Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
01-12-2021 16:42
Static task
static1
Behavioral task
behavioral1
Sample
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe
Resource
win10-en-20211104
General
-
Target
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe
-
Size
313KB
-
MD5
f48787dadec381826ea5c640b1955262
-
SHA1
1cac7f67fb14a676de816b0fc793d976a553d256
-
SHA256
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a
-
SHA512
3f09fe3e0e8341761f67cbd8106df7e17c6d9a328b544b2cf6ce1d50ddfb01f4303f22a26c31e8efbe3457663434793c55d01748888c35bd694ebb8d7cf27816
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/916-150-0x00000000025D0000-0x00000000025FE000-memory.dmp family_redline behavioral1/memory/916-153-0x0000000002640000-0x000000000266C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
33CE.exeSmartClock.exe5D01.exeA8C1.exepid process 748 33CE.exe 4372 SmartClock.exe 4236 5D01.exe 916 A8C1.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2416 -
Drops startup file 1 IoCs
Processes:
33CE.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 33CE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1060 3752 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe5D01.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5D01.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5D01.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5D01.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1660 ipconfig.exe 2172 NETSTAT.EXE 3860 NETSTAT.EXE 4072 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F3E7DC4-401F-11EC-B34F-E2F174782A9A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 4372 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exepid process 3932 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe 3932 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2416 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe5D01.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3932 03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe 4236 5D01.exe 2416 2416 2416 2416 2416 2416 3356 explorer.exe 3356 explorer.exe 2416 2416 1092 explorer.exe 1092 explorer.exe 2416 2416 4880 explorer.exe 4880 explorer.exe 2416 2416 3780 explorer.exe 3780 explorer.exe 2416 2416 4560 explorer.exe 4560 explorer.exe 4560 explorer.exe 4560 explorer.exe 2416 2416 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe 4228 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
A8C1.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 916 A8C1.exe Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: 36 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: 36 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 2688 WMIC.exe Token: SeSecurityPrivilege 2688 WMIC.exe Token: SeTakeOwnershipPrivilege 2688 WMIC.exe Token: SeLoadDriverPrivilege 2688 WMIC.exe Token: SeSystemProfilePrivilege 2688 WMIC.exe Token: SeSystemtimePrivilege 2688 WMIC.exe Token: SeProfSingleProcessPrivilege 2688 WMIC.exe Token: SeIncBasePriorityPrivilege 2688 WMIC.exe Token: SeCreatePagefilePrivilege 2688 WMIC.exe Token: SeBackupPrivilege 2688 WMIC.exe Token: SeRestorePrivilege 2688 WMIC.exe Token: SeShutdownPrivilege 2688 WMIC.exe Token: SeDebugPrivilege 2688 WMIC.exe Token: SeSystemEnvironmentPrivilege 2688 WMIC.exe Token: SeRemoteShutdownPrivilege 2688 WMIC.exe Token: SeUndockPrivilege 2688 WMIC.exe Token: SeManageVolumePrivilege 2688 WMIC.exe Token: 33 2688 WMIC.exe Token: 34 2688 WMIC.exe Token: 35 2688 WMIC.exe Token: 36 2688 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4172 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4172 iexplore.exe 4172 iexplore.exe 3960 IEXPLORE.EXE 3960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33CE.execmd.exenet.exenet.exenet.exedescription pid process target process PID 2416 wrote to memory of 748 2416 33CE.exe PID 2416 wrote to memory of 748 2416 33CE.exe PID 2416 wrote to memory of 748 2416 33CE.exe PID 748 wrote to memory of 4372 748 33CE.exe SmartClock.exe PID 748 wrote to memory of 4372 748 33CE.exe SmartClock.exe PID 748 wrote to memory of 4372 748 33CE.exe SmartClock.exe PID 2416 wrote to memory of 4236 2416 5D01.exe PID 2416 wrote to memory of 4236 2416 5D01.exe PID 2416 wrote to memory of 4236 2416 5D01.exe PID 2416 wrote to memory of 916 2416 A8C1.exe PID 2416 wrote to memory of 916 2416 A8C1.exe PID 2416 wrote to memory of 916 2416 A8C1.exe PID 2416 wrote to memory of 1908 2416 cmd.exe PID 2416 wrote to memory of 1908 2416 cmd.exe PID 1908 wrote to memory of 2512 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2512 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2688 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2688 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2768 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2768 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2260 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2260 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 4520 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 4520 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 4988 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 4988 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 5044 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 5044 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2604 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2604 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1060 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1060 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1204 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1204 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2780 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2780 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 408 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 408 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2208 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 2208 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1404 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1404 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1660 1908 cmd.exe ipconfig.exe PID 1908 wrote to memory of 1660 1908 cmd.exe ipconfig.exe PID 1908 wrote to memory of 1844 1908 cmd.exe ROUTE.EXE PID 1908 wrote to memory of 1844 1908 cmd.exe ROUTE.EXE PID 1908 wrote to memory of 1212 1908 cmd.exe netsh.exe PID 1908 wrote to memory of 1212 1908 cmd.exe netsh.exe PID 1908 wrote to memory of 4476 1908 cmd.exe systeminfo.exe PID 1908 wrote to memory of 4476 1908 cmd.exe systeminfo.exe PID 1908 wrote to memory of 4364 1908 cmd.exe tasklist.exe PID 1908 wrote to memory of 4364 1908 cmd.exe tasklist.exe PID 1908 wrote to memory of 3800 1908 cmd.exe net.exe PID 1908 wrote to memory of 3800 1908 cmd.exe net.exe PID 3800 wrote to memory of 1556 3800 net.exe net1.exe PID 3800 wrote to memory of 1556 3800 net.exe net1.exe PID 1908 wrote to memory of 4968 1908 cmd.exe net.exe PID 1908 wrote to memory of 4968 1908 cmd.exe net.exe PID 4968 wrote to memory of 1804 4968 net.exe net1.exe PID 4968 wrote to memory of 1804 4968 net.exe net1.exe PID 1908 wrote to memory of 2940 1908 cmd.exe net.exe PID 1908 wrote to memory of 2940 1908 cmd.exe net.exe PID 2940 wrote to memory of 2620 2940 net.exe net1.exe PID 2940 wrote to memory of 2620 2940 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3752 -s 8922⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe"C:\Users\Admin\AppData\Local\Temp\03217dbdfb4fa798c9907a751a6c013cac5529b51f11070039ad37754d58d35a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\33CE.exeC:\Users\Admin\AppData\Local\Temp\33CE.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\5D01.exeC:\Users\Admin\AppData\Local\Temp\5D01.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A8C1.exeC:\Users\Admin\AppData\Local\Temp\A8C1.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4172 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\33CE.exeMD5
26110ee8425d26a250ac41e69ae3f188
SHA11f1f74eb28b993221f4f582c71237b23165c2c9a
SHA2560548e595246ebb701d8f42270c1d0d482268722b526c1578a8b1ff50009f8799
SHA5126743b6b334a9ab7b34a324b2e1afb6ef7db31ccecf64f71a23a3ffc29bc5fceb752ba5b9dfaa86decebc24152e072f0518b2249ea3dd084c30bbc7e6030a8a8f
-
C:\Users\Admin\AppData\Local\Temp\33CE.exeMD5
26110ee8425d26a250ac41e69ae3f188
SHA11f1f74eb28b993221f4f582c71237b23165c2c9a
SHA2560548e595246ebb701d8f42270c1d0d482268722b526c1578a8b1ff50009f8799
SHA5126743b6b334a9ab7b34a324b2e1afb6ef7db31ccecf64f71a23a3ffc29bc5fceb752ba5b9dfaa86decebc24152e072f0518b2249ea3dd084c30bbc7e6030a8a8f
-
C:\Users\Admin\AppData\Local\Temp\5D01.exeMD5
1df18eee77b7bdb425fa8079112ac215
SHA122e2b8857247c1d90c8b2d8c4abe45f17b552270
SHA256c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896
SHA512a1e81b2acb729ba53007c65bf6949453034d44a573be7d18c6371886cb8c8626b2ef75f6ac401b0cf2b816d211f87d16440fe6d1e6873c344ddf6ca1e8089dbe
-
C:\Users\Admin\AppData\Local\Temp\5D01.exeMD5
1df18eee77b7bdb425fa8079112ac215
SHA122e2b8857247c1d90c8b2d8c4abe45f17b552270
SHA256c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896
SHA512a1e81b2acb729ba53007c65bf6949453034d44a573be7d18c6371886cb8c8626b2ef75f6ac401b0cf2b816d211f87d16440fe6d1e6873c344ddf6ca1e8089dbe
-
C:\Users\Admin\AppData\Local\Temp\A8C1.exeMD5
60702e0b373aa3c38622549787b734f9
SHA14b71e8d37c246e55491cc91370b7a74aae914c94
SHA256eb8388bfaeb302bf07d07c8b0ad59eb71e4f43b05c47198e78946eacd0e829a3
SHA51258a02d0f1b94ecfc2bf8738eff96029bc34df8011121b9b7a1d268baf473b882a0b72db5a3ce61cd5bc135de66472ef412236b39bfdd001e9ea055fbee1903d6
-
C:\Users\Admin\AppData\Local\Temp\A8C1.exeMD5
60702e0b373aa3c38622549787b734f9
SHA14b71e8d37c246e55491cc91370b7a74aae914c94
SHA256eb8388bfaeb302bf07d07c8b0ad59eb71e4f43b05c47198e78946eacd0e829a3
SHA51258a02d0f1b94ecfc2bf8738eff96029bc34df8011121b9b7a1d268baf473b882a0b72db5a3ce61cd5bc135de66472ef412236b39bfdd001e9ea055fbee1903d6
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
26110ee8425d26a250ac41e69ae3f188
SHA11f1f74eb28b993221f4f582c71237b23165c2c9a
SHA2560548e595246ebb701d8f42270c1d0d482268722b526c1578a8b1ff50009f8799
SHA5126743b6b334a9ab7b34a324b2e1afb6ef7db31ccecf64f71a23a3ffc29bc5fceb752ba5b9dfaa86decebc24152e072f0518b2249ea3dd084c30bbc7e6030a8a8f
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
26110ee8425d26a250ac41e69ae3f188
SHA11f1f74eb28b993221f4f582c71237b23165c2c9a
SHA2560548e595246ebb701d8f42270c1d0d482268722b526c1578a8b1ff50009f8799
SHA5126743b6b334a9ab7b34a324b2e1afb6ef7db31ccecf64f71a23a3ffc29bc5fceb752ba5b9dfaa86decebc24152e072f0518b2249ea3dd084c30bbc7e6030a8a8f
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/408-180-0x0000000000000000-mapping.dmp
-
memory/748-122-0x0000000000000000-mapping.dmp
-
memory/748-126-0x00000000007A0000-0x0000000000831000-memory.dmpFilesize
580KB
-
memory/748-127-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/748-125-0x00000000006B1000-0x0000000000731000-memory.dmpFilesize
512KB
-
memory/916-141-0x0000000000000000-mapping.dmp
-
memory/916-146-0x0000000000400000-0x00000000004EB000-memory.dmpFilesize
940KB
-
memory/916-181-0x0000000006770000-0x0000000006771000-memory.dmpFilesize
4KB
-
memory/916-163-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/916-161-0x0000000004DB4000-0x0000000004DB6000-memory.dmpFilesize
8KB
-
memory/916-179-0x0000000006440000-0x0000000006441000-memory.dmpFilesize
4KB
-
memory/916-160-0x0000000004DB3000-0x0000000004DB4000-memory.dmpFilesize
4KB
-
memory/916-177-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/916-182-0x0000000006940000-0x0000000006941000-memory.dmpFilesize
4KB
-
memory/916-159-0x0000000004DB2000-0x0000000004DB3000-memory.dmpFilesize
4KB
-
memory/916-156-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/916-157-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/916-145-0x00000000001C0000-0x00000000001F9000-memory.dmpFilesize
228KB
-
memory/916-176-0x0000000006290000-0x0000000006291000-memory.dmpFilesize
4KB
-
memory/916-175-0x0000000005BF0000-0x0000000005BF1000-memory.dmpFilesize
4KB
-
memory/916-158-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/916-150-0x00000000025D0000-0x00000000025FE000-memory.dmpFilesize
184KB
-
memory/916-155-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/916-152-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/916-153-0x0000000002640000-0x000000000266C000-memory.dmpFilesize
176KB
-
memory/916-154-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/1060-173-0x0000000000000000-mapping.dmp
-
memory/1060-301-0x000002646D710000-0x000002646D711000-memory.dmpFilesize
4KB
-
memory/1092-277-0x0000000000930000-0x0000000000939000-memory.dmpFilesize
36KB
-
memory/1092-278-0x0000000000920000-0x000000000092E000-memory.dmpFilesize
56KB
-
memory/1092-276-0x0000000000000000-mapping.dmp
-
memory/1204-174-0x0000000000000000-mapping.dmp
-
memory/1212-187-0x0000000000000000-mapping.dmp
-
memory/1264-169-0x0000017F2C5C0000-0x0000017F2C5C2000-memory.dmpFilesize
8KB
-
memory/1264-168-0x0000017F2C5C0000-0x0000017F2C5C2000-memory.dmpFilesize
8KB
-
memory/1404-184-0x0000000000000000-mapping.dmp
-
memory/1556-191-0x0000000000000000-mapping.dmp
-
memory/1660-185-0x0000000000000000-mapping.dmp
-
memory/1804-193-0x0000000000000000-mapping.dmp
-
memory/1844-186-0x0000000000000000-mapping.dmp
-
memory/1908-151-0x0000000000000000-mapping.dmp
-
memory/2132-196-0x0000000000000000-mapping.dmp
-
memory/2172-204-0x0000000000000000-mapping.dmp
-
memory/2208-183-0x0000000000000000-mapping.dmp
-
memory/2260-166-0x0000000000000000-mapping.dmp
-
memory/2416-210-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2416-212-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2416-148-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2416-140-0x0000000004360000-0x0000000004376000-memory.dmpFilesize
88KB
-
memory/2416-147-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2416-149-0x0000000005150000-0x000000000515F000-memory.dmpFilesize
60KB
-
memory/2416-121-0x0000000000940000-0x0000000000956000-memory.dmpFilesize
88KB
-
memory/2416-213-0x0000000005160000-0x0000000005162000-memory.dmpFilesize
8KB
-
memory/2492-295-0x0000026267490000-0x0000026267491000-memory.dmpFilesize
4KB
-
memory/2504-296-0x0000017E41DF0000-0x0000017E41DF1000-memory.dmpFilesize
4KB
-
memory/2512-162-0x0000000000000000-mapping.dmp
-
memory/2604-172-0x0000000000000000-mapping.dmp
-
memory/2620-195-0x0000000000000000-mapping.dmp
-
memory/2624-268-0x0000000003200000-0x0000000003275000-memory.dmpFilesize
468KB
-
memory/2624-269-0x0000000002F80000-0x0000000002FEB000-memory.dmpFilesize
428KB
-
memory/2624-264-0x0000000000000000-mapping.dmp
-
memory/2688-164-0x0000000000000000-mapping.dmp
-
memory/2740-297-0x0000014E7D170000-0x0000014E7D171000-memory.dmpFilesize
4KB
-
memory/2768-165-0x0000000000000000-mapping.dmp
-
memory/2780-178-0x0000000000000000-mapping.dmp
-
memory/2940-194-0x0000000000000000-mapping.dmp
-
memory/3092-200-0x0000000000000000-mapping.dmp
-
memory/3356-273-0x0000000000000000-mapping.dmp
-
memory/3356-275-0x00000000001E0000-0x00000000001EB000-memory.dmpFilesize
44KB
-
memory/3356-274-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/3468-298-0x0000024805690000-0x0000024805691000-memory.dmpFilesize
4KB
-
memory/3644-201-0x0000000000000000-mapping.dmp
-
memory/3664-198-0x0000000000000000-mapping.dmp
-
memory/3780-285-0x0000000000590000-0x000000000059C000-memory.dmpFilesize
48KB
-
memory/3780-284-0x00000000005A0000-0x00000000005A6000-memory.dmpFilesize
24KB
-
memory/3780-283-0x0000000000000000-mapping.dmp
-
memory/3788-271-0x0000000000DF0000-0x0000000000DF7000-memory.dmpFilesize
28KB
-
memory/3788-270-0x0000000000000000-mapping.dmp
-
memory/3788-272-0x0000000000DE0000-0x0000000000DEC000-memory.dmpFilesize
48KB
-
memory/3800-190-0x0000000000000000-mapping.dmp
-
memory/3820-197-0x0000000000000000-mapping.dmp
-
memory/3860-207-0x0000000000000000-mapping.dmp
-
memory/3932-119-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3932-120-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB
-
memory/3960-239-0x0000000000000000-mapping.dmp
-
memory/4012-208-0x0000000000000000-mapping.dmp
-
memory/4072-209-0x0000000000000000-mapping.dmp
-
memory/4172-235-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-218-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-220-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-221-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-222-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-223-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-224-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-226-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-227-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-228-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-230-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-231-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-232-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-234-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-279-0x000001B136A80000-0x000001B136A81000-memory.dmpFilesize
4KB
-
memory/4172-236-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-237-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-219-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-240-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-241-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-243-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-244-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-246-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-248-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-249-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-250-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-302-0x000001B136A90000-0x000001B136A91000-memory.dmpFilesize
4KB
-
memory/4172-216-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-300-0x000001B138B80000-0x000001B138B81000-memory.dmpFilesize
4KB
-
memory/4172-299-0x000001B138B80000-0x000001B138B81000-memory.dmpFilesize
4KB
-
memory/4172-215-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-214-0x00007FFB595B0000-0x00007FFB5961B000-memory.dmpFilesize
428KB
-
memory/4172-286-0x000001B138AD0000-0x000001B138AD1000-memory.dmpFilesize
4KB
-
memory/4228-292-0x0000000000000000-mapping.dmp
-
memory/4228-293-0x0000000000FE0000-0x0000000000FE7000-memory.dmpFilesize
28KB
-
memory/4228-294-0x0000000000FD0000-0x0000000000FDD000-memory.dmpFilesize
52KB
-
memory/4236-134-0x0000000000000000-mapping.dmp
-
memory/4236-138-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4236-139-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB
-
memory/4236-137-0x0000000000731000-0x0000000000742000-memory.dmpFilesize
68KB
-
memory/4364-189-0x0000000000000000-mapping.dmp
-
memory/4372-291-0x00000000001E0000-0x00000000001EB000-memory.dmpFilesize
44KB
-
memory/4372-128-0x0000000000000000-mapping.dmp
-
memory/4372-131-0x0000000000781000-0x0000000000801000-memory.dmpFilesize
512KB
-
memory/4372-133-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/4372-132-0x0000000000640000-0x000000000078A000-memory.dmpFilesize
1.3MB
-
memory/4372-290-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/4396-202-0x0000000000000000-mapping.dmp
-
memory/4444-199-0x0000000000000000-mapping.dmp
-
memory/4476-188-0x0000000000000000-mapping.dmp
-
memory/4520-167-0x0000000000000000-mapping.dmp
-
memory/4560-287-0x0000000000000000-mapping.dmp
-
memory/4560-288-0x00000000004F0000-0x00000000004F6000-memory.dmpFilesize
24KB
-
memory/4560-289-0x00000000004E0000-0x00000000004EB000-memory.dmpFilesize
44KB
-
memory/4880-281-0x0000000000490000-0x0000000000495000-memory.dmpFilesize
20KB
-
memory/4880-282-0x0000000000480000-0x0000000000489000-memory.dmpFilesize
36KB
-
memory/4880-280-0x0000000000000000-mapping.dmp
-
memory/4968-192-0x0000000000000000-mapping.dmp
-
memory/4988-170-0x0000000000000000-mapping.dmp
-
memory/4992-206-0x0000000000000000-mapping.dmp
-
memory/5008-205-0x0000000000000000-mapping.dmp
-
memory/5044-171-0x0000000000000000-mapping.dmp