Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 00:55
Static task
static1
Behavioral task
behavioral1
Sample
0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe
Resource
win10-en-20211104
General
-
Target
0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe
-
Size
232KB
-
MD5
2f47a6640c432f68e788fb6f14c79755
-
SHA1
d9dda1c8b607aa6443644dc7907f43f2452bfabc
-
SHA256
0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb
-
SHA512
ea0a0198a4b5082559123f47b2a5020448631a4c26cf9516fc569ceda8ea202ecc2e727b44a5159374d1dce4ceb4e56fe17a7efed49ccf4a15a79ca1dcfc9926
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-152-0x0000000004BD0000-0x0000000004BFE000-memory.dmp family_redline behavioral1/memory/1700-154-0x0000000007760000-0x000000000778C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
370A.exeSmartClock.exe5F53.exeA518.exeC3CC.exepid process 1540 370A.exe 3044 SmartClock.exe 1176 5F53.exe 4028 A518.exe 1700 C3CC.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Drops startup file 1 IoCs
Processes:
370A.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 370A.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 904 4028 WerFault.exe A518.exe 2240 3700 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5F53.exe0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5F53.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5F53.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5F53.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 3692 ipconfig.exe 304 ipconfig.exe 3464 NETSTAT.EXE 1016 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE1D42C3-530A-11EC-B34F-F2D496D9C4B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 3044 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exepid process 2016 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe 2016 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 58 IoCs
Processes:
0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe5F53.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2016 0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe 1176 5F53.exe 3064 3064 3064 3064 3064 3064 3444 explorer.exe 3444 explorer.exe 3064 3064 3596 explorer.exe 3596 explorer.exe 3064 3064 3692 explorer.exe 3692 explorer.exe 3064 3064 2168 explorer.exe 2168 explorer.exe 3064 3064 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3064 3064 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe 708 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 904 WerFault.exe Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe Token: SeProfSingleProcessPrivilege 3780 WMIC.exe Token: SeIncBasePriorityPrivilege 3780 WMIC.exe Token: SeCreatePagefilePrivilege 3780 WMIC.exe Token: SeBackupPrivilege 3780 WMIC.exe Token: SeRestorePrivilege 3780 WMIC.exe Token: SeShutdownPrivilege 3780 WMIC.exe Token: SeDebugPrivilege 3780 WMIC.exe Token: SeSystemEnvironmentPrivilege 3780 WMIC.exe Token: SeRemoteShutdownPrivilege 3780 WMIC.exe Token: SeUndockPrivilege 3780 WMIC.exe Token: SeManageVolumePrivilege 3780 WMIC.exe Token: 33 3780 WMIC.exe Token: 34 3780 WMIC.exe Token: 35 3780 WMIC.exe Token: 36 3780 WMIC.exe Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe Token: SeProfSingleProcessPrivilege 3780 WMIC.exe Token: SeIncBasePriorityPrivilege 3780 WMIC.exe Token: SeCreatePagefilePrivilege 3780 WMIC.exe Token: SeBackupPrivilege 3780 WMIC.exe Token: SeRestorePrivilege 3780 WMIC.exe Token: SeShutdownPrivilege 3780 WMIC.exe Token: SeDebugPrivilege 3780 WMIC.exe Token: SeSystemEnvironmentPrivilege 3780 WMIC.exe Token: SeRemoteShutdownPrivilege 3780 WMIC.exe Token: SeUndockPrivilege 3780 WMIC.exe Token: SeManageVolumePrivilege 3780 WMIC.exe Token: 33 3780 WMIC.exe Token: 34 3780 WMIC.exe Token: 35 3780 WMIC.exe Token: 36 3780 WMIC.exe Token: SeIncreaseQuotaPrivilege 1524 WMIC.exe Token: SeSecurityPrivilege 1524 WMIC.exe Token: SeTakeOwnershipPrivilege 1524 WMIC.exe Token: SeLoadDriverPrivilege 1524 WMIC.exe Token: SeSystemProfilePrivilege 1524 WMIC.exe Token: SeSystemtimePrivilege 1524 WMIC.exe Token: SeProfSingleProcessPrivilege 1524 WMIC.exe Token: SeIncBasePriorityPrivilege 1524 WMIC.exe Token: SeCreatePagefilePrivilege 1524 WMIC.exe Token: SeBackupPrivilege 1524 WMIC.exe Token: SeRestorePrivilege 1524 WMIC.exe Token: SeShutdownPrivilege 1524 WMIC.exe Token: SeDebugPrivilege 1524 WMIC.exe Token: SeSystemEnvironmentPrivilege 1524 WMIC.exe Token: SeRemoteShutdownPrivilege 1524 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2004 iexplore.exe 2004 iexplore.exe 396 IEXPLORE.EXE 396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
370A.execmd.exenet.exenet.exedescription pid process target process PID 3064 wrote to memory of 1540 3064 370A.exe PID 3064 wrote to memory of 1540 3064 370A.exe PID 3064 wrote to memory of 1540 3064 370A.exe PID 1540 wrote to memory of 3044 1540 370A.exe SmartClock.exe PID 1540 wrote to memory of 3044 1540 370A.exe SmartClock.exe PID 1540 wrote to memory of 3044 1540 370A.exe SmartClock.exe PID 3064 wrote to memory of 1176 3064 5F53.exe PID 3064 wrote to memory of 1176 3064 5F53.exe PID 3064 wrote to memory of 1176 3064 5F53.exe PID 3064 wrote to memory of 4028 3064 A518.exe PID 3064 wrote to memory of 4028 3064 A518.exe PID 3064 wrote to memory of 1700 3064 C3CC.exe PID 3064 wrote to memory of 1700 3064 C3CC.exe PID 3064 wrote to memory of 1700 3064 C3CC.exe PID 3064 wrote to memory of 2840 3064 cmd.exe PID 3064 wrote to memory of 2840 3064 cmd.exe PID 2840 wrote to memory of 3780 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 3780 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1524 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1524 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2416 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2416 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1472 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1472 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 3220 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 3220 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1316 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1316 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2660 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2660 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 932 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 932 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1744 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1744 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1056 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1056 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 608 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 608 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 3436 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 3436 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2340 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 2340 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1472 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 1472 2840 cmd.exe WMIC.exe PID 2840 wrote to memory of 304 2840 cmd.exe ipconfig.exe PID 2840 wrote to memory of 304 2840 cmd.exe ipconfig.exe PID 2840 wrote to memory of 756 2840 cmd.exe ROUTE.EXE PID 2840 wrote to memory of 756 2840 cmd.exe ROUTE.EXE PID 2840 wrote to memory of 1528 2840 cmd.exe netsh.exe PID 2840 wrote to memory of 1528 2840 cmd.exe netsh.exe PID 2840 wrote to memory of 712 2840 cmd.exe systeminfo.exe PID 2840 wrote to memory of 712 2840 cmd.exe systeminfo.exe PID 2840 wrote to memory of 396 2840 cmd.exe tasklist.exe PID 2840 wrote to memory of 396 2840 cmd.exe tasklist.exe PID 2840 wrote to memory of 1788 2840 cmd.exe net.exe PID 2840 wrote to memory of 1788 2840 cmd.exe net.exe PID 1788 wrote to memory of 1388 1788 net.exe net1.exe PID 1788 wrote to memory of 1388 1788 net.exe net1.exe PID 2840 wrote to memory of 1976 2840 cmd.exe net.exe PID 2840 wrote to memory of 1976 2840 cmd.exe net.exe PID 1976 wrote to memory of 400 1976 net.exe net1.exe PID 1976 wrote to memory of 400 1976 net.exe net1.exe PID 2840 wrote to memory of 2832 2840 cmd.exe net.exe PID 2840 wrote to memory of 2832 2840 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3700 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe"C:\Users\Admin\AppData\Local\Temp\0b2c1956c5929ceabe9a1fa6706200c6757a117f86228dc3af3edf0220ca7fcb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\370A.exeC:\Users\Admin\AppData\Local\Temp\370A.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\5F53.exeC:\Users\Admin\AppData\Local\Temp\5F53.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A518.exeC:\Users\Admin\AppData\Local\Temp\A518.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4028 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C3CC.exeC:\Users\Admin\AppData\Local\Temp\C3CC.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\370A.exeMD5
7477f7e7e53e018b8385509d56911e77
SHA1129e86ddbe06df33ada980fd739ca9f16a764114
SHA25649faa981169ebbaa35341fd7ac59cbc6592be3f7792c9f2c9b8b1185c4cd29de
SHA512463c5bd8d67f9f3547c82bc325cea2ef63376cf648b4d291b9fa1795d15be090f09e2c240ae25c38b8f6058fd87c3a3b97e7258e5f711c175c4e6f23ad6a1c5d
-
C:\Users\Admin\AppData\Local\Temp\370A.exeMD5
7477f7e7e53e018b8385509d56911e77
SHA1129e86ddbe06df33ada980fd739ca9f16a764114
SHA25649faa981169ebbaa35341fd7ac59cbc6592be3f7792c9f2c9b8b1185c4cd29de
SHA512463c5bd8d67f9f3547c82bc325cea2ef63376cf648b4d291b9fa1795d15be090f09e2c240ae25c38b8f6058fd87c3a3b97e7258e5f711c175c4e6f23ad6a1c5d
-
C:\Users\Admin\AppData\Local\Temp\5F53.exeMD5
bd17220130ce2b244092feeec997322b
SHA11261904c267899d4198e37954bcd652af7cfd07f
SHA25646ebe03ad70350c57c0c6c7a492cac002a9f3038f0956863da3ac09252f8c22b
SHA5129b1a51d1ba7ae0cf125a3891b2029bafd30b4b5f8ad8c555d37afe4f1cbd1dfe7edd051ac87f3ef37af53e287fc7de68a8fb3a374dfc2cf96a5e1bbc88917f12
-
C:\Users\Admin\AppData\Local\Temp\5F53.exeMD5
bd17220130ce2b244092feeec997322b
SHA11261904c267899d4198e37954bcd652af7cfd07f
SHA25646ebe03ad70350c57c0c6c7a492cac002a9f3038f0956863da3ac09252f8c22b
SHA5129b1a51d1ba7ae0cf125a3891b2029bafd30b4b5f8ad8c555d37afe4f1cbd1dfe7edd051ac87f3ef37af53e287fc7de68a8fb3a374dfc2cf96a5e1bbc88917f12
-
C:\Users\Admin\AppData\Local\Temp\A518.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\A518.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\C3CC.exeMD5
8a40144210e7938b981eda29b0fffa12
SHA1f65c9b90878ee6768aca231b73b27376433a66e1
SHA25687978b7f352fa5a8dd36ac18cd0209ff08019d694823986bacfda7619dba0716
SHA5125cc2895efcbd0add963d827ad079007731eb0ae786e2bedbf01d37c5fc76518aecb42fa5279c9d787395622b06ff6798996f5a6e09507ee135f1169c115b619e
-
C:\Users\Admin\AppData\Local\Temp\C3CC.exeMD5
8a40144210e7938b981eda29b0fffa12
SHA1f65c9b90878ee6768aca231b73b27376433a66e1
SHA25687978b7f352fa5a8dd36ac18cd0209ff08019d694823986bacfda7619dba0716
SHA5125cc2895efcbd0add963d827ad079007731eb0ae786e2bedbf01d37c5fc76518aecb42fa5279c9d787395622b06ff6798996f5a6e09507ee135f1169c115b619e
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7477f7e7e53e018b8385509d56911e77
SHA1129e86ddbe06df33ada980fd739ca9f16a764114
SHA25649faa981169ebbaa35341fd7ac59cbc6592be3f7792c9f2c9b8b1185c4cd29de
SHA512463c5bd8d67f9f3547c82bc325cea2ef63376cf648b4d291b9fa1795d15be090f09e2c240ae25c38b8f6058fd87c3a3b97e7258e5f711c175c4e6f23ad6a1c5d
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
7477f7e7e53e018b8385509d56911e77
SHA1129e86ddbe06df33ada980fd739ca9f16a764114
SHA25649faa981169ebbaa35341fd7ac59cbc6592be3f7792c9f2c9b8b1185c4cd29de
SHA512463c5bd8d67f9f3547c82bc325cea2ef63376cf648b4d291b9fa1795d15be090f09e2c240ae25c38b8f6058fd87c3a3b97e7258e5f711c175c4e6f23ad6a1c5d
-
memory/304-186-0x0000000000000000-mapping.dmp
-
memory/396-190-0x0000000000000000-mapping.dmp
-
memory/396-239-0x0000000000000000-mapping.dmp
-
memory/400-194-0x0000000000000000-mapping.dmp
-
memory/608-176-0x0000000000000000-mapping.dmp
-
memory/708-292-0x0000000000000000-mapping.dmp
-
memory/708-294-0x0000000000FE0000-0x0000000000FED000-memory.dmpFilesize
52KB
-
memory/708-293-0x0000000000FF0000-0x0000000000FF7000-memory.dmpFilesize
28KB
-
memory/712-189-0x0000000000000000-mapping.dmp
-
memory/756-187-0x0000000000000000-mapping.dmp
-
memory/904-301-0x0000016BE19C0000-0x0000016BE19C1000-memory.dmpFilesize
4KB
-
memory/908-198-0x0000000000000000-mapping.dmp
-
memory/932-173-0x0000000000000000-mapping.dmp
-
memory/1016-207-0x0000000000000000-mapping.dmp
-
memory/1056-175-0x0000000000000000-mapping.dmp
-
memory/1176-136-0x0000000002BE0000-0x0000000002C8E000-memory.dmpFilesize
696KB
-
memory/1176-137-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/1176-132-0x0000000000000000-mapping.dmp
-
memory/1176-135-0x0000000002BE0000-0x0000000002C8E000-memory.dmpFilesize
696KB
-
memory/1316-171-0x0000000000000000-mapping.dmp
-
memory/1388-192-0x0000000000000000-mapping.dmp
-
memory/1472-183-0x0000000000000000-mapping.dmp
-
memory/1472-165-0x0000000000000000-mapping.dmp
-
memory/1472-206-0x0000000000000000-mapping.dmp
-
memory/1512-196-0x0000000000000000-mapping.dmp
-
memory/1524-155-0x0000000000000000-mapping.dmp
-
memory/1524-203-0x0000000000000000-mapping.dmp
-
memory/1528-188-0x0000000000000000-mapping.dmp
-
memory/1536-199-0x0000000000000000-mapping.dmp
-
memory/1540-122-0x0000000000000000-mapping.dmp
-
memory/1540-126-0x0000000004870000-0x0000000004901000-memory.dmpFilesize
580KB
-
memory/1540-125-0x00000000047D0000-0x000000000484F000-memory.dmpFilesize
508KB
-
memory/1540-127-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1700-152-0x0000000004BD0000-0x0000000004BFE000-memory.dmpFilesize
184KB
-
memory/1700-180-0x0000000008970000-0x0000000008971000-memory.dmpFilesize
4KB
-
memory/1700-162-0x0000000004C13000-0x0000000004C14000-memory.dmpFilesize
4KB
-
memory/1700-164-0x0000000007FE0000-0x0000000007FE1000-memory.dmpFilesize
4KB
-
memory/1700-160-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/1700-166-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/1700-161-0x0000000004C12000-0x0000000004C13000-memory.dmpFilesize
4KB
-
memory/1700-168-0x0000000004C14000-0x0000000004C16000-memory.dmpFilesize
8KB
-
memory/1700-158-0x0000000000400000-0x0000000002B95000-memory.dmpFilesize
39.6MB
-
memory/1700-185-0x0000000009020000-0x0000000009021000-memory.dmpFilesize
4KB
-
memory/1700-157-0x0000000007E60000-0x0000000007E61000-memory.dmpFilesize
4KB
-
memory/1700-156-0x00000000077D0000-0x00000000077D1000-memory.dmpFilesize
4KB
-
memory/1700-154-0x0000000007760000-0x000000000778C000-memory.dmpFilesize
176KB
-
memory/1700-184-0x0000000008E50000-0x0000000008E51000-memory.dmpFilesize
4KB
-
memory/1700-153-0x0000000007210000-0x0000000007211000-memory.dmpFilesize
4KB
-
memory/1700-150-0x00000000047B0000-0x00000000047E9000-memory.dmpFilesize
228KB
-
memory/1700-144-0x0000000000000000-mapping.dmp
-
memory/1700-178-0x00000000082D0000-0x00000000082D1000-memory.dmpFilesize
4KB
-
memory/1700-149-0x0000000002C10000-0x0000000002D5A000-memory.dmpFilesize
1.3MB
-
memory/1700-159-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1700-181-0x0000000008A30000-0x0000000008A31000-memory.dmpFilesize
4KB
-
memory/1700-182-0x0000000008B20000-0x0000000008B21000-memory.dmpFilesize
4KB
-
memory/1744-174-0x0000000000000000-mapping.dmp
-
memory/1788-191-0x0000000000000000-mapping.dmp
-
memory/1892-270-0x0000000000000000-mapping.dmp
-
memory/1892-272-0x00000000008B0000-0x00000000008BC000-memory.dmpFilesize
48KB
-
memory/1892-271-0x00000000008C0000-0x00000000008C7000-memory.dmpFilesize
28KB
-
memory/1976-193-0x0000000000000000-mapping.dmp
-
memory/2004-250-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-243-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-304-0x000002522C740000-0x000002522C741000-memory.dmpFilesize
4KB
-
memory/2004-302-0x000002522C8C0000-0x000002522C8C1000-memory.dmpFilesize
4KB
-
memory/2004-286-0x000002522E780000-0x000002522E781000-memory.dmpFilesize
4KB
-
memory/2004-279-0x000002522C730000-0x000002522C731000-memory.dmpFilesize
4KB
-
memory/2004-256-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-255-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-254-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-249-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-248-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-246-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-244-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-240-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-241-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-237-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-236-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-235-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-234-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-233-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-231-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-230-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-228-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-227-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-214-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-215-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-216-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-218-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-219-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-220-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-221-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-222-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-223-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-224-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2004-226-0x00007FF9A8B50000-0x00007FF9A8BBB000-memory.dmpFilesize
428KB
-
memory/2016-118-0x0000000002CA0000-0x0000000002CA8000-memory.dmpFilesize
32KB
-
memory/2016-120-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/2016-119-0x0000000002CB0000-0x0000000002CB9000-memory.dmpFilesize
36KB
-
memory/2168-283-0x0000000000000000-mapping.dmp
-
memory/2168-284-0x0000000000AF0000-0x0000000000AF6000-memory.dmpFilesize
24KB
-
memory/2168-285-0x0000000000AE0000-0x0000000000AEC000-memory.dmpFilesize
48KB
-
memory/2212-205-0x0000000000000000-mapping.dmp
-
memory/2240-197-0x0000000000000000-mapping.dmp
-
memory/2240-303-0x0000027AA3070000-0x0000027AA3071000-memory.dmpFilesize
4KB
-
memory/2340-179-0x0000000000000000-mapping.dmp
-
memory/2416-163-0x0000000000000000-mapping.dmp
-
memory/2648-295-0x00000194C24B0000-0x00000194C24B1000-memory.dmpFilesize
4KB
-
memory/2660-172-0x0000000000000000-mapping.dmp
-
memory/2672-296-0x000001FEB5270000-0x000001FEB5271000-memory.dmpFilesize
4KB
-
memory/2792-169-0x0000023D7EA60000-0x0000023D7EA62000-memory.dmpFilesize
8KB
-
memory/2792-170-0x0000023D7EA60000-0x0000023D7EA62000-memory.dmpFilesize
8KB
-
memory/2832-195-0x0000000000000000-mapping.dmp
-
memory/2840-147-0x0000000000000000-mapping.dmp
-
memory/2896-300-0x000002A3990F0000-0x000002A3990F1000-memory.dmpFilesize
4KB
-
memory/2896-297-0x000002A398DB0000-0x000002A398DB1000-memory.dmpFilesize
4KB
-
memory/3044-291-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/3044-128-0x0000000000000000-mapping.dmp
-
memory/3044-290-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3044-131-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3064-138-0x0000000003170000-0x0000000003186000-memory.dmpFilesize
88KB
-
memory/3064-148-0x0000000004C30000-0x0000000004C3F000-memory.dmpFilesize
60KB
-
memory/3064-212-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/3064-213-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/3064-210-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/3064-121-0x0000000000F10000-0x0000000000F26000-memory.dmpFilesize
88KB
-
memory/3064-143-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/3064-142-0x0000000004C50000-0x0000000004C52000-memory.dmpFilesize
8KB
-
memory/3220-167-0x0000000000000000-mapping.dmp
-
memory/3424-298-0x000001BFE9290000-0x000001BFE9291000-memory.dmpFilesize
4KB
-
memory/3436-177-0x0000000000000000-mapping.dmp
-
memory/3436-201-0x0000000000000000-mapping.dmp
-
memory/3444-274-0x0000000000340000-0x0000000000347000-memory.dmpFilesize
28KB
-
memory/3444-275-0x0000000000330000-0x000000000033B000-memory.dmpFilesize
44KB
-
memory/3444-273-0x0000000000000000-mapping.dmp
-
memory/3464-204-0x0000000000000000-mapping.dmp
-
memory/3596-277-0x00000000010D0000-0x00000000010D9000-memory.dmpFilesize
36KB
-
memory/3596-278-0x00000000010C0000-0x00000000010CE000-memory.dmpFilesize
56KB
-
memory/3596-208-0x0000000000000000-mapping.dmp
-
memory/3596-276-0x0000000000000000-mapping.dmp
-
memory/3604-202-0x0000000000000000-mapping.dmp
-
memory/3640-266-0x0000000000000000-mapping.dmp
-
memory/3640-268-0x0000000000BA0000-0x0000000000C15000-memory.dmpFilesize
468KB
-
memory/3640-269-0x0000000000B30000-0x0000000000B9B000-memory.dmpFilesize
428KB
-
memory/3692-282-0x00000000031D0000-0x00000000031D9000-memory.dmpFilesize
36KB
-
memory/3692-281-0x00000000031E0000-0x00000000031E5000-memory.dmpFilesize
20KB
-
memory/3692-280-0x0000000000000000-mapping.dmp
-
memory/3692-209-0x0000000000000000-mapping.dmp
-
memory/3780-151-0x0000000000000000-mapping.dmp
-
memory/3924-289-0x00000000005D0000-0x00000000005DB000-memory.dmpFilesize
44KB
-
memory/3924-288-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/3924-287-0x0000000000000000-mapping.dmp
-
memory/4004-200-0x0000000000000000-mapping.dmp
-
memory/4028-299-0x00000213733C0000-0x00000213733C1000-memory.dmpFilesize
4KB
-
memory/4028-139-0x0000000000000000-mapping.dmp