Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-12-2021 02:05
Static task
static1
Behavioral task
behavioral1
Sample
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe
Resource
win10-en-20211104
General
-
Target
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe
-
Size
247KB
-
MD5
b1ff5c0f50cf70ce35aebfce19ed3a80
-
SHA1
e40ac11f588469158499a0d0888ff8e674ab33af
-
SHA256
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015
-
SHA512
da9ccf4200f94a378d9c027ae1d87f33c7411d06df996f12095d50706b4672f0a9c672a94d520681a6d38d493e756a3c1a42892e3d8d69dff1066dd86923350f
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Extracted
redline
92.255.76.197:38637
Extracted
redline
1
45.9.20.59:46287
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-150-0x00000000023B0000-0x00000000023DE000-memory.dmp family_redline behavioral1/memory/1704-152-0x0000000004EE0000-0x0000000004F0C000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\E148.exe family_redline C:\Users\Admin\AppData\Local\Temp\E148.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
3719.exeSmartClock.exe607C.exe99CD.exeAC7B.exeE148.exepid process 760 3719.exe 4512 SmartClock.exe 1000 607C.exe 1252 99CD.exe 1704 AC7B.exe 2184 E148.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3044 -
Drops startup file 1 IoCs
Processes:
3719.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 3719.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2236 3840 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe607C.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 607C.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 607C.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 607C.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
99CD.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 99CD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 99CD.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1652 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEipconfig.exeipconfig.exeNETSTAT.EXEpid process 1456 NETSTAT.EXE 1320 ipconfig.exe 4280 ipconfig.exe 3732 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D9C169C-400F-11EC-B34F-FEE0DE99BB17} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 4512 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exepid process 4208 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe 4208 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3044 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe607C.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 4208 24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe 1000 607C.exe 3044 3044 3044 3044 3044 3044 1424 explorer.exe 1424 explorer.exe 3044 3044 4996 explorer.exe 4996 explorer.exe 3044 3044 1992 explorer.exe 1992 explorer.exe 3044 3044 1644 explorer.exe 1644 explorer.exe 3044 3044 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 3044 3044 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AC7B.exeWMIC.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 1704 AC7B.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: 36 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: 36 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 4164 WMIC.exe Token: SeSecurityPrivilege 4164 WMIC.exe Token: SeTakeOwnershipPrivilege 4164 WMIC.exe Token: SeLoadDriverPrivilege 4164 WMIC.exe Token: SeSystemProfilePrivilege 4164 WMIC.exe Token: SeSystemtimePrivilege 4164 WMIC.exe Token: SeProfSingleProcessPrivilege 4164 WMIC.exe Token: SeIncBasePriorityPrivilege 4164 WMIC.exe Token: SeCreatePagefilePrivilege 4164 WMIC.exe Token: SeBackupPrivilege 4164 WMIC.exe Token: SeRestorePrivilege 4164 WMIC.exe Token: SeShutdownPrivilege 4164 WMIC.exe Token: SeDebugPrivilege 4164 WMIC.exe Token: SeSystemEnvironmentPrivilege 4164 WMIC.exe Token: SeRemoteShutdownPrivilege 4164 WMIC.exe Token: SeUndockPrivilege 4164 WMIC.exe Token: SeManageVolumePrivilege 4164 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4300 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4300 iexplore.exe 4300 iexplore.exe 4944 IEXPLORE.EXE 4944 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
RuntimeBroker.exepid process 3496 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3719.execmd.exe99CD.execmd.exedescription pid process target process PID 3044 wrote to memory of 760 3044 3719.exe PID 3044 wrote to memory of 760 3044 3719.exe PID 3044 wrote to memory of 760 3044 3719.exe PID 760 wrote to memory of 4512 760 3719.exe SmartClock.exe PID 760 wrote to memory of 4512 760 3719.exe SmartClock.exe PID 760 wrote to memory of 4512 760 3719.exe SmartClock.exe PID 3044 wrote to memory of 1000 3044 607C.exe PID 3044 wrote to memory of 1000 3044 607C.exe PID 3044 wrote to memory of 1000 3044 607C.exe PID 3044 wrote to memory of 1252 3044 99CD.exe PID 3044 wrote to memory of 1252 3044 99CD.exe PID 3044 wrote to memory of 1252 3044 99CD.exe PID 3044 wrote to memory of 1704 3044 AC7B.exe PID 3044 wrote to memory of 1704 3044 AC7B.exe PID 3044 wrote to memory of 1704 3044 AC7B.exe PID 3044 wrote to memory of 3828 3044 cmd.exe PID 3044 wrote to memory of 3828 3044 cmd.exe PID 3828 wrote to memory of 1872 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1872 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4164 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4164 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4872 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4872 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1328 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1328 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4976 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4976 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 2412 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 2412 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4992 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4992 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1992 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1992 3828 cmd.exe WMIC.exe PID 1252 wrote to memory of 2540 1252 99CD.exe cmd.exe PID 1252 wrote to memory of 2540 1252 99CD.exe cmd.exe PID 1252 wrote to memory of 2540 1252 99CD.exe cmd.exe PID 3828 wrote to memory of 2328 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 2328 3828 cmd.exe WMIC.exe PID 2540 wrote to memory of 1652 2540 cmd.exe timeout.exe PID 2540 wrote to memory of 1652 2540 cmd.exe timeout.exe PID 2540 wrote to memory of 1652 2540 cmd.exe timeout.exe PID 3828 wrote to memory of 1916 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1916 3828 cmd.exe WMIC.exe PID 3044 wrote to memory of 2184 3044 E148.exe PID 3044 wrote to memory of 2184 3044 E148.exe PID 3044 wrote to memory of 2184 3044 E148.exe PID 3828 wrote to memory of 2536 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 2536 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 3668 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 3668 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 5012 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 5012 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1060 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 1060 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4280 3828 cmd.exe ipconfig.exe PID 3828 wrote to memory of 4280 3828 cmd.exe ipconfig.exe PID 3828 wrote to memory of 3100 3828 cmd.exe ROUTE.EXE PID 3828 wrote to memory of 3100 3828 cmd.exe ROUTE.EXE PID 3828 wrote to memory of 3376 3828 cmd.exe netsh.exe PID 3828 wrote to memory of 3376 3828 cmd.exe netsh.exe PID 3828 wrote to memory of 5056 3828 cmd.exe systeminfo.exe PID 3828 wrote to memory of 5056 3828 cmd.exe systeminfo.exe PID 3828 wrote to memory of 3952 3828 cmd.exe tasklist.exe PID 3828 wrote to memory of 3952 3828 cmd.exe tasklist.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3840 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe"C:\Users\Admin\AppData\Local\Temp\24a0e2b381718924f13c73ff3fa0abd2eecaf83a435750b72ce86d548106e015.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3719.exeC:\Users\Admin\AppData\Local\Temp\3719.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\607C.exeC:\Users\Admin\AppData\Local\Temp\607C.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\99CD.exeC:\Users\Admin\AppData\Local\Temp\99CD.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\99CD.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\AC7B.exeC:\Users\Admin\AppData\Local\Temp\AC7B.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Admin\AppData\Local\Temp\E148.exeC:\Users\Admin\AppData\Local\Temp\E148.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4300 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3719.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Local\Temp\3719.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Local\Temp\607C.exeMD5
86c76df3f0feed13d6ad6f9155156369
SHA1330e82600381f68d6f6914b50b451b6c59901b26
SHA2564dc4954990ef29b8b1b66f23cd475d375cc759b2aabbfdde761abaafef975baf
SHA512078e22f7c6109abf532591dc429d6a58255a192c3a70324b769e5f2b79549d0814fa2330693484dccdc27427ef25526b5db4f3b574c521bed0ae27eadada789c
-
C:\Users\Admin\AppData\Local\Temp\607C.exeMD5
86c76df3f0feed13d6ad6f9155156369
SHA1330e82600381f68d6f6914b50b451b6c59901b26
SHA2564dc4954990ef29b8b1b66f23cd475d375cc759b2aabbfdde761abaafef975baf
SHA512078e22f7c6109abf532591dc429d6a58255a192c3a70324b769e5f2b79549d0814fa2330693484dccdc27427ef25526b5db4f3b574c521bed0ae27eadada789c
-
C:\Users\Admin\AppData\Local\Temp\99CD.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\99CD.exeMD5
01e84b58f52c9a1fa5e7a60932f9ef3b
SHA104c0aadf2b04795c5d6acd865a066c4490ec5a26
SHA2567f2637c56ceed05819d0e5f09655b8741f1bb72d43fe24a4e117045e2374eea8
SHA5128b42dc06112caa64b4bd924619a8e679a971170bd848e6ffb7ebc19e7490f2d13b74bb73bc4298596ab13428a3baf22c9b211f6696d1ca12550b35e64c0564aa
-
C:\Users\Admin\AppData\Local\Temp\AC7B.exeMD5
258471c4b35be5f9377e4c08e222dcc4
SHA1c54edf034d630517f33923776708c71a26a356fc
SHA25601b4bfc11d82eb8dc810612209d13fcc1c9e40fb8e2c7467cf210e56736bdd8b
SHA51240507444d4645929aa8246d69894fbbdd6847eae8d90d1ca4b7c68c748c7d1cc09e645b10a344f4d3e4e56c09ca02877bc7c785eb96ceda63e83fc4e24993f71
-
C:\Users\Admin\AppData\Local\Temp\AC7B.exeMD5
258471c4b35be5f9377e4c08e222dcc4
SHA1c54edf034d630517f33923776708c71a26a356fc
SHA25601b4bfc11d82eb8dc810612209d13fcc1c9e40fb8e2c7467cf210e56736bdd8b
SHA51240507444d4645929aa8246d69894fbbdd6847eae8d90d1ca4b7c68c748c7d1cc09e645b10a344f4d3e4e56c09ca02877bc7c785eb96ceda63e83fc4e24993f71
-
C:\Users\Admin\AppData\Local\Temp\E148.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\E148.exeMD5
a8162fc2e944d87a356dea9a716b043d
SHA1b5b76a20f49139d1f2dcd1384efefb86cd41b5bd
SHA256d7c447f3e23cf6d10f9638688e5e88baddd70460a1a6f37f4cf18f51044c18b0
SHA512d82f2f068097ab7f71579d57f47acce91d007fd4b6a7f97e876291c22ff5805e59b41404653c70072cf3dbd4a71f8993fb8918b4165ddd6802d3f133321e6b1f
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\HXMCSY~1.ZIPMD5
186001264048fc467a72449bd2b3f417
SHA126f16d7ba511b5ebb6f23c16afa0285ca54dce18
SHA25647bfea0671463f7a988b56e5ec842053c5ff8fa3eb9d5be13d91168be2b8586b
SHA512810c7ee469b3a4d1b126619fed746cca0eab602601a94cb1a75df5a592a04d48e490d20c2d592970d2768b40c31ee98a726075012b685cfc1409d6f053876ea5
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\OHUDEU~1.ZIPMD5
6800d21dc9b93c5dd711f7fbc6deda6d
SHA1d34ee37dc5403fefc86e776faf12a3130696183a
SHA256a9d600f57db106e190491801ff516d6a5f1188e32c9eb581e4961ca853ea74f6
SHA512395123b0d1210d6ce07541a154358972aa819536271ec4e7acb75cddab5bef08e8bc354a39471ea543e991e991f0eb3f007b405cbee6a43d38409b05fd940958
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_Chrome\DEFAUL~1.BINMD5
b963abf9a7967b3a22da64c9193fc932
SHA10831556392b56c00b07f04deb5474c4202c545e8
SHA2566c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5
SHA51264514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_INFOR~1.TXTMD5
293a0629765c7ad97c903bfe01ba480d
SHA17a8d1925e9a876226b565e92268f71eff6630667
SHA2560e42090907a7860ac9963c1f6378e3cda89463a88aca1720a6229a4b2965dde6
SHA5129f3f12709b107f327d5ab4a3c1f9b115226b5e124fcc8a7c61d31481cdc63d75f86e252027278b726be4ea5bf8033c7d9f10f97d961b5a99e46024d2da79735c
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\_Files\_SCREE~1.JPEMD5
697ebb2044131fb411647ef5445688c6
SHA17ec9f84dda268bdba643fbed5a5663366bdbe127
SHA2566ecb3eb26ea2b574aac014c718ee5bf7f2a46974c192f7dc51dadd0e632ed4f2
SHA512c5b11a1924d09421d6c0ffba9409f08d3ac689c5618304ea2bee47a71c1ca64a77d7d7c4dc110107fd1f50f25aec77ff42152fa1b3d563d7eddef81152610c88
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\SCREEN~1.JPGMD5
697ebb2044131fb411647ef5445688c6
SHA17ec9f84dda268bdba643fbed5a5663366bdbe127
SHA2566ecb3eb26ea2b574aac014c718ee5bf7f2a46974c192f7dc51dadd0e632ed4f2
SHA512c5b11a1924d09421d6c0ffba9409f08d3ac689c5618304ea2bee47a71c1ca64a77d7d7c4dc110107fd1f50f25aec77ff42152fa1b3d563d7eddef81152610c88
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\SYSTEM~1.TXTMD5
293a0629765c7ad97c903bfe01ba480d
SHA17a8d1925e9a876226b565e92268f71eff6630667
SHA2560e42090907a7860ac9963c1f6378e3cda89463a88aca1720a6229a4b2965dde6
SHA5129f3f12709b107f327d5ab4a3c1f9b115226b5e124fcc8a7c61d31481cdc63d75f86e252027278b726be4ea5bf8033c7d9f10f97d961b5a99e46024d2da79735c
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\_Chrome\DEFAUL~1.BINMD5
b963abf9a7967b3a22da64c9193fc932
SHA10831556392b56c00b07f04deb5474c4202c545e8
SHA2566c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5
SHA51264514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\XaesUWKXCAG\files_\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
bbe351bb93db00afb09a1338498e1195
SHA1a951a3f136c23990718c4a021e6086563aaaadb1
SHA25614a3fe14f0aeb1fe487ae9e66e13663cbd559b490ad6e7788bb24b0491ab5859
SHA5128dc0c999fd63a79f4fd980ed527e27d7b54ea1a7133453dc458a6be068f243aea76ba271737dbb3787b918d7b85b2bf2e0370bab2c4e51f43c75e58e92b76cac
-
memory/364-241-0x0000000000000000-mapping.dmp
-
memory/368-237-0x0000000000000000-mapping.dmp
-
memory/372-234-0x0000000000000000-mapping.dmp
-
memory/508-238-0x0000000000000000-mapping.dmp
-
memory/660-236-0x0000000000000000-mapping.dmp
-
memory/760-125-0x0000000000748000-0x00000000007C8000-memory.dmpFilesize
512KB
-
memory/760-126-0x00000000020D0000-0x0000000002161000-memory.dmpFilesize
580KB
-
memory/760-127-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/760-122-0x0000000000000000-mapping.dmp
-
memory/796-232-0x0000000000000000-mapping.dmp
-
memory/860-239-0x0000000000000000-mapping.dmp
-
memory/1000-137-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/1000-133-0x0000000000000000-mapping.dmp
-
memory/1000-136-0x00000000006B8000-0x00000000006C1000-memory.dmpFilesize
36KB
-
memory/1000-138-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1060-216-0x0000000000000000-mapping.dmp
-
memory/1248-244-0x0000000000000000-mapping.dmp
-
memory/1252-145-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1252-140-0x0000000000000000-mapping.dmp
-
memory/1252-144-0x0000000002080000-0x00000000020C7000-memory.dmpFilesize
284KB
-
memory/1320-247-0x0000000000000000-mapping.dmp
-
memory/1328-171-0x0000000000000000-mapping.dmp
-
memory/1368-240-0x0000000000000000-mapping.dmp
-
memory/1380-301-0x0000000000000000-mapping.dmp
-
memory/1380-307-0x0000000000A00000-0x0000000000A75000-memory.dmpFilesize
468KB
-
memory/1380-308-0x0000000000760000-0x00000000007CB000-memory.dmpFilesize
428KB
-
memory/1424-316-0x0000000000150000-0x000000000015B000-memory.dmpFilesize
44KB
-
memory/1424-313-0x0000000000160000-0x0000000000167000-memory.dmpFilesize
28KB
-
memory/1424-311-0x0000000000000000-mapping.dmp
-
memory/1456-245-0x0000000000000000-mapping.dmp
-
memory/1644-323-0x0000000000F90000-0x0000000000F9C000-memory.dmpFilesize
48KB
-
memory/1644-321-0x0000000000000000-mapping.dmp
-
memory/1644-322-0x0000000000FA0000-0x0000000000FA6000-memory.dmpFilesize
24KB
-
memory/1652-200-0x0000000000000000-mapping.dmp
-
memory/1704-151-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1704-153-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/1704-146-0x0000000000000000-mapping.dmp
-
memory/1704-150-0x00000000023B0000-0x00000000023DE000-memory.dmpFilesize
184KB
-
memory/1704-152-0x0000000004EE0000-0x0000000004F0C000-memory.dmpFilesize
176KB
-
memory/1704-154-0x0000000001F90000-0x0000000001FC9000-memory.dmpFilesize
228KB
-
memory/1704-180-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/1704-179-0x0000000006440000-0x0000000006441000-memory.dmpFilesize
4KB
-
memory/1704-178-0x0000000005D00000-0x0000000005D01000-memory.dmpFilesize
4KB
-
memory/1704-177-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/1704-176-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/1704-175-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/1704-155-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1704-156-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/1704-158-0x0000000002182000-0x0000000002183000-memory.dmpFilesize
4KB
-
memory/1704-157-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/1704-159-0x0000000002183000-0x0000000002184000-memory.dmpFilesize
4KB
-
memory/1704-160-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/1704-161-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/1704-162-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/1704-163-0x0000000002184000-0x0000000002186000-memory.dmpFilesize
8KB
-
memory/1740-246-0x0000000000000000-mapping.dmp
-
memory/1872-168-0x0000000000000000-mapping.dmp
-
memory/1916-201-0x0000000000000000-mapping.dmp
-
memory/1952-332-0x0000000000FB0000-0x0000000000FB7000-memory.dmpFilesize
28KB
-
memory/1952-326-0x0000000000000000-mapping.dmp
-
memory/1952-333-0x0000000000FA0000-0x0000000000FAD000-memory.dmpFilesize
52KB
-
memory/1992-320-0x00000000034E0000-0x00000000034E9000-memory.dmpFilesize
36KB
-
memory/1992-183-0x0000000000000000-mapping.dmp
-
memory/1992-319-0x00000000034F0000-0x00000000034F5000-memory.dmpFilesize
20KB
-
memory/1992-318-0x0000000000000000-mapping.dmp
-
memory/2184-202-0x0000000000000000-mapping.dmp
-
memory/2184-213-0x0000000004A30000-0x0000000005036000-memory.dmpFilesize
6.0MB
-
memory/2184-205-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2236-339-0x000002361B970000-0x000002361B971000-memory.dmpFilesize
4KB
-
memory/2316-325-0x0000000000000000-mapping.dmp
-
memory/2316-328-0x0000000000130000-0x000000000013B000-memory.dmpFilesize
44KB
-
memory/2316-327-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/2328-185-0x0000000000000000-mapping.dmp
-
memory/2344-329-0x00000270E1B20000-0x00000270E1B21000-memory.dmpFilesize
4KB
-
memory/2368-334-0x000001E4771D0000-0x000001E4771D1000-memory.dmpFilesize
4KB
-
memory/2412-181-0x0000000000000000-mapping.dmp
-
memory/2508-335-0x0000023344C40000-0x0000023344C41000-memory.dmpFilesize
4KB
-
memory/2536-212-0x0000000000000000-mapping.dmp
-
memory/2540-184-0x0000000000000000-mapping.dmp
-
memory/3044-165-0x00000000029D0000-0x00000000029D2000-memory.dmpFilesize
8KB
-
memory/3044-139-0x0000000002600000-0x0000000002616000-memory.dmpFilesize
88KB
-
memory/3044-166-0x00000000027D0000-0x00000000027DF000-memory.dmpFilesize
60KB
-
memory/3044-164-0x00000000029D0000-0x00000000029D2000-memory.dmpFilesize
8KB
-
memory/3044-248-0x00000000029D0000-0x00000000029D2000-memory.dmpFilesize
8KB
-
memory/3044-250-0x00000000029D0000-0x00000000029D2000-memory.dmpFilesize
8KB
-
memory/3044-251-0x00000000029D0000-0x00000000029D2000-memory.dmpFilesize
8KB
-
memory/3044-121-0x00000000006C0000-0x00000000006D6000-memory.dmpFilesize
88KB
-
memory/3100-218-0x0000000000000000-mapping.dmp
-
memory/3252-235-0x0000000000000000-mapping.dmp
-
memory/3376-219-0x0000000000000000-mapping.dmp
-
memory/3496-336-0x0000022E52F20000-0x0000022E52F21000-memory.dmpFilesize
4KB
-
memory/3668-214-0x0000000000000000-mapping.dmp
-
memory/3732-242-0x0000000000000000-mapping.dmp
-
memory/3828-167-0x0000000000000000-mapping.dmp
-
memory/3952-228-0x0000000000000000-mapping.dmp
-
memory/4028-243-0x0000000000000000-mapping.dmp
-
memory/4164-169-0x0000000000000000-mapping.dmp
-
memory/4208-120-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/4208-119-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/4252-230-0x0000000000000000-mapping.dmp
-
memory/4280-217-0x0000000000000000-mapping.dmp
-
memory/4300-265-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-264-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-268-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-269-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-270-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-272-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-273-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-274-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-275-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-340-0x000002B304050000-0x000002B304051000-memory.dmpFilesize
4KB
-
memory/4300-278-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-253-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-252-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-266-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-262-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-338-0x000002B306140000-0x000002B306141000-memory.dmpFilesize
4KB
-
memory/4300-337-0x000002B306140000-0x000002B306141000-memory.dmpFilesize
4KB
-
memory/4300-261-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-260-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-254-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-315-0x000002B304040000-0x000002B304041000-memory.dmpFilesize
4KB
-
memory/4300-259-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-258-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-324-0x000002B306090000-0x000002B306091000-memory.dmpFilesize
4KB
-
memory/4300-257-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4300-256-0x00007FF9F0660000-0x00007FF9F06CB000-memory.dmpFilesize
428KB
-
memory/4356-229-0x0000000000000000-mapping.dmp
-
memory/4444-233-0x0000000000000000-mapping.dmp
-
memory/4512-132-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/4512-128-0x0000000000000000-mapping.dmp
-
memory/4512-330-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/4512-331-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/4632-231-0x0000000000000000-mapping.dmp
-
memory/4792-306-0x0000000000000000-mapping.dmp
-
memory/4792-309-0x0000000000BF0000-0x0000000000BF7000-memory.dmpFilesize
28KB
-
memory/4792-310-0x0000000000BE0000-0x0000000000BEC000-memory.dmpFilesize
48KB
-
memory/4872-170-0x0000000000000000-mapping.dmp
-
memory/4936-174-0x0000016E41580000-0x0000016E41582000-memory.dmpFilesize
8KB
-
memory/4936-173-0x0000016E41580000-0x0000016E41582000-memory.dmpFilesize
8KB
-
memory/4944-277-0x0000000000000000-mapping.dmp
-
memory/4976-172-0x0000000000000000-mapping.dmp
-
memory/4992-182-0x0000000000000000-mapping.dmp
-
memory/4996-314-0x00000000005C0000-0x00000000005C9000-memory.dmpFilesize
36KB
-
memory/4996-317-0x00000000005B0000-0x00000000005BE000-memory.dmpFilesize
56KB
-
memory/4996-312-0x0000000000000000-mapping.dmp
-
memory/5012-215-0x0000000000000000-mapping.dmp
-
memory/5056-227-0x0000000000000000-mapping.dmp