Analysis
-
max time kernel
154s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
04-12-2021 02:46
Static task
static1
Behavioral task
behavioral1
Sample
b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe
Resource
win10-en-20211014
General
-
Target
b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe
-
Size
248KB
-
MD5
b2ec208d6bf22afb073d6cf111598e74
-
SHA1
8802237102c54269ee49be10a6e74dd1f5799cdc
-
SHA256
b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1
-
SHA512
f61eb379d4c0a0c42fdf9a8c73d529e2fda1f12dbad12b7ce840be312d169d486506e3f303544e16ac150ebd628def85eb5e79d66039af9818a96eec298efc91
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
92.255.76.197:38637
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3384-157-0x00000000022B0000-0x00000000022DE000-memory.dmp family_redline behavioral1/memory/3384-160-0x00000000023B0000-0x00000000023DC000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\6AFA.exe family_redline C:\Users\Admin\AppData\Local\Temp\6AFA.exe family_redline behavioral1/memory/3196-211-0x0000000005240000-0x0000000005846000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
9C3C.exeSmartClock.exeC939.exeC2E.exe2E0F.exe6AFA.exepid process 3948 9C3C.exe 752 SmartClock.exe 1260 C939.exe 336 C2E.exe 3384 2E0F.exe 3196 6AFA.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Drops startup file 1 IoCs
Processes:
9C3C.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 9C3C.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2980 3700 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
C939.exeb6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C939.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C939.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C939.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
C2E.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C2E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C2E.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 840 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1440 ipconfig.exe 2472 NETSTAT.EXE 2356 NETSTAT.EXE 1440 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACF59B22-54AC-11EC-B8A2-FE5CCB647586} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 752 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exepid process 3012 b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe 3012 b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exeC939.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3012 b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe 1260 C939.exe 3004 3004 3004 3004 3004 3004 3096 explorer.exe 3096 explorer.exe 3004 3004 2252 explorer.exe 2252 explorer.exe 3004 3004 3360 explorer.exe 3360 explorer.exe 3004 3004 3180 explorer.exe 3180 explorer.exe 3004 3004 2124 explorer.exe 2124 explorer.exe 2124 explorer.exe 2124 explorer.exe 3004 3004 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe 3136 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeIncreaseQuotaPrivilege 4060 WMIC.exe Token: SeSecurityPrivilege 4060 WMIC.exe Token: SeTakeOwnershipPrivilege 4060 WMIC.exe Token: SeLoadDriverPrivilege 4060 WMIC.exe Token: SeSystemProfilePrivilege 4060 WMIC.exe Token: SeSystemtimePrivilege 4060 WMIC.exe Token: SeProfSingleProcessPrivilege 4060 WMIC.exe Token: SeIncBasePriorityPrivilege 4060 WMIC.exe Token: SeCreatePagefilePrivilege 4060 WMIC.exe Token: SeBackupPrivilege 4060 WMIC.exe Token: SeRestorePrivilege 4060 WMIC.exe Token: SeShutdownPrivilege 4060 WMIC.exe Token: SeDebugPrivilege 4060 WMIC.exe Token: SeSystemEnvironmentPrivilege 4060 WMIC.exe Token: SeRemoteShutdownPrivilege 4060 WMIC.exe Token: SeUndockPrivilege 4060 WMIC.exe Token: SeManageVolumePrivilege 4060 WMIC.exe Token: 33 4060 WMIC.exe Token: 34 4060 WMIC.exe Token: 35 4060 WMIC.exe Token: 36 4060 WMIC.exe Token: SeIncreaseQuotaPrivilege 4060 WMIC.exe Token: SeSecurityPrivilege 4060 WMIC.exe Token: SeTakeOwnershipPrivilege 4060 WMIC.exe Token: SeLoadDriverPrivilege 4060 WMIC.exe Token: SeSystemProfilePrivilege 4060 WMIC.exe Token: SeSystemtimePrivilege 4060 WMIC.exe Token: SeProfSingleProcessPrivilege 4060 WMIC.exe Token: SeIncBasePriorityPrivilege 4060 WMIC.exe Token: SeCreatePagefilePrivilege 4060 WMIC.exe Token: SeBackupPrivilege 4060 WMIC.exe Token: SeRestorePrivilege 4060 WMIC.exe Token: SeShutdownPrivilege 4060 WMIC.exe Token: SeDebugPrivilege 4060 WMIC.exe Token: SeSystemEnvironmentPrivilege 4060 WMIC.exe Token: SeRemoteShutdownPrivilege 4060 WMIC.exe Token: SeUndockPrivilege 4060 WMIC.exe Token: SeManageVolumePrivilege 4060 WMIC.exe Token: 33 4060 WMIC.exe Token: 34 4060 WMIC.exe Token: 35 4060 WMIC.exe Token: 36 4060 WMIC.exe Token: SeIncreaseQuotaPrivilege 2984 WMIC.exe Token: SeSecurityPrivilege 2984 WMIC.exe Token: SeTakeOwnershipPrivilege 2984 WMIC.exe Token: SeLoadDriverPrivilege 2984 WMIC.exe Token: SeSystemProfilePrivilege 2984 WMIC.exe Token: SeSystemtimePrivilege 2984 WMIC.exe Token: SeProfSingleProcessPrivilege 2984 WMIC.exe Token: SeIncBasePriorityPrivilege 2984 WMIC.exe Token: SeCreatePagefilePrivilege 2984 WMIC.exe Token: SeBackupPrivilege 2984 WMIC.exe Token: SeRestorePrivilege 2984 WMIC.exe Token: SeShutdownPrivilege 2984 WMIC.exe Token: SeDebugPrivilege 2984 WMIC.exe Token: SeSystemEnvironmentPrivilege 2984 WMIC.exe Token: SeRemoteShutdownPrivilege 2984 WMIC.exe Token: SeUndockPrivilege 2984 WMIC.exe Token: SeManageVolumePrivilege 2984 WMIC.exe Token: 33 2984 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 748 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 748 iexplore.exe 748 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9C3C.execmd.exeC2E.execmd.exedescription pid process target process PID 3004 wrote to memory of 3948 3004 9C3C.exe PID 3004 wrote to memory of 3948 3004 9C3C.exe PID 3004 wrote to memory of 3948 3004 9C3C.exe PID 3948 wrote to memory of 752 3948 9C3C.exe SmartClock.exe PID 3948 wrote to memory of 752 3948 9C3C.exe SmartClock.exe PID 3948 wrote to memory of 752 3948 9C3C.exe SmartClock.exe PID 3004 wrote to memory of 1260 3004 C939.exe PID 3004 wrote to memory of 1260 3004 C939.exe PID 3004 wrote to memory of 1260 3004 C939.exe PID 3004 wrote to memory of 336 3004 C2E.exe PID 3004 wrote to memory of 336 3004 C2E.exe PID 3004 wrote to memory of 336 3004 C2E.exe PID 3004 wrote to memory of 3384 3004 2E0F.exe PID 3004 wrote to memory of 3384 3004 2E0F.exe PID 3004 wrote to memory of 3384 3004 2E0F.exe PID 3004 wrote to memory of 2020 3004 cmd.exe PID 3004 wrote to memory of 2020 3004 cmd.exe PID 2020 wrote to memory of 4060 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 4060 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2984 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2984 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2940 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2940 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3100 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3100 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 916 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 916 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3744 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3744 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2992 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2992 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3068 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3068 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2680 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2680 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3252 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 3252 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2604 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 2604 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1328 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1328 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1324 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1324 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1596 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1596 2020 cmd.exe WMIC.exe PID 336 wrote to memory of 2108 336 C2E.exe cmd.exe PID 336 wrote to memory of 2108 336 C2E.exe cmd.exe PID 336 wrote to memory of 2108 336 C2E.exe cmd.exe PID 2108 wrote to memory of 840 2108 cmd.exe timeout.exe PID 2108 wrote to memory of 840 2108 cmd.exe timeout.exe PID 2108 wrote to memory of 840 2108 cmd.exe timeout.exe PID 3004 wrote to memory of 3196 3004 6AFA.exe PID 3004 wrote to memory of 3196 3004 6AFA.exe PID 3004 wrote to memory of 3196 3004 6AFA.exe PID 2020 wrote to memory of 1440 2020 cmd.exe ipconfig.exe PID 2020 wrote to memory of 1440 2020 cmd.exe ipconfig.exe PID 2020 wrote to memory of 2056 2020 cmd.exe ROUTE.EXE PID 2020 wrote to memory of 2056 2020 cmd.exe ROUTE.EXE PID 2020 wrote to memory of 3104 2020 cmd.exe netsh.exe PID 2020 wrote to memory of 3104 2020 cmd.exe netsh.exe PID 2020 wrote to memory of 2704 2020 cmd.exe systeminfo.exe PID 2020 wrote to memory of 2704 2020 cmd.exe systeminfo.exe PID 2020 wrote to memory of 4092 2020 cmd.exe tasklist.exe PID 2020 wrote to memory of 4092 2020 cmd.exe tasklist.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3700 -s 9402⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe"C:\Users\Admin\AppData\Local\Temp\b6987ed623fa6b0641132244c02f1dfc19b183f318e7e6eaadca359266799dd1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9C3C.exeC:\Users\Admin\AppData\Local\Temp\9C3C.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\C939.exeC:\Users\Admin\AppData\Local\Temp\C939.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C2E.exeC:\Users\Admin\AppData\Local\Temp\C2E.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C2E.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\2E0F.exeC:\Users\Admin\AppData\Local\Temp\2E0F.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Admin\AppData\Local\Temp\6AFA.exeC:\Users\Admin\AppData\Local\Temp\6AFA.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2E0F.exeMD5
ece0294ddae05e6fdcfa0b1b7f17a0c7
SHA1b8f5abee60f5a1d91b62ce00a161ef4ab79c4871
SHA256f8b2f843813a8b9d704a7463939679652f2a681f81784d914033ba1e383cf06c
SHA51246cbbace7ec11dbcdd50cc564f2d8593cd5420769da752be274056795c12710de85cb0e4851d7eccd41246613ec921db6cf724adec2ed5b7167691fdde6658c7
-
C:\Users\Admin\AppData\Local\Temp\2E0F.exeMD5
ece0294ddae05e6fdcfa0b1b7f17a0c7
SHA1b8f5abee60f5a1d91b62ce00a161ef4ab79c4871
SHA256f8b2f843813a8b9d704a7463939679652f2a681f81784d914033ba1e383cf06c
SHA51246cbbace7ec11dbcdd50cc564f2d8593cd5420769da752be274056795c12710de85cb0e4851d7eccd41246613ec921db6cf724adec2ed5b7167691fdde6658c7
-
C:\Users\Admin\AppData\Local\Temp\6AFA.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\6AFA.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\9C3C.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Local\Temp\9C3C.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Local\Temp\C2E.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\C2E.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\C939.exeMD5
9e6c9c142474801ea2ff0a3d788b58d2
SHA17b08371ad69bbd4f43349f6613935bf84f9fb6e5
SHA256b1bc137297a71554da90577181df0ee679999725cfbaa4f4b2bcda89c17d0e5f
SHA5127c0c44d6c1dc6013019289ae86758e95bfb077f1c1ec8708975b491861584a807f1c51cb2d5ad56ac88de809088825ebd4c1eb4b6dc01825851b81ea1ff5e198
-
C:\Users\Admin\AppData\Local\Temp\C939.exeMD5
9e6c9c142474801ea2ff0a3d788b58d2
SHA17b08371ad69bbd4f43349f6613935bf84f9fb6e5
SHA256b1bc137297a71554da90577181df0ee679999725cfbaa4f4b2bcda89c17d0e5f
SHA5127c0c44d6c1dc6013019289ae86758e95bfb077f1c1ec8708975b491861584a807f1c51cb2d5ad56ac88de809088825ebd4c1eb4b6dc01825851b81ea1ff5e198
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\GEBCPU~1.ZIPMD5
88070cdea3d234d0ff167925526ad773
SHA14cdd93be99c8a7e91c189abb253f994fd88de23c
SHA25668f8ed850f5483fef18cd42a526ee2f85333eed3e92ae9aac1cec3b7cd73cc16
SHA512d80d773b462cff2a8d50afa8175b15afe7fda8cea89ae4bf2cfc4c4cb767c073ea5edee04bd3e7e752d7be8cccd511143bd9afd6665d31b04b30b0e50b8653b9
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\YBUXIW~1.ZIPMD5
1761738471582f92cd49f592bb60bd83
SHA14bdd99725a503214344a1a80e9897cce27d87000
SHA25661de98b2ac4d38f2968d022db0b89cecb05a19ae677fd6c7caf827621fc37d3e
SHA51208b37deb1273537a20b4244b04f0873f58dfd962581b5f1c1d2d394cc38e6285cc3021a558cc045c57f498231868bb6ca2354f9bca377d7e912dd0e4c1d7a918
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_Chrome\DEFAUL~1.BINMD5
d4026455697acb78d4f621b54352b4f0
SHA1f32214a2fa38ee0eadb6b38b0cd444dc34ebc2c9
SHA2562e28af610200cae02bd440c87bee8508a08c65510e83916acf94f96faf6d7624
SHA512efb97c89babef3239063c4bb4230f5458474b4141dc128e84a4fe0e4067bc3e8a5ba6e2f6fc87568619af12c05731d121ccf73acbcd9ba06afd5fe92f65a2f76
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_INFOR~1.TXTMD5
3c5ee00c04747d633aeab8f05a969ed0
SHA163b23eb74283e37672ff4690d9deb4b9611208f1
SHA256877860b49abc5f8e43a5552ba3044e8d21fbb219ac29290db7e00796df22d6a5
SHA512481b9b211ed58ede3f4840211a0c2f4649a3f77b978d80e08247d872a85208032b8a25650abb52602567783f9029c4fffa397c1c3d1ceb2661202d6b3dd0355b
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\_Files\_SCREE~1.JPEMD5
7364aa08e9cc2997ee09956835d9aec2
SHA12d0c767aa7a8f326f923707a238eb969120d1a36
SHA256f2e4a228d0eb99969494586f0907789cc13d6b3002aa21699660146623ff4e04
SHA512c3ef4af30e69ae87f5c8ac1229e18eb17f904c3b4c28e47e94d6f09fd06fbe2f7481c04c75292d16ae382911aae2f8d0fe31f03399e838d0b8e954850469648f
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\SCREEN~1.JPGMD5
7364aa08e9cc2997ee09956835d9aec2
SHA12d0c767aa7a8f326f923707a238eb969120d1a36
SHA256f2e4a228d0eb99969494586f0907789cc13d6b3002aa21699660146623ff4e04
SHA512c3ef4af30e69ae87f5c8ac1229e18eb17f904c3b4c28e47e94d6f09fd06fbe2f7481c04c75292d16ae382911aae2f8d0fe31f03399e838d0b8e954850469648f
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\SYSTEM~1.TXTMD5
3c5ee00c04747d633aeab8f05a969ed0
SHA163b23eb74283e37672ff4690d9deb4b9611208f1
SHA256877860b49abc5f8e43a5552ba3044e8d21fbb219ac29290db7e00796df22d6a5
SHA512481b9b211ed58ede3f4840211a0c2f4649a3f77b978d80e08247d872a85208032b8a25650abb52602567783f9029c4fffa397c1c3d1ceb2661202d6b3dd0355b
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\_Chrome\DEFAUL~1.BINMD5
d4026455697acb78d4f621b54352b4f0
SHA1f32214a2fa38ee0eadb6b38b0cd444dc34ebc2c9
SHA2562e28af610200cae02bd440c87bee8508a08c65510e83916acf94f96faf6d7624
SHA512efb97c89babef3239063c4bb4230f5458474b4141dc128e84a4fe0e4067bc3e8a5ba6e2f6fc87568619af12c05731d121ccf73acbcd9ba06afd5fe92f65a2f76
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\UpKePhLekWTNP\files_\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
memory/336-140-0x0000000000508000-0x000000000052E000-memory.dmpFilesize
152KB
-
memory/336-142-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/336-237-0x0000000000000000-mapping.dmp
-
memory/336-141-0x00000000005F0000-0x0000000000637000-memory.dmpFilesize
284KB
-
memory/336-137-0x0000000000000000-mapping.dmp
-
memory/664-232-0x0000000000000000-mapping.dmp
-
memory/676-229-0x0000000000000000-mapping.dmp
-
memory/748-262-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-257-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-337-0x00000290851C0000-0x00000290851C1000-memory.dmpFilesize
4KB
-
memory/748-335-0x00000290872B0000-0x00000290872B1000-memory.dmpFilesize
4KB
-
memory/748-334-0x00000290872B0000-0x00000290872B1000-memory.dmpFilesize
4KB
-
memory/748-249-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-250-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-251-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-253-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-254-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-255-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-321-0x0000029087200000-0x0000029087201000-memory.dmpFilesize
4KB
-
memory/748-314-0x00000290851B0000-0x00000290851B1000-memory.dmpFilesize
4KB
-
memory/748-256-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-272-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-269-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-271-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-270-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-268-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-266-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-265-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-263-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-261-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-259-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/748-258-0x00007FFD30A80000-0x00007FFD30AEB000-memory.dmpFilesize
428KB
-
memory/752-125-0x0000000000000000-mapping.dmp
-
memory/752-129-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/752-326-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/752-128-0x0000000000518000-0x0000000000598000-memory.dmpFilesize
512KB
-
memory/752-325-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/840-196-0x0000000000000000-mapping.dmp
-
memory/916-158-0x0000000000000000-mapping.dmp
-
memory/1092-226-0x0000000000000000-mapping.dmp
-
memory/1232-240-0x0000000000000000-mapping.dmp
-
memory/1260-134-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/1260-135-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1260-130-0x0000000000000000-mapping.dmp
-
memory/1324-233-0x0000000000000000-mapping.dmp
-
memory/1324-179-0x0000000000000000-mapping.dmp
-
memory/1328-178-0x0000000000000000-mapping.dmp
-
memory/1440-212-0x0000000000000000-mapping.dmp
-
memory/1440-244-0x0000000000000000-mapping.dmp
-
memory/1512-236-0x0000000000000000-mapping.dmp
-
memory/1596-180-0x0000000000000000-mapping.dmp
-
memory/1720-274-0x0000000000000000-mapping.dmp
-
memory/1800-235-0x0000000000000000-mapping.dmp
-
memory/2020-149-0x0000000000000000-mapping.dmp
-
memory/2056-213-0x0000000000000000-mapping.dmp
-
memory/2108-181-0x0000000000000000-mapping.dmp
-
memory/2124-322-0x0000000000000000-mapping.dmp
-
memory/2124-324-0x0000000000600000-0x000000000060B000-memory.dmpFilesize
44KB
-
memory/2124-323-0x0000000000610000-0x0000000000616000-memory.dmpFilesize
24KB
-
memory/2228-303-0x0000000000000000-mapping.dmp
-
memory/2228-306-0x0000000001030000-0x0000000001037000-memory.dmpFilesize
28KB
-
memory/2228-307-0x0000000001020000-0x000000000102C000-memory.dmpFilesize
48KB
-
memory/2252-311-0x0000000000000000-mapping.dmp
-
memory/2252-313-0x0000000000720000-0x000000000072E000-memory.dmpFilesize
56KB
-
memory/2252-312-0x0000000000730000-0x0000000000739000-memory.dmpFilesize
36KB
-
memory/2348-330-0x000002AAC4310000-0x000002AAC4311000-memory.dmpFilesize
4KB
-
memory/2356-242-0x0000000000000000-mapping.dmp
-
memory/2372-331-0x000001FFE3D40000-0x000001FFE3D41000-memory.dmpFilesize
4KB
-
memory/2428-230-0x0000000000000000-mapping.dmp
-
memory/2472-239-0x0000000000000000-mapping.dmp
-
memory/2596-234-0x0000000000000000-mapping.dmp
-
memory/2604-177-0x0000000000000000-mapping.dmp
-
memory/2680-175-0x0000000000000000-mapping.dmp
-
memory/2704-215-0x0000000000000000-mapping.dmp
-
memory/2720-332-0x0000016E7A640000-0x0000016E7A641000-memory.dmpFilesize
4KB
-
memory/2912-231-0x0000000000000000-mapping.dmp
-
memory/2940-153-0x0000000000000000-mapping.dmp
-
memory/2960-238-0x0000000000000000-mapping.dmp
-
memory/2980-336-0x000001F51F150000-0x000001F51F151000-memory.dmpFilesize
4KB
-
memory/2984-151-0x0000000000000000-mapping.dmp
-
memory/2992-173-0x0000000000000000-mapping.dmp
-
memory/3004-148-0x00000000043B0000-0x00000000043BF000-memory.dmpFilesize
60KB
-
memory/3004-136-0x00000000028E0000-0x00000000028F6000-memory.dmpFilesize
88KB
-
memory/3004-147-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/3004-118-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/3004-146-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/3004-245-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/3004-247-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/3004-248-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/3012-116-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3012-117-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/3012-115-0x0000000000749000-0x0000000000752000-memory.dmpFilesize
36KB
-
memory/3068-174-0x0000000000000000-mapping.dmp
-
memory/3096-308-0x0000000000000000-mapping.dmp
-
memory/3096-309-0x0000000000AC0000-0x0000000000AC7000-memory.dmpFilesize
28KB
-
memory/3096-310-0x0000000000AB0000-0x0000000000ABB000-memory.dmpFilesize
44KB
-
memory/3100-154-0x0000000000000000-mapping.dmp
-
memory/3104-214-0x0000000000000000-mapping.dmp
-
memory/3136-327-0x0000000000000000-mapping.dmp
-
memory/3136-328-0x00000000007F0000-0x00000000007F7000-memory.dmpFilesize
28KB
-
memory/3136-329-0x00000000007E0000-0x00000000007ED000-memory.dmpFilesize
52KB
-
memory/3168-241-0x0000000000000000-mapping.dmp
-
memory/3180-318-0x0000000000000000-mapping.dmp
-
memory/3180-320-0x0000000000190000-0x000000000019C000-memory.dmpFilesize
48KB
-
memory/3180-319-0x00000000001A0000-0x00000000001A6000-memory.dmpFilesize
24KB
-
memory/3184-302-0x0000000000000000-mapping.dmp
-
memory/3184-304-0x0000000000A70000-0x0000000000AE5000-memory.dmpFilesize
468KB
-
memory/3184-305-0x0000000000A00000-0x0000000000A6B000-memory.dmpFilesize
428KB
-
memory/3196-211-0x0000000005240000-0x0000000005846000-memory.dmpFilesize
6.0MB
-
memory/3196-204-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/3196-201-0x0000000000000000-mapping.dmp
-
memory/3252-176-0x0000000000000000-mapping.dmp
-
memory/3360-315-0x0000000000000000-mapping.dmp
-
memory/3360-316-0x0000000000850000-0x0000000000855000-memory.dmpFilesize
20KB
-
memory/3360-317-0x0000000000840000-0x0000000000849000-memory.dmpFilesize
36KB
-
memory/3384-161-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/3384-171-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/3384-166-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/3384-167-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/3384-163-0x0000000004BA3000-0x0000000004BA4000-memory.dmpFilesize
4KB
-
memory/3384-169-0x0000000004BA4000-0x0000000004BA6000-memory.dmpFilesize
8KB
-
memory/3384-170-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/3384-216-0x0000000006580000-0x0000000006581000-memory.dmpFilesize
4KB
-
memory/3384-217-0x0000000006760000-0x0000000006761000-memory.dmpFilesize
4KB
-
memory/3384-160-0x00000000023B0000-0x00000000023DC000-memory.dmpFilesize
176KB
-
memory/3384-143-0x0000000000000000-mapping.dmp
-
memory/3384-200-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/3384-199-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/3384-198-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/3384-197-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/3384-155-0x0000000000470000-0x000000000051E000-memory.dmpFilesize
696KB
-
memory/3384-168-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/3384-156-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3384-162-0x0000000004BA2000-0x0000000004BA3000-memory.dmpFilesize
4KB
-
memory/3384-159-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3384-157-0x00000000022B0000-0x00000000022DE000-memory.dmpFilesize
184KB
-
memory/3472-333-0x0000023DFA470000-0x0000023DFA471000-memory.dmpFilesize
4KB
-
memory/3596-227-0x0000000000000000-mapping.dmp
-
memory/3744-172-0x0000000000000000-mapping.dmp
-
memory/3764-243-0x0000000000000000-mapping.dmp
-
memory/3920-165-0x0000024479F10000-0x0000024479F12000-memory.dmpFilesize
8KB
-
memory/3920-164-0x0000024479F10000-0x0000024479F12000-memory.dmpFilesize
8KB
-
memory/3948-124-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/3948-122-0x0000000000628000-0x00000000006A8000-memory.dmpFilesize
512KB
-
memory/3948-123-0x0000000001FB0000-0x0000000002041000-memory.dmpFilesize
580KB
-
memory/3948-119-0x0000000000000000-mapping.dmp
-
memory/4032-228-0x0000000000000000-mapping.dmp
-
memory/4060-150-0x0000000000000000-mapping.dmp
-
memory/4092-225-0x0000000000000000-mapping.dmp