Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
01-12-2021 20:40
Static task
static1
Behavioral task
behavioral1
Sample
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe
Resource
win10-en-20211014
General
-
Target
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe
-
Size
332KB
-
MD5
93eb6fe61902a239e05b28ce375ac814
-
SHA1
edec72e9d5b853d2677ea266ba1ee4cb8fd310ff
-
SHA256
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682
-
SHA512
357a41280f48f9bc630d459b348fa59c8355fdb40017c76128aa2476fdf6e3dd69dce8d9c4b9774f056f7acce7a436ddd36adc19402b9cc4d749b48856fcdf25
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2148-145-0x0000000002410000-0x000000000243E000-memory.dmp family_redline behavioral1/memory/2148-147-0x00000000024D0000-0x00000000024FC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
31E9.exe4A54.exeSmartClock.exe6FFE.exe83A6.exepid process 4336 31E9.exe 4472 4A54.exe 4544 SmartClock.exe 1112 6FFE.exe 2148 83A6.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2776 -
Drops startup file 1 IoCs
Processes:
31E9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 31E9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1568 1112 WerFault.exe 6FFE.exe 3564 3752 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe4A54.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4A54.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4A54.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4A54.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1988 ipconfig.exe 4568 NETSTAT.EXE 896 NETSTAT.EXE 2332 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58249F79-2ED9-11EC-B8A2-F2F93CA9AA84} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 4544 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exepid process 4216 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe 4216 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 2776 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2776 -
Suspicious behavior: MapViewOfSection 58 IoCs
Processes:
07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe4A54.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4216 07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe 4472 4A54.exe 2776 2776 2776 2776 2776 2776 4672 explorer.exe 4672 explorer.exe 2776 2776 1332 explorer.exe 1332 explorer.exe 2776 2776 1272 explorer.exe 1272 explorer.exe 2776 2776 1688 explorer.exe 1688 explorer.exe 2776 2776 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2776 2776 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe 4520 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exe83A6.exeWMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeDebugPrivilege 1568 WerFault.exe Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeShutdownPrivilege 2776 Token: SeCreatePagefilePrivilege 2776 Token: SeDebugPrivilege 2148 83A6.exe Token: SeIncreaseQuotaPrivilege 5024 WMIC.exe Token: SeSecurityPrivilege 5024 WMIC.exe Token: SeTakeOwnershipPrivilege 5024 WMIC.exe Token: SeLoadDriverPrivilege 5024 WMIC.exe Token: SeSystemProfilePrivilege 5024 WMIC.exe Token: SeSystemtimePrivilege 5024 WMIC.exe Token: SeProfSingleProcessPrivilege 5024 WMIC.exe Token: SeIncBasePriorityPrivilege 5024 WMIC.exe Token: SeCreatePagefilePrivilege 5024 WMIC.exe Token: SeBackupPrivilege 5024 WMIC.exe Token: SeRestorePrivilege 5024 WMIC.exe Token: SeShutdownPrivilege 5024 WMIC.exe Token: SeDebugPrivilege 5024 WMIC.exe Token: SeSystemEnvironmentPrivilege 5024 WMIC.exe Token: SeRemoteShutdownPrivilege 5024 WMIC.exe Token: SeUndockPrivilege 5024 WMIC.exe Token: SeManageVolumePrivilege 5024 WMIC.exe Token: 33 5024 WMIC.exe Token: 34 5024 WMIC.exe Token: 35 5024 WMIC.exe Token: 36 5024 WMIC.exe Token: SeIncreaseQuotaPrivilege 5024 WMIC.exe Token: SeSecurityPrivilege 5024 WMIC.exe Token: SeTakeOwnershipPrivilege 5024 WMIC.exe Token: SeLoadDriverPrivilege 5024 WMIC.exe Token: SeSystemProfilePrivilege 5024 WMIC.exe Token: SeSystemtimePrivilege 5024 WMIC.exe Token: SeProfSingleProcessPrivilege 5024 WMIC.exe Token: SeIncBasePriorityPrivilege 5024 WMIC.exe Token: SeCreatePagefilePrivilege 5024 WMIC.exe Token: SeBackupPrivilege 5024 WMIC.exe Token: SeRestorePrivilege 5024 WMIC.exe Token: SeShutdownPrivilege 5024 WMIC.exe Token: SeDebugPrivilege 5024 WMIC.exe Token: SeSystemEnvironmentPrivilege 5024 WMIC.exe Token: SeRemoteShutdownPrivilege 5024 WMIC.exe Token: SeUndockPrivilege 5024 WMIC.exe Token: SeManageVolumePrivilege 5024 WMIC.exe Token: 33 5024 WMIC.exe Token: 34 5024 WMIC.exe Token: 35 5024 WMIC.exe Token: 36 5024 WMIC.exe Token: SeIncreaseQuotaPrivilege 4296 WMIC.exe Token: SeSecurityPrivilege 4296 WMIC.exe Token: SeTakeOwnershipPrivilege 4296 WMIC.exe Token: SeLoadDriverPrivilege 4296 WMIC.exe Token: SeSystemProfilePrivilege 4296 WMIC.exe Token: SeSystemtimePrivilege 4296 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2488 iexplore.exe 2488 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
31E9.execmd.exenet.exenet.exedescription pid process target process PID 2776 wrote to memory of 4336 2776 31E9.exe PID 2776 wrote to memory of 4336 2776 31E9.exe PID 2776 wrote to memory of 4336 2776 31E9.exe PID 2776 wrote to memory of 4472 2776 4A54.exe PID 2776 wrote to memory of 4472 2776 4A54.exe PID 2776 wrote to memory of 4472 2776 4A54.exe PID 4336 wrote to memory of 4544 4336 31E9.exe SmartClock.exe PID 4336 wrote to memory of 4544 4336 31E9.exe SmartClock.exe PID 4336 wrote to memory of 4544 4336 31E9.exe SmartClock.exe PID 2776 wrote to memory of 1112 2776 6FFE.exe PID 2776 wrote to memory of 1112 2776 6FFE.exe PID 2776 wrote to memory of 2148 2776 83A6.exe PID 2776 wrote to memory of 2148 2776 83A6.exe PID 2776 wrote to memory of 2148 2776 83A6.exe PID 2776 wrote to memory of 1276 2776 cmd.exe PID 2776 wrote to memory of 1276 2776 cmd.exe PID 1276 wrote to memory of 5024 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 5024 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4296 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4296 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2976 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2976 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 5012 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 5012 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4660 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4660 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 348 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 348 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1272 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1272 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2292 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2292 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1668 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1668 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1864 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1864 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2636 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2636 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4592 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 4592 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2576 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2576 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2984 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 2984 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1988 1276 cmd.exe ipconfig.exe PID 1276 wrote to memory of 1988 1276 cmd.exe ipconfig.exe PID 1276 wrote to memory of 4880 1276 cmd.exe ROUTE.EXE PID 1276 wrote to memory of 4880 1276 cmd.exe ROUTE.EXE PID 1276 wrote to memory of 3020 1276 cmd.exe netsh.exe PID 1276 wrote to memory of 3020 1276 cmd.exe netsh.exe PID 1276 wrote to memory of 3164 1276 cmd.exe systeminfo.exe PID 1276 wrote to memory of 3164 1276 cmd.exe systeminfo.exe PID 1276 wrote to memory of 3364 1276 cmd.exe tasklist.exe PID 1276 wrote to memory of 3364 1276 cmd.exe tasklist.exe PID 1276 wrote to memory of 576 1276 cmd.exe net.exe PID 1276 wrote to memory of 576 1276 cmd.exe net.exe PID 576 wrote to memory of 756 576 net.exe net1.exe PID 576 wrote to memory of 756 576 net.exe net1.exe PID 1276 wrote to memory of 4416 1276 cmd.exe net.exe PID 1276 wrote to memory of 4416 1276 cmd.exe net.exe PID 4416 wrote to memory of 3576 4416 net.exe net1.exe PID 4416 wrote to memory of 3576 4416 net.exe net1.exe PID 1276 wrote to memory of 1596 1276 cmd.exe net.exe PID 1276 wrote to memory of 1596 1276 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3752 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe"C:\Users\Admin\AppData\Local\Temp\07c03ef9e0e9fee72e5fb1920e0bfb25cbe4d9c18e7e20328da531565766d682.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\31E9.exeC:\Users\Admin\AppData\Local\Temp\31E9.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\4A54.exeC:\Users\Admin\AppData\Local\Temp\4A54.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\6FFE.exeC:\Users\Admin\AppData\Local\Temp\6FFE.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1112 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\83A6.exeC:\Users\Admin\AppData\Local\Temp\83A6.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\31E9.exeMD5
2798167a94de0c0d428a73c4a86d141b
SHA1659aa0c21e56dd33bec2b1bcd8d41bd9bf4ee23c
SHA256542081c4248a87e13ff769b356660794c56b0cd6829236fb50ea724d08cfd354
SHA512689a529b19cc01d772d94833427288efd7872ff377742e6518f6fd0daf6b5a161fe3c12ea450e1833dfb3f89e57146742fd6db8bd4512155948944a423ad3199
-
C:\Users\Admin\AppData\Local\Temp\31E9.exeMD5
2798167a94de0c0d428a73c4a86d141b
SHA1659aa0c21e56dd33bec2b1bcd8d41bd9bf4ee23c
SHA256542081c4248a87e13ff769b356660794c56b0cd6829236fb50ea724d08cfd354
SHA512689a529b19cc01d772d94833427288efd7872ff377742e6518f6fd0daf6b5a161fe3c12ea450e1833dfb3f89e57146742fd6db8bd4512155948944a423ad3199
-
C:\Users\Admin\AppData\Local\Temp\4A54.exeMD5
05db051d56a60badfecd383277573408
SHA12acb74daebd96c79e8e412468fd8b2c22d20861a
SHA25641f90072241c6875fbd2cf1125881345e08c95d38de2b01c6815d164c6846f28
SHA51287572dad23c1058c7414e838d9febf7130b14595d97ecfe7aa91b21cdf895db800023e9d0704d79b4922ff5f3e109279409b5d26e1175959d545eeb9fe69c59d
-
C:\Users\Admin\AppData\Local\Temp\4A54.exeMD5
05db051d56a60badfecd383277573408
SHA12acb74daebd96c79e8e412468fd8b2c22d20861a
SHA25641f90072241c6875fbd2cf1125881345e08c95d38de2b01c6815d164c6846f28
SHA51287572dad23c1058c7414e838d9febf7130b14595d97ecfe7aa91b21cdf895db800023e9d0704d79b4922ff5f3e109279409b5d26e1175959d545eeb9fe69c59d
-
C:\Users\Admin\AppData\Local\Temp\6FFE.exeMD5
89f72549d10ca37bda16dfb88b06163c
SHA16bf7fdcf959387f311a4d519c99addd83fcddbb3
SHA256a87650819ff9fdaa524de78d2024505b3afba6412084f5a18d001605bad4e52f
SHA512fb2a292d33a98dd7ff4d35c776ac867a15b34d28238733151c0803595063eb97c52d81012622dd8537716def6011617242e2486eb99bd8acb72918d93ce64fbf
-
C:\Users\Admin\AppData\Local\Temp\6FFE.exeMD5
89f72549d10ca37bda16dfb88b06163c
SHA16bf7fdcf959387f311a4d519c99addd83fcddbb3
SHA256a87650819ff9fdaa524de78d2024505b3afba6412084f5a18d001605bad4e52f
SHA512fb2a292d33a98dd7ff4d35c776ac867a15b34d28238733151c0803595063eb97c52d81012622dd8537716def6011617242e2486eb99bd8acb72918d93ce64fbf
-
C:\Users\Admin\AppData\Local\Temp\83A6.exeMD5
51dd1ed64bf49d32952dd5a33107211e
SHA10cd23120d3b9886194a3805539cc31121e0900e0
SHA2560798775f7664c450c5f42f299b83b18d7cb27b830b7cea0cb323a49298601727
SHA5127d0754f3d6daf6d2e950c3899986f73697305794ba0c1043dcfa25c8d0243ba6f6bc1ba31cf228a28deac4aac8a1022cfb7cf0bfc4c38de847baa1ee71e7a598
-
C:\Users\Admin\AppData\Local\Temp\83A6.exeMD5
51dd1ed64bf49d32952dd5a33107211e
SHA10cd23120d3b9886194a3805539cc31121e0900e0
SHA2560798775f7664c450c5f42f299b83b18d7cb27b830b7cea0cb323a49298601727
SHA5127d0754f3d6daf6d2e950c3899986f73697305794ba0c1043dcfa25c8d0243ba6f6bc1ba31cf228a28deac4aac8a1022cfb7cf0bfc4c38de847baa1ee71e7a598
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
2798167a94de0c0d428a73c4a86d141b
SHA1659aa0c21e56dd33bec2b1bcd8d41bd9bf4ee23c
SHA256542081c4248a87e13ff769b356660794c56b0cd6829236fb50ea724d08cfd354
SHA512689a529b19cc01d772d94833427288efd7872ff377742e6518f6fd0daf6b5a161fe3c12ea450e1833dfb3f89e57146742fd6db8bd4512155948944a423ad3199
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
2798167a94de0c0d428a73c4a86d141b
SHA1659aa0c21e56dd33bec2b1bcd8d41bd9bf4ee23c
SHA256542081c4248a87e13ff769b356660794c56b0cd6829236fb50ea724d08cfd354
SHA512689a529b19cc01d772d94833427288efd7872ff377742e6518f6fd0daf6b5a161fe3c12ea450e1833dfb3f89e57146742fd6db8bd4512155948944a423ad3199
-
memory/348-176-0x0000000000000000-mapping.dmp
-
memory/576-190-0x0000000000000000-mapping.dmp
-
memory/720-205-0x0000000000000000-mapping.dmp
-
memory/756-191-0x0000000000000000-mapping.dmp
-
memory/896-206-0x0000000000000000-mapping.dmp
-
memory/1020-201-0x0000000000000000-mapping.dmp
-
memory/1048-202-0x0000000000000000-mapping.dmp
-
memory/1068-268-0x0000000000A00000-0x0000000000A75000-memory.dmpFilesize
468KB
-
memory/1068-269-0x0000000000770000-0x00000000007DB000-memory.dmpFilesize
428KB
-
memory/1068-266-0x0000000000000000-mapping.dmp
-
memory/1112-137-0x0000000000000000-mapping.dmp
-
memory/1112-298-0x0000020FDDDD0000-0x0000020FDDDD1000-memory.dmpFilesize
4KB
-
memory/1272-281-0x0000000000BF0000-0x0000000000BF9000-memory.dmpFilesize
36KB
-
memory/1272-177-0x0000000000000000-mapping.dmp
-
memory/1272-280-0x0000000000E00000-0x0000000000E05000-memory.dmpFilesize
20KB
-
memory/1272-279-0x0000000000000000-mapping.dmp
-
memory/1276-166-0x0000000000000000-mapping.dmp
-
memory/1332-277-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/1332-275-0x0000000000000000-mapping.dmp
-
memory/1332-276-0x00000000003C0000-0x00000000003C9000-memory.dmpFilesize
36KB
-
memory/1392-204-0x0000000000000000-mapping.dmp
-
memory/1568-300-0x0000020F7C2E0000-0x0000020F7C2E1000-memory.dmpFilesize
4KB
-
memory/1596-194-0x0000000000000000-mapping.dmp
-
memory/1668-179-0x0000000000000000-mapping.dmp
-
memory/1688-282-0x0000000000000000-mapping.dmp
-
memory/1688-283-0x0000000000AE0000-0x0000000000AE6000-memory.dmpFilesize
24KB
-
memory/1688-284-0x0000000000AD0000-0x0000000000ADC000-memory.dmpFilesize
48KB
-
memory/1844-207-0x0000000000000000-mapping.dmp
-
memory/1864-180-0x0000000000000000-mapping.dmp
-
memory/1988-185-0x0000000000000000-mapping.dmp
-
memory/2148-152-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/2148-150-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2148-159-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/2148-160-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB
-
memory/2148-161-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/2148-162-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/2148-157-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/2148-156-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/2148-153-0x0000000002502000-0x0000000002503000-memory.dmpFilesize
4KB
-
memory/2148-155-0x0000000002503000-0x0000000002504000-memory.dmpFilesize
4KB
-
memory/2148-167-0x0000000006700000-0x0000000006701000-memory.dmpFilesize
4KB
-
memory/2148-168-0x00000000068E0000-0x00000000068E1000-memory.dmpFilesize
4KB
-
memory/2148-154-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/2148-151-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/2148-149-0x00000000001C0000-0x00000000001F9000-memory.dmpFilesize
228KB
-
memory/2148-158-0x0000000002504000-0x0000000002506000-memory.dmpFilesize
8KB
-
memory/2148-141-0x0000000000000000-mapping.dmp
-
memory/2148-148-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2148-147-0x00000000024D0000-0x00000000024FC000-memory.dmpFilesize
176KB
-
memory/2148-146-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/2148-145-0x0000000002410000-0x000000000243E000-memory.dmpFilesize
184KB
-
memory/2148-144-0x0000000000711000-0x000000000073D000-memory.dmpFilesize
176KB
-
memory/2292-178-0x0000000000000000-mapping.dmp
-
memory/2308-294-0x0000012EEF160000-0x0000012EEF161000-memory.dmpFilesize
4KB
-
memory/2316-295-0x000002009BE20000-0x000002009BE21000-memory.dmpFilesize
4KB
-
memory/2332-208-0x0000000000000000-mapping.dmp
-
memory/2440-286-0x0000000000000000-mapping.dmp
-
memory/2440-287-0x0000000000AA0000-0x0000000000AA6000-memory.dmpFilesize
24KB
-
memory/2440-288-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2444-296-0x0000019FD0110000-0x0000019FD0111000-memory.dmpFilesize
4KB
-
memory/2444-299-0x0000019FD0450000-0x0000019FD0451000-memory.dmpFilesize
4KB
-
memory/2488-245-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-214-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-302-0x0000024EF3410000-0x0000024EF3411000-memory.dmpFilesize
4KB
-
memory/2488-301-0x0000024EF3290000-0x0000024EF3291000-memory.dmpFilesize
4KB
-
memory/2488-285-0x0000024EF52E0000-0x0000024EF52E1000-memory.dmpFilesize
4KB
-
memory/2488-278-0x0000024EF3280000-0x0000024EF3281000-memory.dmpFilesize
4KB
-
memory/2488-249-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-248-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-247-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-243-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-242-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-240-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-239-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-236-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-223-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-235-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-234-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-222-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-232-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-231-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-230-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-229-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-227-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-226-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-213-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-225-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-215-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-217-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-218-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-219-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-220-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2488-221-0x00007FF9EC830000-0x00007FF9EC89B000-memory.dmpFilesize
428KB
-
memory/2576-183-0x0000000000000000-mapping.dmp
-
memory/2636-181-0x0000000000000000-mapping.dmp
-
memory/2776-212-0x0000000005030000-0x0000000005032000-memory.dmpFilesize
8KB
-
memory/2776-118-0x0000000002390000-0x00000000023A6000-memory.dmpFilesize
88KB
-
memory/2776-209-0x0000000005030000-0x0000000005032000-memory.dmpFilesize
8KB
-
memory/2776-164-0x0000000005030000-0x0000000005032000-memory.dmpFilesize
8KB
-
memory/2776-163-0x0000000005030000-0x0000000005032000-memory.dmpFilesize
8KB
-
memory/2776-211-0x0000000005030000-0x0000000005032000-memory.dmpFilesize
8KB
-
memory/2776-165-0x0000000005010000-0x000000000501F000-memory.dmpFilesize
60KB
-
memory/2776-140-0x0000000002D50000-0x0000000002D66000-memory.dmpFilesize
88KB
-
memory/2948-238-0x0000000000000000-mapping.dmp
-
memory/2976-171-0x0000000000000000-mapping.dmp
-
memory/2984-184-0x0000000000000000-mapping.dmp
-
memory/3020-187-0x0000000000000000-mapping.dmp
-
memory/3148-199-0x0000000000000000-mapping.dmp
-
memory/3164-188-0x0000000000000000-mapping.dmp
-
memory/3364-189-0x0000000000000000-mapping.dmp
-
memory/3488-297-0x0000028C89C50000-0x0000028C89C51000-memory.dmpFilesize
4KB
-
memory/3564-303-0x0000020BD1220000-0x0000020BD1221000-memory.dmpFilesize
4KB
-
memory/3576-193-0x0000000000000000-mapping.dmp
-
memory/3692-200-0x0000000000000000-mapping.dmp
-
memory/4156-175-0x0000021809CD0000-0x0000021809CD2000-memory.dmpFilesize
8KB
-
memory/4156-174-0x0000021809CD0000-0x0000021809CD2000-memory.dmpFilesize
8KB
-
memory/4216-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4216-117-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/4296-170-0x0000000000000000-mapping.dmp
-
memory/4336-123-0x0000000000680000-0x00000000007CA000-memory.dmpFilesize
1.3MB
-
memory/4336-124-0x0000000000400000-0x0000000000544000-memory.dmpFilesize
1.3MB
-
memory/4336-122-0x0000000000801000-0x0000000000881000-memory.dmpFilesize
512KB
-
memory/4336-119-0x0000000000000000-mapping.dmp
-
memory/4416-192-0x0000000000000000-mapping.dmp
-
memory/4436-198-0x0000000000000000-mapping.dmp
-
memory/4468-197-0x0000000000000000-mapping.dmp
-
memory/4472-125-0x0000000000000000-mapping.dmp
-
memory/4472-133-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4472-134-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/4484-196-0x0000000000000000-mapping.dmp
-
memory/4520-292-0x0000000000C40000-0x0000000000C47000-memory.dmpFilesize
28KB
-
memory/4520-293-0x0000000000C30000-0x0000000000C3D000-memory.dmpFilesize
52KB
-
memory/4520-291-0x0000000000000000-mapping.dmp
-
memory/4544-290-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/4544-128-0x0000000000000000-mapping.dmp
-
memory/4544-289-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/4544-136-0x0000000000400000-0x0000000000544000-memory.dmpFilesize
1.3MB
-
memory/4544-135-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/4544-132-0x00000000007B1000-0x0000000000831000-memory.dmpFilesize
512KB
-
memory/4560-195-0x0000000000000000-mapping.dmp
-
memory/4568-203-0x0000000000000000-mapping.dmp
-
memory/4592-182-0x0000000000000000-mapping.dmp
-
memory/4660-173-0x0000000000000000-mapping.dmp
-
memory/4672-272-0x0000000000000000-mapping.dmp
-
memory/4672-273-0x0000000000C70000-0x0000000000C77000-memory.dmpFilesize
28KB
-
memory/4672-274-0x0000000000C60000-0x0000000000C6B000-memory.dmpFilesize
44KB
-
memory/4700-267-0x0000000000000000-mapping.dmp
-
memory/4700-270-0x00000000010D0000-0x00000000010D7000-memory.dmpFilesize
28KB
-
memory/4700-271-0x00000000010C0000-0x00000000010CC000-memory.dmpFilesize
48KB
-
memory/4880-186-0x0000000000000000-mapping.dmp
-
memory/5012-172-0x0000000000000000-mapping.dmp
-
memory/5024-169-0x0000000000000000-mapping.dmp