Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 04:29
Static task
static1
Behavioral task
behavioral1
Sample
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe
Resource
win10-en-20211104
General
-
Target
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe
-
Size
232KB
-
MD5
663f6131e2439a4ed1bae71bd27f7c79
-
SHA1
8c12785381693839306410c02a5bbcaeef037b53
-
SHA256
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee
-
SHA512
5cdcb9346f60e04dc0eaaeb24ac09758b79b0dc74f6836d1910bf1a8095deccfb6eab67ebd79b3f4fbc05bc67eccd22731b9fcf347504469f0f4a1978bf2ffea
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4472-156-0x0000000004A30000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/4472-163-0x0000000004B10000-0x0000000004B3C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
hdbchfj488E.exeSmartClock.exe705B.exeB95B.exeD205.exepid process 4440 hdbchfj 4384 488E.exe 3852 SmartClock.exe 656 705B.exe 1904 B95B.exe 4472 D205.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Drops startup file 1 IoCs
Processes:
488E.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 488E.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2420 1904 WerFault.exe B95B.exe 3608 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exehdbchfj705B.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hdbchfj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hdbchfj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hdbchfj -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 4008 ipconfig.exe 3744 ipconfig.exe 420 NETSTAT.EXE 1820 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F3BD2E8-5584-11EC-B34F-6EDE93C6208D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 3852 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exepid process 3688 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe 3688 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 59 IoCs
Processes:
96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exehdbchfj705B.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3688 96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe 4440 hdbchfj 656 705B.exe 396 396 396 396 396 396 2028 explorer.exe 2028 explorer.exe 396 396 596 explorer.exe 596 explorer.exe 396 396 1908 explorer.exe 1908 explorer.exe 396 396 3104 explorer.exe 3104 explorer.exe 396 396 4456 explorer.exe 4456 explorer.exe 4456 explorer.exe 4456 explorer.exe 396 396 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeWMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeDebugPrivilege 2420 WerFault.exe Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeIncreaseQuotaPrivilege 2192 WMIC.exe Token: SeSecurityPrivilege 2192 WMIC.exe Token: SeTakeOwnershipPrivilege 2192 WMIC.exe Token: SeLoadDriverPrivilege 2192 WMIC.exe Token: SeSystemProfilePrivilege 2192 WMIC.exe Token: SeSystemtimePrivilege 2192 WMIC.exe Token: SeProfSingleProcessPrivilege 2192 WMIC.exe Token: SeIncBasePriorityPrivilege 2192 WMIC.exe Token: SeCreatePagefilePrivilege 2192 WMIC.exe Token: SeBackupPrivilege 2192 WMIC.exe Token: SeRestorePrivilege 2192 WMIC.exe Token: SeShutdownPrivilege 2192 WMIC.exe Token: SeDebugPrivilege 2192 WMIC.exe Token: SeSystemEnvironmentPrivilege 2192 WMIC.exe Token: SeRemoteShutdownPrivilege 2192 WMIC.exe Token: SeUndockPrivilege 2192 WMIC.exe Token: SeManageVolumePrivilege 2192 WMIC.exe Token: 33 2192 WMIC.exe Token: 34 2192 WMIC.exe Token: 35 2192 WMIC.exe Token: 36 2192 WMIC.exe Token: SeIncreaseQuotaPrivilege 2192 WMIC.exe Token: SeSecurityPrivilege 2192 WMIC.exe Token: SeTakeOwnershipPrivilege 2192 WMIC.exe Token: SeLoadDriverPrivilege 2192 WMIC.exe Token: SeSystemProfilePrivilege 2192 WMIC.exe Token: SeSystemtimePrivilege 2192 WMIC.exe Token: SeProfSingleProcessPrivilege 2192 WMIC.exe Token: SeIncBasePriorityPrivilege 2192 WMIC.exe Token: SeCreatePagefilePrivilege 2192 WMIC.exe Token: SeBackupPrivilege 2192 WMIC.exe Token: SeRestorePrivilege 2192 WMIC.exe Token: SeShutdownPrivilege 2192 WMIC.exe Token: SeDebugPrivilege 2192 WMIC.exe Token: SeSystemEnvironmentPrivilege 2192 WMIC.exe Token: SeRemoteShutdownPrivilege 2192 WMIC.exe Token: SeUndockPrivilege 2192 WMIC.exe Token: SeManageVolumePrivilege 2192 WMIC.exe Token: 33 2192 WMIC.exe Token: 34 2192 WMIC.exe Token: 35 2192 WMIC.exe Token: 36 2192 WMIC.exe Token: SeIncreaseQuotaPrivilege 4936 WMIC.exe Token: SeSecurityPrivilege 4936 WMIC.exe Token: SeTakeOwnershipPrivilege 4936 WMIC.exe Token: SeLoadDriverPrivilege 4936 WMIC.exe Token: SeSystemProfilePrivilege 4936 WMIC.exe Token: SeSystemtimePrivilege 4936 WMIC.exe Token: SeProfSingleProcessPrivilege 4936 WMIC.exe Token: SeIncBasePriorityPrivilege 4936 WMIC.exe Token: SeCreatePagefilePrivilege 4936 WMIC.exe Token: SeBackupPrivilege 4936 WMIC.exe Token: SeRestorePrivilege 4936 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1916 iexplore.exe 1916 iexplore.exe 4656 IEXPLORE.EXE 4656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
488E.execmd.exenet.exenet.exedescription pid process target process PID 396 wrote to memory of 4384 396 488E.exe PID 396 wrote to memory of 4384 396 488E.exe PID 396 wrote to memory of 4384 396 488E.exe PID 4384 wrote to memory of 3852 4384 488E.exe SmartClock.exe PID 4384 wrote to memory of 3852 4384 488E.exe SmartClock.exe PID 4384 wrote to memory of 3852 4384 488E.exe SmartClock.exe PID 396 wrote to memory of 656 396 705B.exe PID 396 wrote to memory of 656 396 705B.exe PID 396 wrote to memory of 656 396 705B.exe PID 396 wrote to memory of 1904 396 B95B.exe PID 396 wrote to memory of 1904 396 B95B.exe PID 396 wrote to memory of 4472 396 D205.exe PID 396 wrote to memory of 4472 396 D205.exe PID 396 wrote to memory of 4472 396 D205.exe PID 396 wrote to memory of 4864 396 cmd.exe PID 396 wrote to memory of 4864 396 cmd.exe PID 4864 wrote to memory of 2192 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2192 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4936 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4936 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4660 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4660 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4336 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4336 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4956 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 4956 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1356 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1356 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2372 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2372 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1660 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1660 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1908 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 1908 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2244 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2244 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2788 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2788 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 3352 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 3352 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2272 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2272 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2152 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2152 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 3744 4864 cmd.exe ipconfig.exe PID 4864 wrote to memory of 3744 4864 cmd.exe ipconfig.exe PID 4864 wrote to memory of 3592 4864 cmd.exe ROUTE.EXE PID 4864 wrote to memory of 3592 4864 cmd.exe ROUTE.EXE PID 4864 wrote to memory of 3172 4864 cmd.exe netsh.exe PID 4864 wrote to memory of 3172 4864 cmd.exe netsh.exe PID 4864 wrote to memory of 2204 4864 cmd.exe systeminfo.exe PID 4864 wrote to memory of 2204 4864 cmd.exe systeminfo.exe PID 4864 wrote to memory of 740 4864 cmd.exe tasklist.exe PID 4864 wrote to memory of 740 4864 cmd.exe tasklist.exe PID 4864 wrote to memory of 3056 4864 cmd.exe net.exe PID 4864 wrote to memory of 3056 4864 cmd.exe net.exe PID 3056 wrote to memory of 4504 3056 net.exe net1.exe PID 3056 wrote to memory of 4504 3056 net.exe net1.exe PID 4864 wrote to memory of 4512 4864 cmd.exe net.exe PID 4864 wrote to memory of 4512 4864 cmd.exe net.exe PID 4512 wrote to memory of 4360 4512 net.exe net1.exe PID 4512 wrote to memory of 4360 4512 net.exe net1.exe PID 4864 wrote to memory of 4528 4864 cmd.exe net.exe PID 4864 wrote to memory of 4528 4864 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2880
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3696
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 8922⤵
- Program crash
PID:3608
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3448
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3248
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3236
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe"C:\Users\Admin\AppData\Local\Temp\96bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3688
-
C:\Users\Admin\AppData\Roaming\hdbchfjC:\Users\Admin\AppData\Roaming\hdbchfj1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4440
-
C:\Users\Admin\AppData\Local\Temp\488E.exeC:\Users\Admin\AppData\Local\Temp\488E.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:3852
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\705B.exeC:\Users\Admin\AppData\Local\Temp\705B.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:656
-
C:\Users\Admin\AppData\Local\Temp\B95B.exeC:\Users\Admin\AppData\Local\Temp\B95B.exe1⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1904 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Users\Admin\AppData\Local\Temp\D205.exeC:\Users\Admin\AppData\Local\Temp\D205.exe1⤵
- Executes dropped EXE
PID:4472
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵PID:4660
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵PID:4336
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵PID:4956
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵PID:1356
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵PID:1660
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵PID:1908
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵PID:2788
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵PID:3352
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵PID:2272
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵PID:2152
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
PID:3744 -
C:\Windows\system32\ROUTE.EXEroute print2⤵PID:3592
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵PID:3172
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:2204 -
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
PID:740 -
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵PID:4504
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵PID:4360
-
C:\Windows\system32\net.exenet user2⤵PID:4528
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵PID:4568
-
C:\Windows\system32\net.exenet user /domain2⤵PID:4380
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵PID:4056
-
C:\Windows\system32\net.exenet use2⤵PID:860
-
C:\Windows\system32\net.exenet group2⤵PID:352
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵PID:2912
-
C:\Windows\system32\net.exenet localgroup2⤵PID:3568
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵PID:856
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
PID:420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵PID:1272
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵PID:1608
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
PID:1820 -
C:\Windows\system32\schtasks.exeschtasks /query2⤵PID:1432
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:4008
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5108
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4656
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1400
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1768
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:2028
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:596
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1908
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3104
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4456
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\488E.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Local\Temp\488E.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Local\Temp\705B.exeMD5
bc200d1d9549c0d552a3176a6b8306e5
SHA1bcd2b7586194fa423f937dc067da7e574ec865c4
SHA256a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b
SHA512bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee
-
C:\Users\Admin\AppData\Local\Temp\705B.exeMD5
bc200d1d9549c0d552a3176a6b8306e5
SHA1bcd2b7586194fa423f937dc067da7e574ec865c4
SHA256a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b
SHA512bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee
-
C:\Users\Admin\AppData\Local\Temp\B95B.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\B95B.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\D205.exeMD5
00fcb05f0ab14ac59946bca333704e21
SHA153060aaa268e70173f7e6bd707281c103fa4275c
SHA25628bd58849bc16c8e724610ed3a6457018826915693a62e7bdb8c4211a3b2d991
SHA5124440357f91564c806c20cfe02f72a4fa2ab1e5cfbcaf459790d0707c9ea50a6884f0f650c6819a783b93ac34e3a46d1ca34a345c895d63212556bf1dfc4f9ac5
-
C:\Users\Admin\AppData\Local\Temp\D205.exeMD5
00fcb05f0ab14ac59946bca333704e21
SHA153060aaa268e70173f7e6bd707281c103fa4275c
SHA25628bd58849bc16c8e724610ed3a6457018826915693a62e7bdb8c4211a3b2d991
SHA5124440357f91564c806c20cfe02f72a4fa2ab1e5cfbcaf459790d0707c9ea50a6884f0f650c6819a783b93ac34e3a46d1ca34a345c895d63212556bf1dfc4f9ac5
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Roaming\hdbchfjMD5
663f6131e2439a4ed1bae71bd27f7c79
SHA18c12785381693839306410c02a5bbcaeef037b53
SHA25696bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee
SHA5125cdcb9346f60e04dc0eaaeb24ac09758b79b0dc74f6836d1910bf1a8095deccfb6eab67ebd79b3f4fbc05bc67eccd22731b9fcf347504469f0f4a1978bf2ffea
-
C:\Users\Admin\AppData\Roaming\hdbchfjMD5
663f6131e2439a4ed1bae71bd27f7c79
SHA18c12785381693839306410c02a5bbcaeef037b53
SHA25696bb507a07e9c3266a3f869ff5beba7be7911eebfe4aa389e04fed6e750586ee
SHA5125cdcb9346f60e04dc0eaaeb24ac09758b79b0dc74f6836d1910bf1a8095deccfb6eab67ebd79b3f4fbc05bc67eccd22731b9fcf347504469f0f4a1978bf2ffea
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/352-206-0x0000000000000000-mapping.dmp
-
memory/396-220-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/396-217-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/396-153-0x0000000004150000-0x000000000415F000-memory.dmpFilesize
60KB
-
memory/396-219-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/396-148-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/396-127-0x0000000000750000-0x0000000000766000-memory.dmpFilesize
88KB
-
memory/396-121-0x00000000003D0000-0x00000000003E6000-memory.dmpFilesize
88KB
-
memory/396-144-0x0000000002620000-0x0000000002636000-memory.dmpFilesize
88KB
-
memory/396-149-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/420-211-0x0000000000000000-mapping.dmp
-
memory/596-283-0x0000000000000000-mapping.dmp
-
memory/596-285-0x0000000001080000-0x000000000108E000-memory.dmpFilesize
56KB
-
memory/596-284-0x0000000001090000-0x0000000001099000-memory.dmpFilesize
36KB
-
memory/656-143-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/656-141-0x0000000002C60000-0x0000000002C68000-memory.dmpFilesize
32KB
-
memory/656-142-0x0000000002C80000-0x0000000002DCA000-memory.dmpFilesize
1.3MB
-
memory/656-138-0x0000000000000000-mapping.dmp
-
memory/740-196-0x0000000000000000-mapping.dmp
-
memory/856-209-0x0000000000000000-mapping.dmp
-
memory/860-205-0x0000000000000000-mapping.dmp
-
memory/1272-212-0x0000000000000000-mapping.dmp
-
memory/1356-177-0x0000000000000000-mapping.dmp
-
memory/1400-276-0x0000000003200000-0x000000000326B000-memory.dmpFilesize
428KB
-
memory/1400-275-0x0000000003270000-0x00000000032E5000-memory.dmpFilesize
468KB
-
memory/1400-274-0x0000000000000000-mapping.dmp
-
memory/1432-215-0x0000000000000000-mapping.dmp
-
memory/1504-301-0x0000000000D10000-0x0000000000D1D000-memory.dmpFilesize
52KB
-
memory/1504-299-0x0000000000000000-mapping.dmp
-
memory/1504-300-0x0000000000D20000-0x0000000000D27000-memory.dmpFilesize
28KB
-
memory/1608-213-0x0000000000000000-mapping.dmp
-
memory/1660-179-0x0000000000000000-mapping.dmp
-
memory/1768-279-0x00000000008F0000-0x00000000008FC000-memory.dmpFilesize
48KB
-
memory/1768-278-0x0000000000900000-0x0000000000907000-memory.dmpFilesize
28KB
-
memory/1768-277-0x0000000000000000-mapping.dmp
-
memory/1820-214-0x0000000000000000-mapping.dmp
-
memory/1904-145-0x0000000000000000-mapping.dmp
-
memory/1904-306-0x0000016F9D4F0000-0x0000016F9D4F1000-memory.dmpFilesize
4KB
-
memory/1908-287-0x0000000000000000-mapping.dmp
-
memory/1908-288-0x0000000000600000-0x0000000000605000-memory.dmpFilesize
20KB
-
memory/1908-289-0x00000000003F0000-0x00000000003F9000-memory.dmpFilesize
36KB
-
memory/1908-180-0x0000000000000000-mapping.dmp
-
memory/1916-221-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-253-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-228-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-227-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-293-0x00000162D9820000-0x00000162D9821000-memory.dmpFilesize
4KB
-
memory/1916-226-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-263-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-262-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-261-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-257-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-225-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-256-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-286-0x00000162D77D0000-0x00000162D77D1000-memory.dmpFilesize
4KB
-
memory/1916-223-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-255-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-222-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-230-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-242-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-231-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-251-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-250-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-233-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-234-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-235-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-237-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-238-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-229-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-247-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-239-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-309-0x00000162D7960000-0x00000162D7961000-memory.dmpFilesize
4KB
-
memory/1916-248-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-244-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-241-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/1916-243-0x00007FF91BCE0000-0x00007FF91BD4B000-memory.dmpFilesize
428KB
-
memory/2028-282-0x0000000000A70000-0x0000000000A7B000-memory.dmpFilesize
44KB
-
memory/2028-280-0x0000000000000000-mapping.dmp
-
memory/2028-281-0x0000000000A80000-0x0000000000A87000-memory.dmpFilesize
28KB
-
memory/2152-189-0x0000000000000000-mapping.dmp
-
memory/2192-161-0x0000000000000000-mapping.dmp
-
memory/2204-195-0x0000000000000000-mapping.dmp
-
memory/2244-183-0x0000000000000000-mapping.dmp
-
memory/2272-188-0x0000000000000000-mapping.dmp
-
memory/2372-178-0x0000000000000000-mapping.dmp
-
memory/2420-308-0x0000024704190000-0x0000024704191000-memory.dmpFilesize
4KB
-
memory/2592-302-0x0000026D7F0A0000-0x0000026D7F0A1000-memory.dmpFilesize
4KB
-
memory/2612-303-0x000001AB3A4C0000-0x000001AB3A4C1000-memory.dmpFilesize
4KB
-
memory/2788-186-0x0000000000000000-mapping.dmp
-
memory/2880-304-0x0000018C9EB20000-0x0000018C9EB21000-memory.dmpFilesize
4KB
-
memory/2880-307-0x0000018C9EE60000-0x0000018C9EE61000-memory.dmpFilesize
4KB
-
memory/2912-207-0x0000000000000000-mapping.dmp
-
memory/3056-197-0x0000000000000000-mapping.dmp
-
memory/3104-292-0x0000000000520000-0x000000000052C000-memory.dmpFilesize
48KB
-
memory/3104-290-0x0000000000000000-mapping.dmp
-
memory/3104-291-0x0000000000530000-0x0000000000536000-memory.dmpFilesize
24KB
-
memory/3172-194-0x0000000000000000-mapping.dmp
-
memory/3352-187-0x0000000000000000-mapping.dmp
-
memory/3448-305-0x00000260868C0000-0x00000260868C1000-memory.dmpFilesize
4KB
-
memory/3568-208-0x0000000000000000-mapping.dmp
-
memory/3592-193-0x0000000000000000-mapping.dmp
-
memory/3608-310-0x0000028C61610000-0x0000028C61611000-memory.dmpFilesize
4KB
-
memory/3688-118-0x0000000002CF0000-0x0000000002CF8000-memory.dmpFilesize
32KB
-
memory/3688-120-0x0000000002D00000-0x0000000002D09000-memory.dmpFilesize
36KB
-
memory/3688-119-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3744-192-0x0000000000000000-mapping.dmp
-
memory/3852-297-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3852-137-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3852-134-0x0000000000000000-mapping.dmp
-
memory/3852-298-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/4008-216-0x0000000000000000-mapping.dmp
-
memory/4056-204-0x0000000000000000-mapping.dmp
-
memory/4336-171-0x0000000000000000-mapping.dmp
-
memory/4360-200-0x0000000000000000-mapping.dmp
-
memory/4380-203-0x0000000000000000-mapping.dmp
-
memory/4384-128-0x0000000000000000-mapping.dmp
-
memory/4384-133-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/4384-132-0x00000000048E0000-0x0000000004971000-memory.dmpFilesize
580KB
-
memory/4384-131-0x0000000004810000-0x000000000488F000-memory.dmpFilesize
508KB
-
memory/4440-126-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/4440-124-0x0000000002B80000-0x0000000002C2E000-memory.dmpFilesize
696KB
-
memory/4440-125-0x0000000002B80000-0x0000000002C2E000-memory.dmpFilesize
696KB
-
memory/4456-296-0x00000000032B0000-0x00000000032BB000-memory.dmpFilesize
44KB
-
memory/4456-295-0x00000000032C0000-0x00000000032C6000-memory.dmpFilesize
24KB
-
memory/4456-294-0x0000000000000000-mapping.dmp
-
memory/4472-160-0x0000000000400000-0x0000000002B95000-memory.dmpFilesize
39.6MB
-
memory/4472-170-0x0000000007290000-0x0000000007291000-memory.dmpFilesize
4KB
-
memory/4472-150-0x0000000000000000-mapping.dmp
-
memory/4472-155-0x0000000002BA0000-0x0000000002C4E000-memory.dmpFilesize
696KB
-
memory/4472-156-0x0000000004A30000-0x0000000004A5E000-memory.dmpFilesize
184KB
-
memory/4472-157-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/4472-191-0x0000000008FE0000-0x0000000008FE1000-memory.dmpFilesize
4KB
-
memory/4472-190-0x0000000008E10000-0x0000000008E11000-memory.dmpFilesize
4KB
-
memory/4472-185-0x00000000089E0000-0x00000000089E1000-memory.dmpFilesize
4KB
-
memory/4472-184-0x00000000088F0000-0x00000000088F1000-memory.dmpFilesize
4KB
-
memory/4472-182-0x0000000008850000-0x0000000008851000-memory.dmpFilesize
4KB
-
memory/4472-181-0x0000000007B80000-0x0000000007B81000-memory.dmpFilesize
4KB
-
memory/4472-158-0x0000000002BA0000-0x0000000002C4E000-memory.dmpFilesize
696KB
-
memory/4472-159-0x0000000007392000-0x0000000007393000-memory.dmpFilesize
4KB
-
memory/4472-174-0x0000000007394000-0x0000000007396000-memory.dmpFilesize
8KB
-
memory/4472-162-0x00000000073A0000-0x00000000073A1000-memory.dmpFilesize
4KB
-
memory/4472-172-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/4472-163-0x0000000004B10000-0x0000000004B3C000-memory.dmpFilesize
176KB
-
memory/4472-165-0x0000000007EB0000-0x0000000007EB1000-memory.dmpFilesize
4KB
-
memory/4472-168-0x0000000007393000-0x0000000007394000-memory.dmpFilesize
4KB
-
memory/4472-167-0x00000000078A0000-0x00000000078A1000-memory.dmpFilesize
4KB
-
memory/4472-166-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/4504-198-0x0000000000000000-mapping.dmp
-
memory/4512-199-0x0000000000000000-mapping.dmp
-
memory/4528-201-0x0000000000000000-mapping.dmp
-
memory/4568-202-0x0000000000000000-mapping.dmp
-
memory/4656-246-0x0000000000000000-mapping.dmp
-
memory/4660-169-0x0000000000000000-mapping.dmp
-
memory/4864-154-0x0000000000000000-mapping.dmp
-
memory/4936-164-0x0000000000000000-mapping.dmp
-
memory/4956-173-0x0000000000000000-mapping.dmp
-
memory/5108-175-0x000001F6FDE30000-0x000001F6FDE32000-memory.dmpFilesize
8KB
-
memory/5108-176-0x000001F6FDE30000-0x000001F6FDE32000-memory.dmpFilesize
8KB