Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-12-2021 05:41
Static task
static1
Behavioral task
behavioral1
Sample
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe
Resource
win10-en-20211014
General
-
Target
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe
-
Size
232KB
-
MD5
702734f7de078e9939cba207472df2eb
-
SHA1
60421930fcf589c65ed577126571928385074c55
-
SHA256
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e
-
SHA512
d08e7ebf39a8cce5a9d9d9d337f93c4e0d5b314e02a3228f0cf76c91ea6e4e0ebc8351d16a46bce94b77c2eb817dee87c951d6dddf160101f00a82e37cca392d
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1296-193-0x0000000004C60000-0x0000000004C8E000-memory.dmp family_redline behavioral1/memory/1296-198-0x0000000007140000-0x000000000716C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
69D2.exeSmartClock.exe9140.exeDC54.exeF56B.exepid process 3972 69D2.exe 3508 SmartClock.exe 3048 9140.exe 1932 DC54.exe 1296 F56B.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Drops startup file 1 IoCs
Processes:
69D2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 69D2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3868 1932 WerFault.exe DC54.exe 520 3824 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe9140.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9140.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9140.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9140.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3048 ipconfig.exe 2760 NETSTAT.EXE 828 NETSTAT.EXE 3916 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5E076AF-5332-11EC-B8A2-42858A040E5E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 3508 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exepid process 3220 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe 3220 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 58 IoCs
Processes:
2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe9140.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3220 2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe 3048 9140.exe 3028 3028 3028 3028 3028 3028 1000 explorer.exe 1000 explorer.exe 3028 3028 828 explorer.exe 828 explorer.exe 3028 3028 1796 explorer.exe 1796 explorer.exe 3028 3028 1508 explorer.exe 1508 explorer.exe 3028 3028 752 explorer.exe 752 explorer.exe 752 explorer.exe 752 explorer.exe 3028 3028 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe 3860 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeWMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeDebugPrivilege 3868 WerFault.exe Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeIncreaseQuotaPrivilege 2148 WMIC.exe Token: SeSecurityPrivilege 2148 WMIC.exe Token: SeTakeOwnershipPrivilege 2148 WMIC.exe Token: SeLoadDriverPrivilege 2148 WMIC.exe Token: SeSystemProfilePrivilege 2148 WMIC.exe Token: SeSystemtimePrivilege 2148 WMIC.exe Token: SeProfSingleProcessPrivilege 2148 WMIC.exe Token: SeIncBasePriorityPrivilege 2148 WMIC.exe Token: SeCreatePagefilePrivilege 2148 WMIC.exe Token: SeBackupPrivilege 2148 WMIC.exe Token: SeRestorePrivilege 2148 WMIC.exe Token: SeShutdownPrivilege 2148 WMIC.exe Token: SeDebugPrivilege 2148 WMIC.exe Token: SeSystemEnvironmentPrivilege 2148 WMIC.exe Token: SeRemoteShutdownPrivilege 2148 WMIC.exe Token: SeUndockPrivilege 2148 WMIC.exe Token: SeManageVolumePrivilege 2148 WMIC.exe Token: 33 2148 WMIC.exe Token: 34 2148 WMIC.exe Token: 35 2148 WMIC.exe Token: 36 2148 WMIC.exe Token: SeIncreaseQuotaPrivilege 2148 WMIC.exe Token: SeSecurityPrivilege 2148 WMIC.exe Token: SeTakeOwnershipPrivilege 2148 WMIC.exe Token: SeLoadDriverPrivilege 2148 WMIC.exe Token: SeSystemProfilePrivilege 2148 WMIC.exe Token: SeSystemtimePrivilege 2148 WMIC.exe Token: SeProfSingleProcessPrivilege 2148 WMIC.exe Token: SeIncBasePriorityPrivilege 2148 WMIC.exe Token: SeCreatePagefilePrivilege 2148 WMIC.exe Token: SeBackupPrivilege 2148 WMIC.exe Token: SeRestorePrivilege 2148 WMIC.exe Token: SeShutdownPrivilege 2148 WMIC.exe Token: SeDebugPrivilege 2148 WMIC.exe Token: SeSystemEnvironmentPrivilege 2148 WMIC.exe Token: SeRemoteShutdownPrivilege 2148 WMIC.exe Token: SeUndockPrivilege 2148 WMIC.exe Token: SeManageVolumePrivilege 2148 WMIC.exe Token: 33 2148 WMIC.exe Token: 34 2148 WMIC.exe Token: 35 2148 WMIC.exe Token: 36 2148 WMIC.exe Token: SeIncreaseQuotaPrivilege 3080 WMIC.exe Token: SeSecurityPrivilege 3080 WMIC.exe Token: SeTakeOwnershipPrivilege 3080 WMIC.exe Token: SeLoadDriverPrivilege 3080 WMIC.exe Token: SeSystemProfilePrivilege 3080 WMIC.exe Token: SeSystemtimePrivilege 3080 WMIC.exe Token: SeProfSingleProcessPrivilege 3080 WMIC.exe Token: SeIncBasePriorityPrivilege 3080 WMIC.exe Token: SeCreatePagefilePrivilege 3080 WMIC.exe Token: SeBackupPrivilege 3080 WMIC.exe Token: SeRestorePrivilege 3080 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3796 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3796 iexplore.exe 3796 iexplore.exe 3556 IEXPLORE.EXE 3556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69D2.execmd.exenet.exenet.exedescription pid process target process PID 3028 wrote to memory of 3972 3028 69D2.exe PID 3028 wrote to memory of 3972 3028 69D2.exe PID 3028 wrote to memory of 3972 3028 69D2.exe PID 3972 wrote to memory of 3508 3972 69D2.exe SmartClock.exe PID 3972 wrote to memory of 3508 3972 69D2.exe SmartClock.exe PID 3972 wrote to memory of 3508 3972 69D2.exe SmartClock.exe PID 3028 wrote to memory of 3048 3028 9140.exe PID 3028 wrote to memory of 3048 3028 9140.exe PID 3028 wrote to memory of 3048 3028 9140.exe PID 3028 wrote to memory of 1932 3028 DC54.exe PID 3028 wrote to memory of 1932 3028 DC54.exe PID 3028 wrote to memory of 3372 3028 cmd.exe PID 3028 wrote to memory of 3372 3028 cmd.exe PID 3028 wrote to memory of 1296 3028 F56B.exe PID 3028 wrote to memory of 1296 3028 F56B.exe PID 3028 wrote to memory of 1296 3028 F56B.exe PID 3372 wrote to memory of 2148 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2148 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3080 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3080 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3916 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3916 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1036 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1036 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3860 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3860 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2252 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2252 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1260 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1260 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2196 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2196 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3812 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3812 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3180 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3180 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2600 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 2600 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1216 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 1216 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 884 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 884 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 4004 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 4004 3372 cmd.exe WMIC.exe PID 3372 wrote to memory of 3048 3372 cmd.exe ipconfig.exe PID 3372 wrote to memory of 3048 3372 cmd.exe ipconfig.exe PID 3372 wrote to memory of 3368 3372 cmd.exe ROUTE.EXE PID 3372 wrote to memory of 3368 3372 cmd.exe ROUTE.EXE PID 3372 wrote to memory of 1612 3372 cmd.exe netsh.exe PID 3372 wrote to memory of 1612 3372 cmd.exe netsh.exe PID 3372 wrote to memory of 592 3372 cmd.exe systeminfo.exe PID 3372 wrote to memory of 592 3372 cmd.exe systeminfo.exe PID 3372 wrote to memory of 2432 3372 cmd.exe tasklist.exe PID 3372 wrote to memory of 2432 3372 cmd.exe tasklist.exe PID 3372 wrote to memory of 2148 3372 cmd.exe net.exe PID 3372 wrote to memory of 2148 3372 cmd.exe net.exe PID 2148 wrote to memory of 2196 2148 net.exe net1.exe PID 2148 wrote to memory of 2196 2148 net.exe net1.exe PID 3372 wrote to memory of 1320 3372 cmd.exe net.exe PID 3372 wrote to memory of 1320 3372 cmd.exe net.exe PID 1320 wrote to memory of 3812 1320 net.exe net1.exe PID 1320 wrote to memory of 3812 1320 net.exe net1.exe PID 3372 wrote to memory of 2044 3372 cmd.exe net.exe PID 3372 wrote to memory of 2044 3372 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3824 -s 9162⤵
- Program crash
PID:520
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3528
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3260
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3244
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2476
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2360
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe"C:\Users\Admin\AppData\Local\Temp\2886efa6dcc0823e8f76c091638969816c75f0b534cbe1bc35a847518c92185e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3220
-
C:\Users\Admin\AppData\Local\Temp\69D2.exeC:\Users\Admin\AppData\Local\Temp\69D2.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:3508
-
C:\Users\Admin\AppData\Local\Temp\9140.exeC:\Users\Admin\AppData\Local\Temp\9140.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3048
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\DC54.exeC:\Users\Admin\AppData\Local\Temp\DC54.exe1⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1932 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵PID:3916
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵PID:1036
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵PID:3860
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵PID:2252
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵PID:1260
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵PID:2196
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵PID:3812
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵PID:3180
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵PID:2600
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵PID:1216
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵PID:884
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵PID:4004
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
PID:3048 -
C:\Windows\system32\ROUTE.EXEroute print2⤵PID:3368
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵PID:1612
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:592 -
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
PID:2432 -
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵PID:2196
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵PID:3812
-
C:\Windows\system32\net.exenet user2⤵PID:2044
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵PID:1012
-
C:\Windows\system32\net.exenet user /domain2⤵PID:1308
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵PID:2948
-
C:\Windows\system32\net.exenet use2⤵PID:696
-
C:\Windows\system32\net.exenet group2⤵PID:2600
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵PID:1820
-
C:\Windows\system32\net.exenet localgroup2⤵PID:1216
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵PID:1856
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
PID:2760 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵PID:3216
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵PID:2108
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
PID:828 -
C:\Windows\system32\schtasks.exeschtasks /query2⤵PID:3716
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:3916
-
C:\Users\Admin\AppData\Local\Temp\F56B.exeC:\Users\Admin\AppData\Local\Temp\F56B.exe1⤵
- Executes dropped EXE
PID:1296
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:2856
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3556
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3696
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1856
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1000
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:828
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1796
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1508
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:752
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3860
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\69D2.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Local\Temp\69D2.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Local\Temp\9140.exeMD5
bc200d1d9549c0d552a3176a6b8306e5
SHA1bcd2b7586194fa423f937dc067da7e574ec865c4
SHA256a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b
SHA512bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee
-
C:\Users\Admin\AppData\Local\Temp\9140.exeMD5
bc200d1d9549c0d552a3176a6b8306e5
SHA1bcd2b7586194fa423f937dc067da7e574ec865c4
SHA256a4623e30d5519818816ab99a69a05bd4633d7ed776c3112177b4540474fd794b
SHA512bf2410e2a3dccf91018ab88c77a9d0949c864d9c0f91fa2b628801aca9bd54401f8af935fcb8a5cc931be5b99dfdd0f5bd523be4c6c209271e10fa029c43e2ee
-
C:\Users\Admin\AppData\Local\Temp\DC54.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\DC54.exeMD5
797969fff63bc27ff47c02212685e027
SHA18dbb347120bdfffbb4eec3929d323cc6ed42698d
SHA256df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4
SHA512de4051aba6167836a16dbc7e27d9b6af306ca97bc0ae6c9cd1f969a6c334c35c828dbe6537bfc8b45deb91d79c821094d9dcd79493231217f6b93b8255cdc297
-
C:\Users\Admin\AppData\Local\Temp\F56B.exeMD5
c929245e9ce35a502e5cd32b65aa52bd
SHA1436970bd93d50ba9c3757d34ed773e53108616e5
SHA256c054f8eef671ddc0a950768128f9ce94491307bc836cde18ff91090966e8dbf5
SHA5127887a5e35e822f7a52ba79ef0250622eef33056ec806a41f1f80bc70f247a77c7220c6b0d99ecc66bcc051d69e04b51cb30009e8bf5aa355c5135f20914dc195
-
C:\Users\Admin\AppData\Local\Temp\F56B.exeMD5
c929245e9ce35a502e5cd32b65aa52bd
SHA1436970bd93d50ba9c3757d34ed773e53108616e5
SHA256c054f8eef671ddc0a950768128f9ce94491307bc836cde18ff91090966e8dbf5
SHA5127887a5e35e822f7a52ba79ef0250622eef33056ec806a41f1f80bc70f247a77c7220c6b0d99ecc66bcc051d69e04b51cb30009e8bf5aa355c5135f20914dc195
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
d8c82a8af410f220685eb71cd9fa2208
SHA104373777849054ff699390bc591514ea398bf996
SHA256b035d596636fed42ca48f32c93b150457310cc896faa0ea41c28d24fc9d2f0b7
SHA512b02272bc85ab072725975b0707c88ee8442d16c32a6e27cb6b4cac165730d9a7de8599a57407f72f20c09d2c2b30926d0e0ce1b4485ad04d51cdb47baaafe704
-
memory/592-226-0x0000000000000000-mapping.dmp
-
memory/696-236-0x0000000000000000-mapping.dmp
-
memory/752-326-0x0000000003220000-0x000000000322B000-memory.dmpFilesize
44KB
-
memory/752-325-0x0000000003230000-0x0000000003236000-memory.dmpFilesize
24KB
-
memory/752-324-0x0000000000000000-mapping.dmp
-
memory/828-313-0x0000000000000000-mapping.dmp
-
memory/828-244-0x0000000000000000-mapping.dmp
-
memory/828-315-0x0000000000560000-0x000000000056E000-memory.dmpFilesize
56KB
-
memory/828-314-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB
-
memory/884-221-0x0000000000000000-mapping.dmp
-
memory/1000-312-0x0000000003220000-0x000000000322B000-memory.dmpFilesize
44KB
-
memory/1000-311-0x0000000003230000-0x0000000003237000-memory.dmpFilesize
28KB
-
memory/1000-310-0x0000000000000000-mapping.dmp
-
memory/1012-233-0x0000000000000000-mapping.dmp
-
memory/1036-192-0x0000000000000000-mapping.dmp
-
memory/1216-220-0x0000000000000000-mapping.dmp
-
memory/1216-239-0x0000000000000000-mapping.dmp
-
memory/1260-213-0x0000000000000000-mapping.dmp
-
memory/1296-195-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/1296-202-0x0000000007D60000-0x0000000007D61000-memory.dmpFilesize
4KB
-
memory/1296-194-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/1296-193-0x0000000004C60000-0x0000000004C8E000-memory.dmpFilesize
184KB
-
memory/1296-197-0x0000000007243000-0x0000000007244000-memory.dmpFilesize
4KB
-
memory/1296-209-0x0000000008850000-0x0000000008851000-memory.dmpFilesize
4KB
-
memory/1296-208-0x0000000008190000-0x0000000008191000-memory.dmpFilesize
4KB
-
memory/1296-207-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/1296-201-0x0000000007200000-0x0000000007201000-memory.dmpFilesize
4KB
-
memory/1296-210-0x00000000088F0000-0x00000000088F1000-memory.dmpFilesize
4KB
-
memory/1296-198-0x0000000007140000-0x000000000716C000-memory.dmpFilesize
176KB
-
memory/1296-190-0x0000000000400000-0x0000000002B95000-memory.dmpFilesize
39.6MB
-
memory/1296-211-0x00000000089E0000-0x00000000089E1000-memory.dmpFilesize
4KB
-
memory/1296-188-0x0000000002BA0000-0x0000000002CEA000-memory.dmpFilesize
1.3MB
-
memory/1296-189-0x00000000046E0000-0x0000000004719000-memory.dmpFilesize
228KB
-
memory/1296-196-0x0000000007242000-0x0000000007243000-memory.dmpFilesize
4KB
-
memory/1296-206-0x0000000007244000-0x0000000007246000-memory.dmpFilesize
8KB
-
memory/1296-205-0x0000000007EA0000-0x0000000007EA1000-memory.dmpFilesize
4KB
-
memory/1296-200-0x0000000007750000-0x0000000007751000-memory.dmpFilesize
4KB
-
memory/1296-215-0x0000000008C10000-0x0000000008C11000-memory.dmpFilesize
4KB
-
memory/1296-183-0x0000000000000000-mapping.dmp
-
memory/1296-216-0x0000000008DE0000-0x0000000008DE1000-memory.dmpFilesize
4KB
-
memory/1308-234-0x0000000000000000-mapping.dmp
-
memory/1320-230-0x0000000000000000-mapping.dmp
-
memory/1508-321-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/1508-322-0x0000000000160000-0x000000000016C000-memory.dmpFilesize
48KB
-
memory/1508-320-0x0000000000000000-mapping.dmp
-
memory/1612-225-0x0000000000000000-mapping.dmp
-
memory/1796-317-0x0000000000000000-mapping.dmp
-
memory/1796-318-0x0000000000670000-0x0000000000675000-memory.dmpFilesize
20KB
-
memory/1796-319-0x0000000000660000-0x0000000000669000-memory.dmpFilesize
36KB
-
memory/1820-238-0x0000000000000000-mapping.dmp
-
memory/1856-309-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/1856-240-0x0000000000000000-mapping.dmp
-
memory/1856-307-0x0000000000000000-mapping.dmp
-
memory/1856-308-0x00000000003E0000-0x00000000003E7000-memory.dmpFilesize
28KB
-
memory/1932-336-0x0000022971650000-0x0000022971651000-memory.dmpFilesize
4KB
-
memory/1932-177-0x0000000000000000-mapping.dmp
-
memory/2044-232-0x0000000000000000-mapping.dmp
-
memory/2108-243-0x0000000000000000-mapping.dmp
-
memory/2148-186-0x0000000000000000-mapping.dmp
-
memory/2148-228-0x0000000000000000-mapping.dmp
-
memory/2196-214-0x0000000000000000-mapping.dmp
-
memory/2196-229-0x0000000000000000-mapping.dmp
-
memory/2252-212-0x0000000000000000-mapping.dmp
-
memory/2324-332-0x0000026F9F440000-0x0000026F9F441000-memory.dmpFilesize
4KB
-
memory/2360-333-0x0000019E03290000-0x0000019E03291000-memory.dmpFilesize
4KB
-
memory/2432-227-0x0000000000000000-mapping.dmp
-
memory/2476-337-0x0000020760C40000-0x0000020760C41000-memory.dmpFilesize
4KB
-
memory/2476-334-0x0000020760900000-0x0000020760901000-memory.dmpFilesize
4KB
-
memory/2600-237-0x0000000000000000-mapping.dmp
-
memory/2600-219-0x0000000000000000-mapping.dmp
-
memory/2760-241-0x0000000000000000-mapping.dmp
-
memory/2856-203-0x000002BE7B730000-0x000002BE7B732000-memory.dmpFilesize
8KB
-
memory/2856-204-0x000002BE7B730000-0x000002BE7B732000-memory.dmpFilesize
8KB
-
memory/2948-235-0x0000000000000000-mapping.dmp
-
memory/3028-161-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-137-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-118-0x00000000007A0000-0x00000000007B6000-memory.dmpFilesize
88KB
-
memory/3028-129-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-130-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-181-0x0000000004F70000-0x0000000004F7F000-memory.dmpFilesize
60KB
-
memory/3028-180-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-176-0x00000000027C0000-0x00000000027D6000-memory.dmpFilesize
88KB
-
memory/3028-131-0x0000000002210000-0x0000000002220000-memory.dmpFilesize
64KB
-
memory/3028-132-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-133-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-134-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-169-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-167-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-168-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-166-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/3028-165-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-164-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-135-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-136-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-163-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-162-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-138-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-139-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-140-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-141-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-160-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-159-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-158-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-157-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-156-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-155-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-142-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-154-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-151-0x0000000002210000-0x0000000002220000-memory.dmpFilesize
64KB
-
memory/3028-153-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-152-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-150-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-149-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-148-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-147-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-146-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-145-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-249-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-144-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-143-0x0000000002280000-0x0000000002290000-memory.dmpFilesize
64KB
-
memory/3028-250-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3028-247-0x0000000002260000-0x0000000002262000-memory.dmpFilesize
8KB
-
memory/3048-175-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3048-223-0x0000000000000000-mapping.dmp
-
memory/3048-170-0x0000000000000000-mapping.dmp
-
memory/3048-174-0x0000000002B80000-0x0000000002C2E000-memory.dmpFilesize
696KB
-
memory/3048-173-0x0000000002B80000-0x0000000002C2E000-memory.dmpFilesize
696KB
-
memory/3080-187-0x0000000000000000-mapping.dmp
-
memory/3180-218-0x0000000000000000-mapping.dmp
-
memory/3216-242-0x0000000000000000-mapping.dmp
-
memory/3220-117-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/3220-115-0x00000000001D0000-0x00000000001D8000-memory.dmpFilesize
32KB
-
memory/3220-116-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/3368-224-0x0000000000000000-mapping.dmp
-
memory/3372-182-0x0000000000000000-mapping.dmp
-
memory/3508-327-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3508-128-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3508-124-0x0000000000000000-mapping.dmp
-
memory/3508-328-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/3528-335-0x000001BC147F0000-0x000001BC147F1000-memory.dmpFilesize
4KB
-
memory/3556-276-0x0000000000000000-mapping.dmp
-
memory/3696-304-0x0000000000000000-mapping.dmp
-
memory/3696-305-0x0000000003290000-0x0000000003305000-memory.dmpFilesize
468KB
-
memory/3696-306-0x0000000003220000-0x000000000328B000-memory.dmpFilesize
428KB
-
memory/3716-245-0x0000000000000000-mapping.dmp
-
memory/3796-263-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-258-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-269-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-251-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-268-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-252-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-267-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-253-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-265-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-316-0x0000023463DA0000-0x0000023463DA1000-memory.dmpFilesize
4KB
-
memory/3796-264-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-255-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-261-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-260-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-259-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-256-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3796-323-0x0000023465E00000-0x0000023465E01000-memory.dmpFilesize
4KB
-
memory/3796-257-0x00007FFE64180000-0x00007FFE641EB000-memory.dmpFilesize
428KB
-
memory/3812-231-0x0000000000000000-mapping.dmp
-
memory/3812-217-0x0000000000000000-mapping.dmp
-
memory/3860-331-0x0000000000130000-0x000000000013D000-memory.dmpFilesize
52KB
-
memory/3860-199-0x0000000000000000-mapping.dmp
-
memory/3860-329-0x0000000000000000-mapping.dmp
-
memory/3860-330-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/3916-191-0x0000000000000000-mapping.dmp
-
memory/3916-246-0x0000000000000000-mapping.dmp
-
memory/3972-122-0x0000000002D40000-0x0000000002DBF000-memory.dmpFilesize
508KB
-
memory/3972-119-0x0000000000000000-mapping.dmp
-
memory/3972-127-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3972-123-0x0000000004880000-0x0000000004911000-memory.dmpFilesize
580KB
-
memory/4004-222-0x0000000000000000-mapping.dmp