.dmpFilesize
112KB
-
memory/3192-175-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3192-181-0x0000000004973000-0x0000000004974000-memory.dmpFilesize
4KB
-
memory/3192-178-0x0000000004974000-0x0000000004976000-memory.dmpFilesize
8KB
-
memory/3192-180-0x0000000004972000-0x0000000004973000-memory.dmpFilesize
4KB
-
memory/3192-165-0x000000000040CD2F-mapping.dmp
-
memory/3192-164-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3192-170-0x00000000023E0000-0x00000000023FB000-memory.dmpFilesize
108KB
-
memory/3312-118-0x0000000000402DD8-mapping.dmp
-
memory/3312-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3320-227-0x0000000000000000-mapping.dmp
-
memory/3320-236-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3320-230-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3448-278-0x0000000000000000-mapping.dmp
-
memory/3456-132-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3456-131-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/3456-141-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/3456-137-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/3456-123-0x0000000000000000-mapping.dmp
-
memory/3456-129-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/3508-143-0x0000000000402DD8-mapping.dmp
-
memory/3576-185-0x00000000048E0000-0x0000000004943000-memory.dmpFilesize
396KB
-
memory/3576-146-0x0000000000000000-mapping.dmp
-
memory/3576-187-0x0000000004990000-0x0000000004A00000-memory.dmpFilesize
448KB
-
memory/3576-149-0x0000000002E66000-0x0000000002EDE000-memory.dmpFilesize
480KB
-
memory/3576-158-0x00000000046F0000-0x0000000004773000-memory.dmpFilesize
524KB
-
memory/3576-159-0x0000000000400000-0x0000000002BB3000-memory.dmpFilesize
39.7MB
-
memory/3616-249-0x0000000005700000-0x0000000005D06000-memory.dmpFilesize
6.0MB
-
memory/3616-239-0x0000000000418EF6-mapping.dmp
-
memory/3616-238-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3628-275-0x0000000000000000-mapping.dmp
-
memory/3676-276-0x0000000000D00000-0x0000000000D07000-memory.dmpFilesize
28KB
-
memory/3676-277-0x0000000000CF0000-0x0000000000CFC000-memory.dmpFilesize
48KB
-
memory/3676-273-0x0000000000000000-mapping.dmp
-
memory/3796-279-0x0000000000000000-mapping.dmp
-
memory/3944-120-0x0000000000000000-mapping.dmp
-
memory/3944-140-0x0000000002DE6000-0x0000000002DF7000-memory.dmpFilesize
68KB
-
memory/3944-145-0x0000000002B50000-0x0000000002C9A000-memory.dmpFilesize
1.3MB