Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-12-2021 01:50
Static task
static1
Behavioral task
behavioral1
Sample
50dfd197492d2836638b800d144bbff3.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
50dfd197492d2836638b800d144bbff3.exe
Resource
win10-en-20211104
General
-
Target
50dfd197492d2836638b800d144bbff3.exe
-
Size
248KB
-
MD5
50dfd197492d2836638b800d144bbff3
-
SHA1
7a0891b734da828be8265c01df2ee435276f2f85
-
SHA256
c161867b30341da1738ad780ac4c44300dc5f29e25bca55de80803394efdcd7b
-
SHA512
44febeadb7c215d48effb66493753fd14fbf47ca7000930b2adc895a5e5d09c42dc56ce30f281e6d5a3d0996ef962747f11774a32ca73ab6ac4b98625f03e7f6
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
92.255.76.197:38637
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/500-150-0x0000000002140000-0x000000000216E000-memory.dmp family_redline behavioral2/memory/500-152-0x0000000002340000-0x000000000236C000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\E530.exe family_redline C:\Users\Admin\AppData\Local\Temp\E530.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
42D1.exeSmartClock.exe7BC4.exeAD16.exeBC69.exeE530.exepid process 4484 42D1.exe 772 SmartClock.exe 2864 7BC4.exe 860 AD16.exe 500 BC69.exe 2716 E530.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Drops startup file 1 IoCs
Processes:
42D1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 42D1.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3196 3796 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7BC4.exe50dfd197492d2836638b800d144bbff3.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7BC4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50dfd197492d2836638b800d144bbff3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50dfd197492d2836638b800d144bbff3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50dfd197492d2836638b800d144bbff3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7BC4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7BC4.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AD16.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AD16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AD16.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 372 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3340 ipconfig.exe 3220 NETSTAT.EXE 1120 NETSTAT.EXE 1484 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C42F0D33-54A4-11EC-B34F-F66057313890} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 772 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
50dfd197492d2836638b800d144bbff3.exepid process 4268 50dfd197492d2836638b800d144bbff3.exe 4268 50dfd197492d2836638b800d144bbff3.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
50dfd197492d2836638b800d144bbff3.exe7BC4.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4268 50dfd197492d2836638b800d144bbff3.exe 2864 7BC4.exe 3032 3032 3032 3032 3032 3032 4852 explorer.exe 4852 explorer.exe 3032 3032 1360 explorer.exe 1360 explorer.exe 3032 3032 2312 explorer.exe 2312 explorer.exe 3032 3032 1212 explorer.exe 1212 explorer.exe 3032 3032 4820 explorer.exe 4820 explorer.exe 4820 explorer.exe 4820 explorer.exe 3032 3032 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe 2200 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
BC69.exeWMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeDebugPrivilege 500 BC69.exe Token: SeIncreaseQuotaPrivilege 4160 WMIC.exe Token: SeSecurityPrivilege 4160 WMIC.exe Token: SeTakeOwnershipPrivilege 4160 WMIC.exe Token: SeLoadDriverPrivilege 4160 WMIC.exe Token: SeSystemProfilePrivilege 4160 WMIC.exe Token: SeSystemtimePrivilege 4160 WMIC.exe Token: SeProfSingleProcessPrivilege 4160 WMIC.exe Token: SeIncBasePriorityPrivilege 4160 WMIC.exe Token: SeCreatePagefilePrivilege 4160 WMIC.exe Token: SeBackupPrivilege 4160 WMIC.exe Token: SeRestorePrivilege 4160 WMIC.exe Token: SeShutdownPrivilege 4160 WMIC.exe Token: SeDebugPrivilege 4160 WMIC.exe Token: SeSystemEnvironmentPrivilege 4160 WMIC.exe Token: SeRemoteShutdownPrivilege 4160 WMIC.exe Token: SeUndockPrivilege 4160 WMIC.exe Token: SeManageVolumePrivilege 4160 WMIC.exe Token: 33 4160 WMIC.exe Token: 34 4160 WMIC.exe Token: 35 4160 WMIC.exe Token: 36 4160 WMIC.exe Token: SeIncreaseQuotaPrivilege 4160 WMIC.exe Token: SeSecurityPrivilege 4160 WMIC.exe Token: SeTakeOwnershipPrivilege 4160 WMIC.exe Token: SeLoadDriverPrivilege 4160 WMIC.exe Token: SeSystemProfilePrivilege 4160 WMIC.exe Token: SeSystemtimePrivilege 4160 WMIC.exe Token: SeProfSingleProcessPrivilege 4160 WMIC.exe Token: SeIncBasePriorityPrivilege 4160 WMIC.exe Token: SeCreatePagefilePrivilege 4160 WMIC.exe Token: SeBackupPrivilege 4160 WMIC.exe Token: SeRestorePrivilege 4160 WMIC.exe Token: SeShutdownPrivilege 4160 WMIC.exe Token: SeDebugPrivilege 4160 WMIC.exe Token: SeSystemEnvironmentPrivilege 4160 WMIC.exe Token: SeRemoteShutdownPrivilege 4160 WMIC.exe Token: SeUndockPrivilege 4160 WMIC.exe Token: SeManageVolumePrivilege 4160 WMIC.exe Token: 33 4160 WMIC.exe Token: 34 4160 WMIC.exe Token: 35 4160 WMIC.exe Token: 36 4160 WMIC.exe Token: SeIncreaseQuotaPrivilege 4876 WMIC.exe Token: SeSecurityPrivilege 4876 WMIC.exe Token: SeTakeOwnershipPrivilege 4876 WMIC.exe Token: SeLoadDriverPrivilege 4876 WMIC.exe Token: SeSystemProfilePrivilege 4876 WMIC.exe Token: SeSystemtimePrivilege 4876 WMIC.exe Token: SeProfSingleProcessPrivilege 4876 WMIC.exe Token: SeIncBasePriorityPrivilege 4876 WMIC.exe Token: SeCreatePagefilePrivilege 4876 WMIC.exe Token: SeBackupPrivilege 4876 WMIC.exe Token: SeRestorePrivilege 4876 WMIC.exe Token: SeShutdownPrivilege 4876 WMIC.exe Token: SeDebugPrivilege 4876 WMIC.exe Token: SeSystemEnvironmentPrivilege 4876 WMIC.exe Token: SeRemoteShutdownPrivilege 4876 WMIC.exe Token: SeUndockPrivilege 4876 WMIC.exe Token: SeManageVolumePrivilege 4876 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1752 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1752 iexplore.exe 1752 iexplore.exe 4628 IEXPLORE.EXE 4628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42D1.execmd.exeAD16.execmd.exedescription pid process target process PID 3032 wrote to memory of 4484 3032 42D1.exe PID 3032 wrote to memory of 4484 3032 42D1.exe PID 3032 wrote to memory of 4484 3032 42D1.exe PID 4484 wrote to memory of 772 4484 42D1.exe SmartClock.exe PID 4484 wrote to memory of 772 4484 42D1.exe SmartClock.exe PID 4484 wrote to memory of 772 4484 42D1.exe SmartClock.exe PID 3032 wrote to memory of 2864 3032 7BC4.exe PID 3032 wrote to memory of 2864 3032 7BC4.exe PID 3032 wrote to memory of 2864 3032 7BC4.exe PID 3032 wrote to memory of 860 3032 AD16.exe PID 3032 wrote to memory of 860 3032 AD16.exe PID 3032 wrote to memory of 860 3032 AD16.exe PID 3032 wrote to memory of 500 3032 BC69.exe PID 3032 wrote to memory of 500 3032 BC69.exe PID 3032 wrote to memory of 500 3032 BC69.exe PID 3032 wrote to memory of 2388 3032 cmd.exe PID 3032 wrote to memory of 2388 3032 cmd.exe PID 3032 wrote to memory of 2716 3032 E530.exe PID 3032 wrote to memory of 2716 3032 E530.exe PID 3032 wrote to memory of 2716 3032 E530.exe PID 2388 wrote to memory of 4160 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4160 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4876 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4876 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 5000 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 5000 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4648 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4648 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4620 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4620 2388 cmd.exe WMIC.exe PID 860 wrote to memory of 4968 860 AD16.exe cmd.exe PID 860 wrote to memory of 4968 860 AD16.exe cmd.exe PID 860 wrote to memory of 4968 860 AD16.exe cmd.exe PID 4968 wrote to memory of 372 4968 cmd.exe timeout.exe PID 4968 wrote to memory of 372 4968 cmd.exe timeout.exe PID 4968 wrote to memory of 372 4968 cmd.exe timeout.exe PID 2388 wrote to memory of 1308 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 1308 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3000 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3000 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 1904 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 1904 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 2164 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 2164 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3092 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3092 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3364 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3364 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4812 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 4812 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 828 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 828 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 1720 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 1720 2388 cmd.exe WMIC.exe PID 2388 wrote to memory of 3340 2388 cmd.exe ipconfig.exe PID 2388 wrote to memory of 3340 2388 cmd.exe ipconfig.exe PID 2388 wrote to memory of 2052 2388 cmd.exe ROUTE.EXE PID 2388 wrote to memory of 2052 2388 cmd.exe ROUTE.EXE PID 2388 wrote to memory of 3240 2388 cmd.exe netsh.exe PID 2388 wrote to memory of 3240 2388 cmd.exe netsh.exe PID 2388 wrote to memory of 3276 2388 cmd.exe systeminfo.exe PID 2388 wrote to memory of 3276 2388 cmd.exe systeminfo.exe PID 2388 wrote to memory of 3972 2388 cmd.exe tasklist.exe PID 2388 wrote to memory of 3972 2388 cmd.exe tasklist.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3796 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\50dfd197492d2836638b800d144bbff3.exe"C:\Users\Admin\AppData\Local\Temp\50dfd197492d2836638b800d144bbff3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\42D1.exeC:\Users\Admin\AppData\Local\Temp\42D1.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\7BC4.exeC:\Users\Admin\AppData\Local\Temp\7BC4.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AD16.exeC:\Users\Admin\AppData\Local\Temp\AD16.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\cZcNAujc & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\AD16.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\BC69.exeC:\Users\Admin\AppData\Local\Temp\BC69.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\E530.exeC:\Users\Admin\AppData\Local\Temp\E530.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\42D1.exeMD5
42c6347146452117ae98dad4f06d6953
SHA1a113372acb37913a34e6d6e46c4b84004b3286aa
SHA256ea5a184fe57e1c2926bfc4b228ee0d338a66754779c665735b1176d3904ef399
SHA512d9b508bad5accab933ce6a961f2e46aa00b3b8c70c0233515271b32c6ee7be47141e3563a0c4b58354793b8fbe4e6da628a6890243695a047badf79691889da5
-
C:\Users\Admin\AppData\Local\Temp\42D1.exeMD5
42c6347146452117ae98dad4f06d6953
SHA1a113372acb37913a34e6d6e46c4b84004b3286aa
SHA256ea5a184fe57e1c2926bfc4b228ee0d338a66754779c665735b1176d3904ef399
SHA512d9b508bad5accab933ce6a961f2e46aa00b3b8c70c0233515271b32c6ee7be47141e3563a0c4b58354793b8fbe4e6da628a6890243695a047badf79691889da5
-
C:\Users\Admin\AppData\Local\Temp\7BC4.exeMD5
86c76df3f0feed13d6ad6f9155156369
SHA1330e82600381f68d6f6914b50b451b6c59901b26
SHA2564dc4954990ef29b8b1b66f23cd475d375cc759b2aabbfdde761abaafef975baf
SHA512078e22f7c6109abf532591dc429d6a58255a192c3a70324b769e5f2b79549d0814fa2330693484dccdc27427ef25526b5db4f3b574c521bed0ae27eadada789c
-
C:\Users\Admin\AppData\Local\Temp\7BC4.exeMD5
86c76df3f0feed13d6ad6f9155156369
SHA1330e82600381f68d6f6914b50b451b6c59901b26
SHA2564dc4954990ef29b8b1b66f23cd475d375cc759b2aabbfdde761abaafef975baf
SHA512078e22f7c6109abf532591dc429d6a58255a192c3a70324b769e5f2b79549d0814fa2330693484dccdc27427ef25526b5db4f3b574c521bed0ae27eadada789c
-
C:\Users\Admin\AppData\Local\Temp\AD16.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\AD16.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\BC69.exeMD5
e9da00061b4c96cf60b331f267be5928
SHA1be73385036664af11791b6334423d96f544b0fce
SHA256776e55092b71fe1e99a7d5d4d119f2620fd100626c0b3fb6247ad062a452d30a
SHA512587c563de95b984b0defe9edba5ac28fd5fc048bf0b88602394ef0585445f620db224cbc0c1aa9ecf4f9bc72b89abf69869e6b7e9009c558111b52e5d4a5cd6a
-
C:\Users\Admin\AppData\Local\Temp\BC69.exeMD5
e9da00061b4c96cf60b331f267be5928
SHA1be73385036664af11791b6334423d96f544b0fce
SHA256776e55092b71fe1e99a7d5d4d119f2620fd100626c0b3fb6247ad062a452d30a
SHA512587c563de95b984b0defe9edba5ac28fd5fc048bf0b88602394ef0585445f620db224cbc0c1aa9ecf4f9bc72b89abf69869e6b7e9009c558111b52e5d4a5cd6a
-
C:\Users\Admin\AppData\Local\Temp\E530.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\E530.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\GDFSWF~1.ZIPMD5
d04ed314037b8a7388cbae3565486322
SHA105ea537788265cba595b667b56a2b8c1cdabf711
SHA256fcfeb7bcc5ec59937cc61a2bca1a7d34d6a50dbf9703d0e6970ff3e670efdcb3
SHA5125f289ec5115f7bd1085820f8dd1c5bcbb332942ef7bdaa2fd5b10691084caadeb217240fa595931e4f5138f25913398415cebcf4690153a8fe97dc9d7513b1d8
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\WTEJNB~1.ZIPMD5
e6ee631fefd09a5a501429540df528ea
SHA16d38e3d01a348e9f4bb11744543c82ad97ab5dee
SHA256bbc0f47fe921c53251352c95d59590d74fcad08fcfe50d79723d3d89f6314c28
SHA512b9a9ac7d10c6aad0789df5d407b9d3ef99a058dce52a480c90349d7cbb9ce1ced7af05cf5b54eac66bceb2a1260c2619f52517a63994d29f909f1e513d0033ca
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_Chrome\DEFAUL~1.BINMD5
b963abf9a7967b3a22da64c9193fc932
SHA10831556392b56c00b07f04deb5474c4202c545e8
SHA2566c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5
SHA51264514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_INFOR~1.TXTMD5
f6d85b6273e275888d6ad98c5d78cc1d
SHA12f547fd00264a4ad465c6d7e6b4d1b6dd8317f37
SHA256a5fbef55bcc39b9298f7b0e1cf26221fd1908879336a7c029a7579286c877b5d
SHA512621edcc0352d2d23a45c5b5059ab3e315dda53603e4544f98c29fb4909cb4cd58375de59a3f88be0fbed50799caf96176f853d29161dea61175214bc01b378c5
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\_Files\_SCREE~1.JPEMD5
51edfc9bc5a950762eaddcca8057c191
SHA13d35e8bb26b58ca5623257781c72f96aff2aef5e
SHA256eefb21510e3c9324a9f03d01c0e737464618ae5e82794299ee8e035d6e276bc1
SHA5123b2c35b4823572605dad7876483e53f23a912af2cae40af26299b2b9d722e9beadaf9f74beedb8fa20db426fb54b89f3b210e338616bea790b5ff0835b61be1c
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\SCREEN~1.JPGMD5
51edfc9bc5a950762eaddcca8057c191
SHA13d35e8bb26b58ca5623257781c72f96aff2aef5e
SHA256eefb21510e3c9324a9f03d01c0e737464618ae5e82794299ee8e035d6e276bc1
SHA5123b2c35b4823572605dad7876483e53f23a912af2cae40af26299b2b9d722e9beadaf9f74beedb8fa20db426fb54b89f3b210e338616bea790b5ff0835b61be1c
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\SYSTEM~1.TXTMD5
f6d85b6273e275888d6ad98c5d78cc1d
SHA12f547fd00264a4ad465c6d7e6b4d1b6dd8317f37
SHA256a5fbef55bcc39b9298f7b0e1cf26221fd1908879336a7c029a7579286c877b5d
SHA512621edcc0352d2d23a45c5b5059ab3e315dda53603e4544f98c29fb4909cb4cd58375de59a3f88be0fbed50799caf96176f853d29161dea61175214bc01b378c5
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\_Chrome\DEFAUL~1.BINMD5
b963abf9a7967b3a22da64c9193fc932
SHA10831556392b56c00b07f04deb5474c4202c545e8
SHA2566c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5
SHA51264514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\cZcNAujc\files_\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
42c6347146452117ae98dad4f06d6953
SHA1a113372acb37913a34e6d6e46c4b84004b3286aa
SHA256ea5a184fe57e1c2926bfc4b228ee0d338a66754779c665735b1176d3904ef399
SHA512d9b508bad5accab933ce6a961f2e46aa00b3b8c70c0233515271b32c6ee7be47141e3563a0c4b58354793b8fbe4e6da628a6890243695a047badf79691889da5
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
42c6347146452117ae98dad4f06d6953
SHA1a113372acb37913a34e6d6e46c4b84004b3286aa
SHA256ea5a184fe57e1c2926bfc4b228ee0d338a66754779c665735b1176d3904ef399
SHA512d9b508bad5accab933ce6a961f2e46aa00b3b8c70c0233515271b32c6ee7be47141e3563a0c4b58354793b8fbe4e6da628a6890243695a047badf79691889da5
-
memory/368-244-0x0000000000000000-mapping.dmp
-
memory/372-205-0x0000000000000000-mapping.dmp
-
memory/500-178-0x0000000006380000-0x0000000006381000-memory.dmpFilesize
4KB
-
memory/500-163-0x00000000024D4000-0x00000000024D6000-memory.dmpFilesize
8KB
-
memory/500-150-0x0000000002140000-0x000000000216E000-memory.dmpFilesize
184KB
-
memory/500-151-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/500-152-0x0000000002340000-0x000000000236C000-memory.dmpFilesize
176KB
-
memory/500-153-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/500-154-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/500-155-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/500-156-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/500-157-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/500-158-0x00000000020B0000-0x00000000020E9000-memory.dmpFilesize
228KB
-
memory/500-159-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/500-160-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/500-161-0x00000000024D2000-0x00000000024D3000-memory.dmpFilesize
4KB
-
memory/500-162-0x00000000024D3000-0x00000000024D4000-memory.dmpFilesize
4KB
-
memory/500-207-0x0000000006780000-0x0000000006781000-memory.dmpFilesize
4KB
-
memory/500-206-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/500-173-0x0000000006190000-0x0000000006191000-memory.dmpFilesize
4KB
-
memory/500-146-0x0000000000000000-mapping.dmp
-
memory/500-167-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/500-169-0x00000000060D0000-0x00000000060D1000-memory.dmpFilesize
4KB
-
memory/596-239-0x0000000000000000-mapping.dmp
-
memory/772-126-0x0000000000000000-mapping.dmp
-
memory/772-328-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/772-131-0x00000000006A8000-0x0000000000728000-memory.dmpFilesize
512KB
-
memory/772-132-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/772-329-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/776-237-0x0000000000000000-mapping.dmp
-
memory/828-222-0x0000000000000000-mapping.dmp
-
memory/860-145-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/860-140-0x0000000000000000-mapping.dmp
-
memory/860-144-0x00000000020B0000-0x00000000020F7000-memory.dmpFilesize
284KB
-
memory/904-243-0x0000000000000000-mapping.dmp
-
memory/1120-245-0x0000000000000000-mapping.dmp
-
memory/1212-323-0x00000000008A0000-0x00000000008AC000-memory.dmpFilesize
48KB
-
memory/1212-321-0x0000000000000000-mapping.dmp
-
memory/1212-322-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/1308-208-0x0000000000000000-mapping.dmp
-
memory/1360-314-0x0000000000000000-mapping.dmp
-
memory/1360-316-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB
-
memory/1360-315-0x00000000008F0000-0x00000000008F9000-memory.dmpFilesize
36KB
-
memory/1396-246-0x0000000000000000-mapping.dmp
-
memory/1484-247-0x0000000000000000-mapping.dmp
-
memory/1572-238-0x0000000000000000-mapping.dmp
-
memory/1720-223-0x0000000000000000-mapping.dmp
-
memory/1752-265-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-260-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-340-0x000002602AA70000-0x000002602AA71000-memory.dmpFilesize
4KB
-
memory/1752-317-0x000002602AA60000-0x000002602AA61000-memory.dmpFilesize
4KB
-
memory/1752-338-0x000002602CB60000-0x000002602CB61000-memory.dmpFilesize
4KB
-
memory/1752-337-0x000002602CB60000-0x000002602CB61000-memory.dmpFilesize
4KB
-
memory/1752-275-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-253-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-274-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-272-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-273-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-254-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-256-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-270-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-269-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-257-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-268-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-266-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-258-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-259-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-264-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-262-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-252-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1752-324-0x000002602CAB0000-0x000002602CAB1000-memory.dmpFilesize
4KB
-
memory/1752-261-0x00007FFAA7580000-0x00007FFAA75EB000-memory.dmpFilesize
428KB
-
memory/1904-210-0x0000000000000000-mapping.dmp
-
memory/1920-240-0x0000000000000000-mapping.dmp
-
memory/2052-225-0x0000000000000000-mapping.dmp
-
memory/2164-211-0x0000000000000000-mapping.dmp
-
memory/2200-331-0x0000000000720000-0x0000000000727000-memory.dmpFilesize
28KB
-
memory/2200-332-0x0000000000710000-0x000000000071D000-memory.dmpFilesize
52KB
-
memory/2200-330-0x0000000000000000-mapping.dmp
-
memory/2268-229-0x0000000000000000-mapping.dmp
-
memory/2312-320-0x0000000003020000-0x0000000003029000-memory.dmpFilesize
36KB
-
memory/2312-319-0x0000000003030000-0x0000000003035000-memory.dmpFilesize
20KB
-
memory/2312-318-0x0000000000000000-mapping.dmp
-
memory/2388-166-0x0000000000000000-mapping.dmp
-
memory/2428-333-0x000001FB71290000-0x000001FB71291000-memory.dmpFilesize
4KB
-
memory/2460-334-0x0000020B900A0000-0x0000020B900A1000-memory.dmpFilesize
4KB
-
memory/2716-170-0x0000000000000000-mapping.dmp
-
memory/2716-183-0x00000000052D0000-0x00000000058D6000-memory.dmpFilesize
6.0MB
-
memory/2716-174-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/2724-335-0x00000137C0AB0000-0x00000137C0AB1000-memory.dmpFilesize
4KB
-
memory/2852-307-0x0000000003020000-0x000000000308B000-memory.dmpFilesize
428KB
-
memory/2852-306-0x0000000003090000-0x0000000003105000-memory.dmpFilesize
468KB
-
memory/2852-301-0x0000000000000000-mapping.dmp
-
memory/2864-133-0x0000000000000000-mapping.dmp
-
memory/2864-136-0x00000000007A9000-0x00000000007B2000-memory.dmpFilesize
36KB
-
memory/2864-137-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB
-
memory/2864-138-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/3000-209-0x0000000000000000-mapping.dmp
-
memory/3032-165-0x0000000005100000-0x0000000005102000-memory.dmpFilesize
8KB
-
memory/3032-250-0x0000000005100000-0x0000000005102000-memory.dmpFilesize
8KB
-
memory/3032-251-0x0000000005100000-0x0000000005102000-memory.dmpFilesize
8KB
-
memory/3032-139-0x0000000002B50000-0x0000000002B66000-memory.dmpFilesize
88KB
-
memory/3032-248-0x0000000005100000-0x0000000005102000-memory.dmpFilesize
8KB
-
memory/3032-121-0x00000000009A0000-0x00000000009B6000-memory.dmpFilesize
88KB
-
memory/3032-168-0x00000000050F0000-0x00000000050FF000-memory.dmpFilesize
60KB
-
memory/3032-164-0x0000000005100000-0x0000000005102000-memory.dmpFilesize
8KB
-
memory/3092-219-0x0000000000000000-mapping.dmp
-
memory/3196-339-0x00000170DC4B0000-0x00000170DC4B1000-memory.dmpFilesize
4KB
-
memory/3220-242-0x0000000000000000-mapping.dmp
-
memory/3240-226-0x0000000000000000-mapping.dmp
-
memory/3252-231-0x0000000000000000-mapping.dmp
-
memory/3276-227-0x0000000000000000-mapping.dmp
-
memory/3340-224-0x0000000000000000-mapping.dmp
-
memory/3364-220-0x0000000000000000-mapping.dmp
-
memory/3548-336-0x000001B85E960000-0x000001B85E961000-memory.dmpFilesize
4KB
-
memory/3640-241-0x0000000000000000-mapping.dmp
-
memory/3836-233-0x0000000000000000-mapping.dmp
-
memory/3972-228-0x0000000000000000-mapping.dmp
-
memory/4020-232-0x0000000000000000-mapping.dmp
-
memory/4160-182-0x0000000000000000-mapping.dmp
-
memory/4264-230-0x0000000000000000-mapping.dmp
-
memory/4268-118-0x0000000000629000-0x0000000000632000-memory.dmpFilesize
36KB
-
memory/4268-119-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/4268-120-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/4408-235-0x0000000000000000-mapping.dmp
-
memory/4420-236-0x0000000000000000-mapping.dmp
-
memory/4484-125-0x0000000000658000-0x00000000006D8000-memory.dmpFilesize
512KB
-
memory/4484-129-0x0000000001FE0000-0x0000000002071000-memory.dmpFilesize
580KB
-
memory/4484-130-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/4484-122-0x0000000000000000-mapping.dmp
-
memory/4620-187-0x0000000000000000-mapping.dmp
-
memory/4628-277-0x0000000000000000-mapping.dmp
-
memory/4648-186-0x0000000000000000-mapping.dmp
-
memory/4660-234-0x0000000000000000-mapping.dmp
-
memory/4812-221-0x0000000000000000-mapping.dmp
-
memory/4820-327-0x0000000003020000-0x000000000302B000-memory.dmpFilesize
44KB
-
memory/4820-325-0x0000000000000000-mapping.dmp
-
memory/4820-326-0x0000000003030000-0x0000000003036000-memory.dmpFilesize
24KB
-
memory/4828-308-0x0000000000000000-mapping.dmp
-
memory/4828-309-0x00000000004D0000-0x00000000004D7000-memory.dmpFilesize
28KB
-
memory/4828-310-0x00000000004C0000-0x00000000004CC000-memory.dmpFilesize
48KB
-
memory/4852-313-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/4852-312-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/4852-311-0x0000000000000000-mapping.dmp
-
memory/4876-184-0x0000000000000000-mapping.dmp
-
memory/4940-189-0x00000204EF930000-0x00000204EF932000-memory.dmpFilesize
8KB
-
memory/4940-188-0x00000204EF930000-0x00000204EF932000-memory.dmpFilesize
8KB
-
memory/4968-190-0x0000000000000000-mapping.dmp
-
memory/5000-185-0x0000000000000000-mapping.dmp