Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 02:20
Static task
static1
Behavioral task
behavioral1
Sample
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe
Resource
win10-en-20211104
General
-
Target
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe
-
Size
232KB
-
MD5
edfdc8d0f673d491c2fa5e758a423324
-
SHA1
7c16a45e5e3d29c8700ed57daa0467ab1c16247f
-
SHA256
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce
-
SHA512
639773052b400a496a79fd082d1b2be0839ff19ae5e3dadcd89325b5cb5b67091ab14a1528ee7d7fdced79f63266d4b88400107e7872e8ebfc177905d36b332b
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-147-0x0000000004A50000-0x0000000004A7E000-memory.dmp family_redline behavioral1/memory/1656-149-0x0000000004CD0000-0x0000000004CFC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
1E32.exeSmartClock.exe2E9E.exe45B2.exe4F67.exepid process 732 1E32.exe 4520 SmartClock.exe 3244 2E9E.exe 2968 45B2.exe 1656 4F67.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2436 -
Drops startup file 1 IoCs
Processes:
1E32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 1E32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3972 2968 WerFault.exe 45B2.exe 2020 3736 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe2E9E.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2E9E.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2E9E.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2E9E.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 5016 ipconfig.exe 1732 NETSTAT.EXE 2700 NETSTAT.EXE 3888 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B016D634-5316-11EC-B34F-C6CD99C971BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 4520 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exepid process 3584 ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe 3584 ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 2436 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2436 -
Suspicious behavior: MapViewOfSection 58 IoCs
Processes:
ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe2E9E.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3584 ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe 3244 2E9E.exe 2436 2436 2436 2436 2436 2436 5044 explorer.exe 5044 explorer.exe 2436 2436 928 explorer.exe 928 explorer.exe 2436 2436 5080 explorer.exe 5080 explorer.exe 2436 2436 1188 explorer.exe 1188 explorer.exe 2436 2436 1316 explorer.exe 1316 explorer.exe 1316 explorer.exe 1316 explorer.exe 2436 2436 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exe4F67.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3972 WerFault.exe Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeDebugPrivilege 1656 4F67.exe Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeShutdownPrivilege 2436 Token: SeCreatePagefilePrivilege 2436 Token: SeIncreaseQuotaPrivilege 4976 WMIC.exe Token: SeSecurityPrivilege 4976 WMIC.exe Token: SeTakeOwnershipPrivilege 4976 WMIC.exe Token: SeLoadDriverPrivilege 4976 WMIC.exe Token: SeSystemProfilePrivilege 4976 WMIC.exe Token: SeSystemtimePrivilege 4976 WMIC.exe Token: SeProfSingleProcessPrivilege 4976 WMIC.exe Token: SeIncBasePriorityPrivilege 4976 WMIC.exe Token: SeCreatePagefilePrivilege 4976 WMIC.exe Token: SeBackupPrivilege 4976 WMIC.exe Token: SeRestorePrivilege 4976 WMIC.exe Token: SeShutdownPrivilege 4976 WMIC.exe Token: SeDebugPrivilege 4976 WMIC.exe Token: SeSystemEnvironmentPrivilege 4976 WMIC.exe Token: SeRemoteShutdownPrivilege 4976 WMIC.exe Token: SeUndockPrivilege 4976 WMIC.exe Token: SeManageVolumePrivilege 4976 WMIC.exe Token: 33 4976 WMIC.exe Token: 34 4976 WMIC.exe Token: 35 4976 WMIC.exe Token: 36 4976 WMIC.exe Token: SeIncreaseQuotaPrivilege 4976 WMIC.exe Token: SeSecurityPrivilege 4976 WMIC.exe Token: SeTakeOwnershipPrivilege 4976 WMIC.exe Token: SeLoadDriverPrivilege 4976 WMIC.exe Token: SeSystemProfilePrivilege 4976 WMIC.exe Token: SeSystemtimePrivilege 4976 WMIC.exe Token: SeProfSingleProcessPrivilege 4976 WMIC.exe Token: SeIncBasePriorityPrivilege 4976 WMIC.exe Token: SeCreatePagefilePrivilege 4976 WMIC.exe Token: SeBackupPrivilege 4976 WMIC.exe Token: SeRestorePrivilege 4976 WMIC.exe Token: SeShutdownPrivilege 4976 WMIC.exe Token: SeDebugPrivilege 4976 WMIC.exe Token: SeSystemEnvironmentPrivilege 4976 WMIC.exe Token: SeRemoteShutdownPrivilege 4976 WMIC.exe Token: SeUndockPrivilege 4976 WMIC.exe Token: SeManageVolumePrivilege 4976 WMIC.exe Token: 33 4976 WMIC.exe Token: 34 4976 WMIC.exe Token: 35 4976 WMIC.exe Token: 36 4976 WMIC.exe Token: SeIncreaseQuotaPrivilege 4636 WMIC.exe Token: SeSecurityPrivilege 4636 WMIC.exe Token: SeTakeOwnershipPrivilege 4636 WMIC.exe Token: SeLoadDriverPrivilege 4636 WMIC.exe Token: SeSystemProfilePrivilege 4636 WMIC.exe Token: SeSystemtimePrivilege 4636 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3812 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3812 iexplore.exe 3812 iexplore.exe 3576 IEXPLORE.EXE 3576 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
RuntimeBroker.exepid process 3496 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1E32.execmd.exenet.exenet.exedescription pid process target process PID 2436 wrote to memory of 732 2436 1E32.exe PID 2436 wrote to memory of 732 2436 1E32.exe PID 2436 wrote to memory of 732 2436 1E32.exe PID 732 wrote to memory of 4520 732 1E32.exe SmartClock.exe PID 732 wrote to memory of 4520 732 1E32.exe SmartClock.exe PID 732 wrote to memory of 4520 732 1E32.exe SmartClock.exe PID 2436 wrote to memory of 3244 2436 2E9E.exe PID 2436 wrote to memory of 3244 2436 2E9E.exe PID 2436 wrote to memory of 3244 2436 2E9E.exe PID 2436 wrote to memory of 2968 2436 45B2.exe PID 2436 wrote to memory of 2968 2436 45B2.exe PID 2436 wrote to memory of 1656 2436 4F67.exe PID 2436 wrote to memory of 1656 2436 4F67.exe PID 2436 wrote to memory of 1656 2436 4F67.exe PID 2436 wrote to memory of 2828 2436 cmd.exe PID 2436 wrote to memory of 2828 2436 cmd.exe PID 2828 wrote to memory of 4976 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 4976 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 4636 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 4636 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 4348 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 4348 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 5032 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 5032 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2788 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2788 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1316 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1316 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2460 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2460 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1680 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1680 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1756 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 1756 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2052 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2052 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2020 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2020 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2268 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2268 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2892 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 2892 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 3784 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 3784 2828 cmd.exe WMIC.exe PID 2828 wrote to memory of 5016 2828 cmd.exe ipconfig.exe PID 2828 wrote to memory of 5016 2828 cmd.exe ipconfig.exe PID 2828 wrote to memory of 964 2828 cmd.exe ROUTE.EXE PID 2828 wrote to memory of 964 2828 cmd.exe ROUTE.EXE PID 2828 wrote to memory of 2428 2828 cmd.exe netsh.exe PID 2828 wrote to memory of 2428 2828 cmd.exe netsh.exe PID 2828 wrote to memory of 3196 2828 cmd.exe systeminfo.exe PID 2828 wrote to memory of 3196 2828 cmd.exe systeminfo.exe PID 2828 wrote to memory of 5036 2828 cmd.exe tasklist.exe PID 2828 wrote to memory of 5036 2828 cmd.exe tasklist.exe PID 2828 wrote to memory of 3640 2828 cmd.exe net.exe PID 2828 wrote to memory of 3640 2828 cmd.exe net.exe PID 3640 wrote to memory of 3984 3640 net.exe net1.exe PID 3640 wrote to memory of 3984 3640 net.exe net1.exe PID 2828 wrote to memory of 3996 2828 cmd.exe net.exe PID 2828 wrote to memory of 3996 2828 cmd.exe net.exe PID 3996 wrote to memory of 3584 3996 net.exe net1.exe PID 3996 wrote to memory of 3584 3996 net.exe net1.exe PID 2828 wrote to memory of 4076 2828 cmd.exe net.exe PID 2828 wrote to memory of 4076 2828 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3736 -s 9042⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe"C:\Users\Admin\AppData\Local\Temp\ef0cbf775e540a36352c5d47bbf08d30b15b1600a7a5f2983907de18c44d94ce.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1E32.exeC:\Users\Admin\AppData\Local\Temp\1E32.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\2E9E.exeC:\Users\Admin\AppData\Local\Temp\2E9E.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\45B2.exeC:\Users\Admin\AppData\Local\Temp\45B2.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2968 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\4F67.exeC:\Users\Admin\AppData\Local\Temp\4F67.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3812 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1E32.exeMD5
32b09f3af9d677a8e1b3bfa018db5c29
SHA11129ba6ed7ac21e78abd0521795b8bfed3643505
SHA25622b29e49b8a545c40e4822b67b9a1eea70e0274ea1a2687a3b539216aceb950e
SHA512a904c40325d1d5b4683b23c686f7c2799ba888510c82574d004c51929cec8443243bdfacddbf9acf33225225fe3a2ac3280e690273ee3b7fb70343975150c350
-
C:\Users\Admin\AppData\Local\Temp\1E32.exeMD5
32b09f3af9d677a8e1b3bfa018db5c29
SHA11129ba6ed7ac21e78abd0521795b8bfed3643505
SHA25622b29e49b8a545c40e4822b67b9a1eea70e0274ea1a2687a3b539216aceb950e
SHA512a904c40325d1d5b4683b23c686f7c2799ba888510c82574d004c51929cec8443243bdfacddbf9acf33225225fe3a2ac3280e690273ee3b7fb70343975150c350
-
C:\Users\Admin\AppData\Local\Temp\2E9E.exeMD5
0e314e38d19179ead2e608867588bc50
SHA1e76f626f2898fdef4008fcaa961175767a5b03c2
SHA256e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b
SHA512a1d5fb57e5594c45b6433048055ae4205f0795b95f759fef1cf8179134600b45bd33ae205db2cb8c4addb1fe5360522527169818a7549a8519e5ff2ba301dea8
-
C:\Users\Admin\AppData\Local\Temp\2E9E.exeMD5
0e314e38d19179ead2e608867588bc50
SHA1e76f626f2898fdef4008fcaa961175767a5b03c2
SHA256e57b333b6656132ec903d5b028dd95dc432486a32216b8c393c0cfe72647490b
SHA512a1d5fb57e5594c45b6433048055ae4205f0795b95f759fef1cf8179134600b45bd33ae205db2cb8c4addb1fe5360522527169818a7549a8519e5ff2ba301dea8
-
C:\Users\Admin\AppData\Local\Temp\45B2.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\45B2.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\4F67.exeMD5
7ec08f02ceeda6270dfa2c8ef7d92ea8
SHA19e1a5141b3a256f910dc855b060d26693e4dfd52
SHA256fa1e301f1b1e210093cf27781b78cfa7bb002ce39f49bcfae5ee904d3846e666
SHA512457f81cbc4b4b30ba5e75e46bbe846f4ad2f6aafaf495f60e9d28fdf07991c3a70e1690909d4318cbabdb916ee2b4d60c2b05f0091587340c20b823d585179b8
-
C:\Users\Admin\AppData\Local\Temp\4F67.exeMD5
7ec08f02ceeda6270dfa2c8ef7d92ea8
SHA19e1a5141b3a256f910dc855b060d26693e4dfd52
SHA256fa1e301f1b1e210093cf27781b78cfa7bb002ce39f49bcfae5ee904d3846e666
SHA512457f81cbc4b4b30ba5e75e46bbe846f4ad2f6aafaf495f60e9d28fdf07991c3a70e1690909d4318cbabdb916ee2b4d60c2b05f0091587340c20b823d585179b8
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
32b09f3af9d677a8e1b3bfa018db5c29
SHA11129ba6ed7ac21e78abd0521795b8bfed3643505
SHA25622b29e49b8a545c40e4822b67b9a1eea70e0274ea1a2687a3b539216aceb950e
SHA512a904c40325d1d5b4683b23c686f7c2799ba888510c82574d004c51929cec8443243bdfacddbf9acf33225225fe3a2ac3280e690273ee3b7fb70343975150c350
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
32b09f3af9d677a8e1b3bfa018db5c29
SHA11129ba6ed7ac21e78abd0521795b8bfed3643505
SHA25622b29e49b8a545c40e4822b67b9a1eea70e0274ea1a2687a3b539216aceb950e
SHA512a904c40325d1d5b4683b23c686f7c2799ba888510c82574d004c51929cec8443243bdfacddbf9acf33225225fe3a2ac3280e690273ee3b7fb70343975150c350
-
memory/596-203-0x0000000000000000-mapping.dmp
-
memory/732-127-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/732-126-0x00000000048F0000-0x0000000004981000-memory.dmpFilesize
580KB
-
memory/732-125-0x0000000004870000-0x00000000048EF000-memory.dmpFilesize
508KB
-
memory/732-122-0x0000000000000000-mapping.dmp
-
memory/760-197-0x0000000000000000-mapping.dmp
-
memory/928-278-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/928-276-0x0000000000000000-mapping.dmp
-
memory/928-277-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/964-187-0x0000000000000000-mapping.dmp
-
memory/1188-284-0x0000000000110000-0x0000000000116000-memory.dmpFilesize
24KB
-
memory/1188-283-0x0000000000000000-mapping.dmp
-
memory/1188-285-0x0000000000100000-0x000000000010C000-memory.dmpFilesize
48KB
-
memory/1316-286-0x0000000000000000-mapping.dmp
-
memory/1316-290-0x0000000003010000-0x000000000301B000-memory.dmpFilesize
44KB
-
memory/1316-288-0x0000000003020000-0x0000000003026000-memory.dmpFilesize
24KB
-
memory/1316-177-0x0000000000000000-mapping.dmp
-
memory/1656-149-0x0000000004CD0000-0x0000000004CFC000-memory.dmpFilesize
176KB
-
memory/1656-163-0x00000000089E0000-0x00000000089E1000-memory.dmpFilesize
4KB
-
memory/1656-148-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/1656-146-0x0000000002E10000-0x0000000002E49000-memory.dmpFilesize
228KB
-
memory/1656-150-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/1656-152-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1656-151-0x0000000000400000-0x0000000002B95000-memory.dmpFilesize
39.6MB
-
memory/1656-153-0x0000000004D22000-0x0000000004D23000-memory.dmpFilesize
4KB
-
memory/1656-154-0x0000000004D23000-0x0000000004D24000-memory.dmpFilesize
4KB
-
memory/1656-155-0x0000000007D20000-0x0000000007D21000-memory.dmpFilesize
4KB
-
memory/1656-156-0x0000000007D50000-0x0000000007D51000-memory.dmpFilesize
4KB
-
memory/1656-157-0x0000000007EA0000-0x0000000007EA1000-memory.dmpFilesize
4KB
-
memory/1656-158-0x0000000004D24000-0x0000000004D26000-memory.dmpFilesize
8KB
-
memory/1656-159-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/1656-160-0x0000000008190000-0x0000000008191000-memory.dmpFilesize
4KB
-
memory/1656-161-0x0000000008840000-0x0000000008841000-memory.dmpFilesize
4KB
-
memory/1656-162-0x00000000088E0000-0x00000000088E1000-memory.dmpFilesize
4KB
-
memory/1656-147-0x0000000004A50000-0x0000000004A7E000-memory.dmpFilesize
184KB
-
memory/1656-164-0x0000000008D10000-0x0000000008D11000-memory.dmpFilesize
4KB
-
memory/1656-165-0x0000000008EE0000-0x0000000008EE1000-memory.dmpFilesize
4KB
-
memory/1656-145-0x0000000002DE0000-0x0000000002E0B000-memory.dmpFilesize
172KB
-
memory/1656-142-0x0000000000000000-mapping.dmp
-
memory/1680-179-0x0000000000000000-mapping.dmp
-
memory/1732-204-0x0000000000000000-mapping.dmp
-
memory/1756-180-0x0000000000000000-mapping.dmp
-
memory/2020-303-0x0000021C974B0000-0x0000021C974B1000-memory.dmpFilesize
4KB
-
memory/2020-182-0x0000000000000000-mapping.dmp
-
memory/2052-181-0x0000000000000000-mapping.dmp
-
memory/2164-205-0x0000000000000000-mapping.dmp
-
memory/2188-200-0x0000000000000000-mapping.dmp
-
memory/2212-293-0x00000000005D0000-0x00000000005D7000-memory.dmpFilesize
28KB
-
memory/2212-294-0x00000000005C0000-0x00000000005CD000-memory.dmpFilesize
52KB
-
memory/2212-292-0x0000000000000000-mapping.dmp
-
memory/2248-201-0x0000000000000000-mapping.dmp
-
memory/2268-183-0x0000000000000000-mapping.dmp
-
memory/2428-188-0x0000000000000000-mapping.dmp
-
memory/2436-212-0x0000000006700000-0x0000000006702000-memory.dmpFilesize
8KB
-
memory/2436-167-0x0000000006700000-0x0000000006702000-memory.dmpFilesize
8KB
-
memory/2436-121-0x0000000001330000-0x0000000001346000-memory.dmpFilesize
88KB
-
memory/2436-210-0x0000000006700000-0x0000000006702000-memory.dmpFilesize
8KB
-
memory/2436-166-0x0000000006700000-0x0000000006702000-memory.dmpFilesize
8KB
-
memory/2436-213-0x0000000006700000-0x0000000006702000-memory.dmpFilesize
8KB
-
memory/2436-141-0x0000000003580000-0x0000000003596000-memory.dmpFilesize
88KB
-
memory/2436-168-0x00000000066F0000-0x00000000066FF000-memory.dmpFilesize
60KB
-
memory/2460-178-0x0000000000000000-mapping.dmp
-
memory/2600-295-0x000002D051110000-0x000002D051111000-memory.dmpFilesize
4KB
-
memory/2644-296-0x000001FA91C60000-0x000001FA91C61000-memory.dmpFilesize
4KB
-
memory/2700-207-0x0000000000000000-mapping.dmp
-
memory/2716-206-0x0000000000000000-mapping.dmp
-
memory/2788-174-0x0000000000000000-mapping.dmp
-
memory/2828-169-0x0000000000000000-mapping.dmp
-
memory/2892-184-0x0000000000000000-mapping.dmp
-
memory/2928-300-0x0000029AB4330000-0x0000029AB4331000-memory.dmpFilesize
4KB
-
memory/2928-297-0x0000029AB3FF0000-0x0000029AB3FF1000-memory.dmpFilesize
4KB
-
memory/2936-208-0x0000000000000000-mapping.dmp
-
memory/2968-138-0x0000000000000000-mapping.dmp
-
memory/2968-299-0x0000016586470000-0x0000016586471000-memory.dmpFilesize
4KB
-
memory/2976-202-0x0000000000000000-mapping.dmp
-
memory/3168-199-0x0000000000000000-mapping.dmp
-
memory/3196-189-0x0000000000000000-mapping.dmp
-
memory/3244-131-0x0000000000000000-mapping.dmp
-
memory/3244-137-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3244-135-0x0000000002B80000-0x0000000002CCA000-memory.dmpFilesize
1.3MB
-
memory/3244-136-0x0000000002B80000-0x0000000002CCA000-memory.dmpFilesize
1.3MB
-
memory/3496-298-0x000001E988D50000-0x000001E988D51000-memory.dmpFilesize
4KB
-
memory/3576-239-0x0000000000000000-mapping.dmp
-
memory/3584-120-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3584-194-0x0000000000000000-mapping.dmp
-
memory/3584-119-0x00000000048A0000-0x00000000048A9000-memory.dmpFilesize
36KB
-
memory/3584-118-0x0000000004890000-0x0000000004898000-memory.dmpFilesize
32KB
-
memory/3640-191-0x0000000000000000-mapping.dmp
-
memory/3656-269-0x0000000002A20000-0x0000000002A8B000-memory.dmpFilesize
428KB
-
memory/3656-268-0x0000000002A90000-0x0000000002B05000-memory.dmpFilesize
468KB
-
memory/3656-265-0x0000000000000000-mapping.dmp
-
memory/3784-185-0x0000000000000000-mapping.dmp
-
memory/3812-236-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-255-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-224-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-226-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-227-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-228-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-230-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-231-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-233-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-234-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-235-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-222-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-237-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-221-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-240-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-241-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-243-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-244-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-246-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-248-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-249-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-250-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-254-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-223-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-256-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-220-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-219-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-218-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-287-0x000001256D610000-0x000001256D611000-memory.dmpFilesize
4KB
-
memory/3812-279-0x000001256B5C0000-0x000001256B5C1000-memory.dmpFilesize
4KB
-
memory/3812-214-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-304-0x000001256B5D0000-0x000001256B5D1000-memory.dmpFilesize
4KB
-
memory/3812-302-0x000001256B750000-0x000001256B751000-memory.dmpFilesize
4KB
-
memory/3812-215-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3812-216-0x00007FFB71C20000-0x00007FFB71C8B000-memory.dmpFilesize
428KB
-
memory/3888-209-0x0000000000000000-mapping.dmp
-
memory/3972-301-0x000001E847DF0000-0x000001E847DF1000-memory.dmpFilesize
4KB
-
memory/3984-192-0x0000000000000000-mapping.dmp
-
memory/3996-193-0x0000000000000000-mapping.dmp
-
memory/4076-195-0x0000000000000000-mapping.dmp
-
memory/4164-272-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/4164-271-0x0000000000560000-0x0000000000567000-memory.dmpFilesize
28KB
-
memory/4164-270-0x0000000000000000-mapping.dmp
-
memory/4232-196-0x0000000000000000-mapping.dmp
-
memory/4348-172-0x0000000000000000-mapping.dmp
-
memory/4472-198-0x0000000000000000-mapping.dmp
-
memory/4520-289-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/4520-134-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/4520-291-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/4520-128-0x0000000000000000-mapping.dmp
-
memory/4636-171-0x0000000000000000-mapping.dmp
-
memory/4976-170-0x0000000000000000-mapping.dmp
-
memory/5016-186-0x0000000000000000-mapping.dmp
-
memory/5032-173-0x0000000000000000-mapping.dmp
-
memory/5036-190-0x0000000000000000-mapping.dmp
-
memory/5044-275-0x0000000002E40000-0x0000000002E4B000-memory.dmpFilesize
44KB
-
memory/5044-274-0x0000000002E50000-0x0000000002E57000-memory.dmpFilesize
28KB
-
memory/5044-273-0x0000000000000000-mapping.dmp
-
memory/5080-280-0x0000000000000000-mapping.dmp
-
memory/5080-281-0x0000000002800000-0x0000000002805000-memory.dmpFilesize
20KB
-
memory/5080-282-0x00000000025F0000-0x00000000025F9000-memory.dmpFilesize
36KB
-
memory/5088-176-0x00000240069D0000-0x00000240069D2000-memory.dmpFilesize
8KB
-
memory/5088-175-0x00000240069D0000-0x00000240069D2000-memory.dmpFilesize
8KB