Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
01-12-2021 20:05
Static task
static1
Behavioral task
behavioral1
Sample
5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe
Resource
win10-en-20211014
General
-
Target
5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe
-
Size
319KB
-
MD5
a5d5cfdc12acabf8618f4da7dea265b0
-
SHA1
96f5ee0d4184b7a073a51a20084353604ffe8906
-
SHA256
5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a
-
SHA512
1facfe7a1b7edc1fcd1b4d97e140626bc830914d5c6fe82786f35a6dcc7ea65bf07af3755a5ffa2c868c532c83e8a1eced09f67f92c390333a91298c1e09f49b
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2832-152-0x00000000022B0000-0x00000000022DE000-memory.dmp family_redline behavioral1/memory/2832-158-0x0000000002820000-0x000000000284C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
B235.exeSmartClock.exeD907.exe401F.exepid process 3776 B235.exe 3400 SmartClock.exe 2708 D907.exe 2832 401F.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2792 -
Drops startup file 1 IoCs
Processes:
B235.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk B235.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3084 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
D907.exe5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D907.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D907.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D907.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3108 ipconfig.exe 2156 NETSTAT.EXE 3692 NETSTAT.EXE 3108 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55C70E1A-52E2-11EC-B8A2-52576DE11831} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 3400 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exepid process 1752 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe 1752 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2792 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exeD907.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1752 5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe 2708 D907.exe 2792 2792 2792 2792 2792 2792 3504 explorer.exe 3504 explorer.exe 2792 2792 2400 explorer.exe 2400 explorer.exe 2792 2792 3096 explorer.exe 3096 explorer.exe 2792 2792 1788 explorer.exe 1788 explorer.exe 2792 2792 2444 explorer.exe 2444 explorer.exe 2444 explorer.exe 2444 explorer.exe 2792 2792 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe 2772 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeShutdownPrivilege 2792 Token: SeCreatePagefilePrivilege 2792 Token: SeIncreaseQuotaPrivilege 1316 WMIC.exe Token: SeSecurityPrivilege 1316 WMIC.exe Token: SeTakeOwnershipPrivilege 1316 WMIC.exe Token: SeLoadDriverPrivilege 1316 WMIC.exe Token: SeSystemProfilePrivilege 1316 WMIC.exe Token: SeSystemtimePrivilege 1316 WMIC.exe Token: SeProfSingleProcessPrivilege 1316 WMIC.exe Token: SeIncBasePriorityPrivilege 1316 WMIC.exe Token: SeCreatePagefilePrivilege 1316 WMIC.exe Token: SeBackupPrivilege 1316 WMIC.exe Token: SeRestorePrivilege 1316 WMIC.exe Token: SeShutdownPrivilege 1316 WMIC.exe Token: SeDebugPrivilege 1316 WMIC.exe Token: SeSystemEnvironmentPrivilege 1316 WMIC.exe Token: SeRemoteShutdownPrivilege 1316 WMIC.exe Token: SeUndockPrivilege 1316 WMIC.exe Token: SeManageVolumePrivilege 1316 WMIC.exe Token: 33 1316 WMIC.exe Token: 34 1316 WMIC.exe Token: 35 1316 WMIC.exe Token: 36 1316 WMIC.exe Token: SeIncreaseQuotaPrivilege 1316 WMIC.exe Token: SeSecurityPrivilege 1316 WMIC.exe Token: SeTakeOwnershipPrivilege 1316 WMIC.exe Token: SeLoadDriverPrivilege 1316 WMIC.exe Token: SeSystemProfilePrivilege 1316 WMIC.exe Token: SeSystemtimePrivilege 1316 WMIC.exe Token: SeProfSingleProcessPrivilege 1316 WMIC.exe Token: SeIncBasePriorityPrivilege 1316 WMIC.exe Token: SeCreatePagefilePrivilege 1316 WMIC.exe Token: SeBackupPrivilege 1316 WMIC.exe Token: SeRestorePrivilege 1316 WMIC.exe Token: SeShutdownPrivilege 1316 WMIC.exe Token: SeDebugPrivilege 1316 WMIC.exe Token: SeSystemEnvironmentPrivilege 1316 WMIC.exe Token: SeRemoteShutdownPrivilege 1316 WMIC.exe Token: SeUndockPrivilege 1316 WMIC.exe Token: SeManageVolumePrivilege 1316 WMIC.exe Token: 33 1316 WMIC.exe Token: 34 1316 WMIC.exe Token: 35 1316 WMIC.exe Token: 36 1316 WMIC.exe Token: SeIncreaseQuotaPrivilege 1592 WMIC.exe Token: SeSecurityPrivilege 1592 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3612 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3612 iexplore.exe 3612 iexplore.exe 1356 IEXPLORE.EXE 1356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
B235.execmd.exenet.exenet.exenet.exedescription pid process target process PID 2792 wrote to memory of 3776 2792 B235.exe PID 2792 wrote to memory of 3776 2792 B235.exe PID 2792 wrote to memory of 3776 2792 B235.exe PID 3776 wrote to memory of 3400 3776 B235.exe SmartClock.exe PID 3776 wrote to memory of 3400 3776 B235.exe SmartClock.exe PID 3776 wrote to memory of 3400 3776 B235.exe SmartClock.exe PID 2792 wrote to memory of 2708 2792 D907.exe PID 2792 wrote to memory of 2708 2792 D907.exe PID 2792 wrote to memory of 2708 2792 D907.exe PID 2792 wrote to memory of 2832 2792 401F.exe PID 2792 wrote to memory of 2832 2792 401F.exe PID 2792 wrote to memory of 2832 2792 401F.exe PID 2792 wrote to memory of 3980 2792 cmd.exe PID 2792 wrote to memory of 3980 2792 cmd.exe PID 3980 wrote to memory of 1316 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1316 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1592 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1592 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3680 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3680 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3004 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3004 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3160 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3160 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2720 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2720 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1312 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1312 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2576 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2576 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2116 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2116 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3096 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3096 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1560 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1560 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2352 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2352 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2440 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2440 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1964 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1964 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3108 3980 cmd.exe ipconfig.exe PID 3980 wrote to memory of 3108 3980 cmd.exe ipconfig.exe PID 3980 wrote to memory of 3112 3980 cmd.exe ROUTE.EXE PID 3980 wrote to memory of 3112 3980 cmd.exe ROUTE.EXE PID 3980 wrote to memory of 2820 3980 cmd.exe netsh.exe PID 3980 wrote to memory of 2820 3980 cmd.exe netsh.exe PID 3980 wrote to memory of 3156 3980 cmd.exe systeminfo.exe PID 3980 wrote to memory of 3156 3980 cmd.exe systeminfo.exe PID 3980 wrote to memory of 2708 3980 cmd.exe tasklist.exe PID 3980 wrote to memory of 2708 3980 cmd.exe tasklist.exe PID 3980 wrote to memory of 3172 3980 cmd.exe net.exe PID 3980 wrote to memory of 3172 3980 cmd.exe net.exe PID 3172 wrote to memory of 2372 3172 net.exe net1.exe PID 3172 wrote to memory of 2372 3172 net.exe net1.exe PID 3980 wrote to memory of 2364 3980 cmd.exe net.exe PID 3980 wrote to memory of 2364 3980 cmd.exe net.exe PID 2364 wrote to memory of 1884 2364 net.exe net1.exe PID 2364 wrote to memory of 1884 2364 net.exe net1.exe PID 3980 wrote to memory of 348 3980 cmd.exe net.exe PID 3980 wrote to memory of 348 3980 cmd.exe net.exe PID 348 wrote to memory of 2096 348 net.exe net1.exe PID 348 wrote to memory of 2096 348 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9242⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe"C:\Users\Admin\AppData\Local\Temp\5e34bc8a509290e054eb833d6c5f75be5f633d19e366214e3f1b7e8b0ab1915a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\B235.exeC:\Users\Admin\AppData\Local\Temp\B235.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\D907.exeC:\Users\Admin\AppData\Local\Temp\D907.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\401F.exeC:\Users\Admin\AppData\Local\Temp\401F.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3612 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\401F.exeMD5
9d3e819df9a8a67380d4b0bc252dc924
SHA14c534e98b763ae1de0dc572d230b58f9e6ba6f2f
SHA256302dc96a5163e27b3f2d05620fe61f95acd751064af720f9855719e79aaafeeb
SHA5126ae1f36276d5e5e1e73e948988b2399e8e9cf3c166acc770e3dd435b8afeec78afce377f99546b165c6ebf9977d52701a677d6d4cb3ea420e4e52b42dabbf70b
-
C:\Users\Admin\AppData\Local\Temp\401F.exeMD5
9d3e819df9a8a67380d4b0bc252dc924
SHA14c534e98b763ae1de0dc572d230b58f9e6ba6f2f
SHA256302dc96a5163e27b3f2d05620fe61f95acd751064af720f9855719e79aaafeeb
SHA5126ae1f36276d5e5e1e73e948988b2399e8e9cf3c166acc770e3dd435b8afeec78afce377f99546b165c6ebf9977d52701a677d6d4cb3ea420e4e52b42dabbf70b
-
C:\Users\Admin\AppData\Local\Temp\B235.exeMD5
9d9df4df096e893093dbb90b4501bfc3
SHA1fc53e5b9a7dd2e1be87f4eb232074dd8f8f8afba
SHA256a569082fb9dd8dcdb949827b151ad18856a7d5708cd5fd9976da7cdb6835c16a
SHA512e87d969fedbf1c3c4e51112916f169df9c1afbb60a68afa2296296c62c3f13732467f5d612e86b4c4ad2106edd68602503229824d00502ea66fb08090674e490
-
C:\Users\Admin\AppData\Local\Temp\B235.exeMD5
9d9df4df096e893093dbb90b4501bfc3
SHA1fc53e5b9a7dd2e1be87f4eb232074dd8f8f8afba
SHA256a569082fb9dd8dcdb949827b151ad18856a7d5708cd5fd9976da7cdb6835c16a
SHA512e87d969fedbf1c3c4e51112916f169df9c1afbb60a68afa2296296c62c3f13732467f5d612e86b4c4ad2106edd68602503229824d00502ea66fb08090674e490
-
C:\Users\Admin\AppData\Local\Temp\D907.exeMD5
2143ff7503e7337ff9f0abdae6c3468e
SHA132aa2fb93420b27e3470c62898fa47bea6a4d606
SHA256f171c9db2d59a3fd6e40651aea1dfe80dd8cc610e8e496c387c5192d950ce202
SHA512a86c7b5b41aa7a2fdcc41c95e2ff11bab53e31c35f9a6051e82b5998c7300e69d14fc46967447592153cc138edac07aea3b8288b61c28b02db439a8387989137
-
C:\Users\Admin\AppData\Local\Temp\D907.exeMD5
2143ff7503e7337ff9f0abdae6c3468e
SHA132aa2fb93420b27e3470c62898fa47bea6a4d606
SHA256f171c9db2d59a3fd6e40651aea1dfe80dd8cc610e8e496c387c5192d950ce202
SHA512a86c7b5b41aa7a2fdcc41c95e2ff11bab53e31c35f9a6051e82b5998c7300e69d14fc46967447592153cc138edac07aea3b8288b61c28b02db439a8387989137
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
9d9df4df096e893093dbb90b4501bfc3
SHA1fc53e5b9a7dd2e1be87f4eb232074dd8f8f8afba
SHA256a569082fb9dd8dcdb949827b151ad18856a7d5708cd5fd9976da7cdb6835c16a
SHA512e87d969fedbf1c3c4e51112916f169df9c1afbb60a68afa2296296c62c3f13732467f5d612e86b4c4ad2106edd68602503229824d00502ea66fb08090674e490
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
9d9df4df096e893093dbb90b4501bfc3
SHA1fc53e5b9a7dd2e1be87f4eb232074dd8f8f8afba
SHA256a569082fb9dd8dcdb949827b151ad18856a7d5708cd5fd9976da7cdb6835c16a
SHA512e87d969fedbf1c3c4e51112916f169df9c1afbb60a68afa2296296c62c3f13732467f5d612e86b4c4ad2106edd68602503229824d00502ea66fb08090674e490
-
memory/348-191-0x0000000000000000-mapping.dmp
-
memory/832-199-0x0000000000000000-mapping.dmp
-
memory/956-198-0x0000000000000000-mapping.dmp
-
memory/1312-168-0x0000000000000000-mapping.dmp
-
memory/1316-148-0x0000000000000000-mapping.dmp
-
memory/1356-235-0x0000000000000000-mapping.dmp
-
memory/1468-195-0x0000000000000000-mapping.dmp
-
memory/1560-172-0x0000000000000000-mapping.dmp
-
memory/1592-149-0x0000000000000000-mapping.dmp
-
memory/1752-115-0x0000000000851000-0x0000000000862000-memory.dmpFilesize
68KB
-
memory/1752-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1752-117-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1788-196-0x0000000000000000-mapping.dmp
-
memory/1788-280-0x0000000001230000-0x0000000001236000-memory.dmpFilesize
24KB
-
memory/1788-279-0x0000000000000000-mapping.dmp
-
memory/1788-281-0x0000000001220000-0x000000000122C000-memory.dmpFilesize
48KB
-
memory/1884-190-0x0000000000000000-mapping.dmp
-
memory/1964-175-0x0000000000000000-mapping.dmp
-
memory/1976-197-0x0000000000000000-mapping.dmp
-
memory/2096-192-0x0000000000000000-mapping.dmp
-
memory/2116-170-0x0000000000000000-mapping.dmp
-
memory/2124-268-0x0000000001290000-0x000000000129C000-memory.dmpFilesize
48KB
-
memory/2124-267-0x00000000012A0000-0x00000000012A7000-memory.dmpFilesize
28KB
-
memory/2124-264-0x0000000000000000-mapping.dmp
-
memory/2156-200-0x0000000000000000-mapping.dmp
-
memory/2220-194-0x0000000000000000-mapping.dmp
-
memory/2264-193-0x0000000000000000-mapping.dmp
-
memory/2316-291-0x0000028CDE780000-0x0000028CDE781000-memory.dmpFilesize
4KB
-
memory/2324-292-0x0000023B2EA50000-0x0000023B2EA51000-memory.dmpFilesize
4KB
-
memory/2352-173-0x0000000000000000-mapping.dmp
-
memory/2364-189-0x0000000000000000-mapping.dmp
-
memory/2372-188-0x0000000000000000-mapping.dmp
-
memory/2400-272-0x0000000000000000-mapping.dmp
-
memory/2400-273-0x0000000000B30000-0x0000000000B39000-memory.dmpFilesize
36KB
-
memory/2400-274-0x0000000000B20000-0x0000000000B2E000-memory.dmpFilesize
56KB
-
memory/2440-174-0x0000000000000000-mapping.dmp
-
memory/2444-285-0x00000000003B0000-0x00000000003BB000-memory.dmpFilesize
44KB
-
memory/2444-283-0x0000000000000000-mapping.dmp
-
memory/2444-284-0x00000000003C0000-0x00000000003C6000-memory.dmpFilesize
24KB
-
memory/2452-293-0x000001D8D7A30000-0x000001D8D7A31000-memory.dmpFilesize
4KB
-
memory/2552-201-0x0000000000000000-mapping.dmp
-
memory/2576-169-0x0000000000000000-mapping.dmp
-
memory/2708-128-0x0000000000000000-mapping.dmp
-
memory/2708-136-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2708-186-0x0000000000000000-mapping.dmp
-
memory/2708-135-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2720-167-0x0000000000000000-mapping.dmp
-
memory/2772-289-0x0000000000340000-0x0000000000347000-memory.dmpFilesize
28KB
-
memory/2772-288-0x0000000000000000-mapping.dmp
-
memory/2772-290-0x0000000000330000-0x000000000033D000-memory.dmpFilesize
52KB
-
memory/2792-209-0x0000000004D80000-0x0000000004D82000-memory.dmpFilesize
8KB
-
memory/2792-208-0x0000000004D80000-0x0000000004D82000-memory.dmpFilesize
8KB
-
memory/2792-143-0x0000000005AC0000-0x0000000005ACF000-memory.dmpFilesize
60KB
-
memory/2792-142-0x0000000004D80000-0x0000000004D82000-memory.dmpFilesize
8KB
-
memory/2792-118-0x0000000001250000-0x0000000001266000-memory.dmpFilesize
88KB
-
memory/2792-141-0x0000000004D80000-0x0000000004D82000-memory.dmpFilesize
8KB
-
memory/2792-206-0x0000000004D80000-0x0000000004D82000-memory.dmpFilesize
8KB
-
memory/2792-137-0x0000000003660000-0x0000000003676000-memory.dmpFilesize
88KB
-
memory/2820-181-0x0000000000000000-mapping.dmp
-
memory/2832-156-0x00000000028A2000-0x00000000028A3000-memory.dmpFilesize
4KB
-
memory/2832-158-0x0000000002820000-0x000000000284C000-memory.dmpFilesize
176KB
-
memory/2832-184-0x0000000006970000-0x0000000006971000-memory.dmpFilesize
4KB
-
memory/2832-155-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/2832-157-0x00000000028A3000-0x00000000028A4000-memory.dmpFilesize
4KB
-
memory/2832-182-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/2832-180-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/2832-185-0x0000000006B50000-0x0000000006B51000-memory.dmpFilesize
4KB
-
memory/2832-178-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB
-
memory/2832-154-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/2832-176-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2832-152-0x00000000022B0000-0x00000000022DE000-memory.dmpFilesize
184KB
-
memory/2832-166-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/2832-165-0x00000000028A4000-0x00000000028A6000-memory.dmpFilesize
8KB
-
memory/2832-164-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/2832-163-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/2832-162-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/2832-161-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/2832-146-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/2832-147-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/2832-145-0x0000000000581000-0x00000000005AD000-memory.dmpFilesize
176KB
-
memory/2832-138-0x0000000000000000-mapping.dmp
-
memory/3004-151-0x0000000000000000-mapping.dmp
-
memory/3064-202-0x0000000000000000-mapping.dmp
-
memory/3084-297-0x000001B42DFA0000-0x000001B42DFA1000-memory.dmpFilesize
4KB
-
memory/3096-171-0x0000000000000000-mapping.dmp
-
memory/3096-276-0x0000000000000000-mapping.dmp
-
memory/3096-277-0x0000000000180000-0x0000000000185000-memory.dmpFilesize
20KB
-
memory/3096-278-0x0000000000170000-0x0000000000179000-memory.dmpFilesize
36KB
-
memory/3108-177-0x0000000000000000-mapping.dmp
-
memory/3108-205-0x0000000000000000-mapping.dmp
-
memory/3112-179-0x0000000000000000-mapping.dmp
-
memory/3124-266-0x0000000000D20000-0x0000000000D8B000-memory.dmpFilesize
428KB
-
memory/3124-265-0x0000000003440000-0x00000000034B5000-memory.dmpFilesize
468KB
-
memory/3124-263-0x0000000000000000-mapping.dmp
-
memory/3156-183-0x0000000000000000-mapping.dmp
-
memory/3160-153-0x0000000000000000-mapping.dmp
-
memory/3172-187-0x0000000000000000-mapping.dmp
-
memory/3400-133-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3400-125-0x0000000000000000-mapping.dmp
-
memory/3400-286-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3400-287-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/3400-132-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/3400-131-0x0000000000801000-0x0000000000881000-memory.dmpFilesize
512KB
-
memory/3424-294-0x000001EE64CF0000-0x000001EE64CF1000-memory.dmpFilesize
4KB
-
memory/3504-271-0x0000000000840000-0x000000000084B000-memory.dmpFilesize
44KB
-
memory/3504-270-0x0000000000850000-0x0000000000857000-memory.dmpFilesize
28KB
-
memory/3504-269-0x0000000000000000-mapping.dmp
-
memory/3552-204-0x0000000000000000-mapping.dmp
-
memory/3612-233-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-222-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-244-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-245-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-246-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-240-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-239-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-237-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-236-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-232-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-231-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-230-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-229-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-227-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-226-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-224-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-296-0x000001F18A9C0000-0x000001F18A9C1000-memory.dmpFilesize
4KB
-
memory/3612-275-0x000001F1888C0000-0x000001F1888C1000-memory.dmpFilesize
4KB
-
memory/3612-223-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-242-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-220-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-219-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-218-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-217-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-282-0x000001F18A910000-0x000001F18A911000-memory.dmpFilesize
4KB
-
memory/3612-295-0x000001F18A9C0000-0x000001F18A9C1000-memory.dmpFilesize
4KB
-
memory/3612-216-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-215-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-214-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-212-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-211-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3612-210-0x00007FFCFB0B0000-0x00007FFCFB11B000-memory.dmpFilesize
428KB
-
memory/3680-150-0x0000000000000000-mapping.dmp
-
memory/3692-203-0x0000000000000000-mapping.dmp
-
memory/3748-159-0x0000029FBF580000-0x0000029FBF582000-memory.dmpFilesize
8KB
-
memory/3748-160-0x0000029FBF580000-0x0000029FBF582000-memory.dmpFilesize
8KB
-
memory/3776-123-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/3776-124-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/3776-119-0x0000000000000000-mapping.dmp
-
memory/3980-144-0x0000000000000000-mapping.dmp