Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-12-2021 08:37
Static task
static1
Behavioral task
behavioral1
Sample
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe
Resource
win10-en-20211208
General
-
Target
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe
-
Size
181KB
-
MD5
9a0911d600dd954edbf1275fcee37af9
-
SHA1
222fc2bb19a6874b2b92534430a3b6b6bef8822b
-
SHA256
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc
-
SHA512
5c99bdf04d3210c4d0dcdfe3a0bab763a7f9c662038ac1caed29d3dfea245ebb7fd32448b127a7e02f65dc0161fadc65b25a1729165438cdb6b2c1781270576b
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
tofsee
mubrikych.top
oxxyfix.xyz
Extracted
raccoon
Extracted
raccoon
1.8.3-hotfix
eab89db8f8e51b4a23c6cffb85db8684a0f53e06
-
url4cnc
http://91.219.236.27/zalmanssx
http://94.158.245.167/zalmanssx
http://185.163.204.216/zalmanssx
http://185.225.19.238/zalmanssx
http://185.163.204.218/zalmanssx
https://t.me/zalmanssx
Extracted
amadey
2.86
185.215.113.35/d2VxjasuwS/index.php
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-133-0x0000000000320000-0x0000000000389000-memory.dmp family_redline behavioral1/memory/3396-153-0x0000000000370000-0x0000000000484000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1056 created 3764 1056 WerFault.exe E41A.exe -
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
22F5.exe8402.exe8A4C.exe96B1.exe8402.exeBD84.exeC267.exeDF37.exeuqywjhgn.exeE41A.exetkools.exetkools.exe56BA.exepid process 3692 22F5.exe 3248 8402.exe 2676 8A4C.exe 3396 96B1.exe 4028 8402.exe 1532 BD84.exe 2088 C267.exe 3852 DF37.exe 1016 uqywjhgn.exe 3764 E41A.exe 1672 tkools.exe 996 tkools.exe 1100 56BA.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
E41A.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E41A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E41A.exe -
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
E41A.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E41A.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
8A4C.exe96B1.exeE41A.exe56BA.exepid process 2676 8A4C.exe 3396 96B1.exe 3764 E41A.exe 3764 E41A.exe 1100 56BA.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe8402.exeuqywjhgn.exedescription pid process target process PID 2776 set thread context of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 3248 set thread context of 4028 3248 8402.exe 8402.exe PID 1016 set thread context of 404 1016 uqywjhgn.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1056 3764 WerFault.exe E41A.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe22F5.exeBD84.exe8402.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 22F5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 22F5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BD84.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BD84.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BD84.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 22F5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8402.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8402.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8402.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exepid process 2308 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 2308 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe22F5.exe8402.exeBD84.exepid process 2308 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 3692 22F5.exe 4028 8402.exe 1532 BD84.exe 3004 3004 3004 3004 -
Suspicious use of AdjustPrivilegeToken 59 IoCs
Processes:
8A4C.exe96B1.exeWerFault.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 2676 8A4C.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 3396 96B1.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeRestorePrivilege 1056 WerFault.exe Token: SeBackupPrivilege 1056 WerFault.exe Token: SeDebugPrivilege 1056 WerFault.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe8402.exeC267.exeuqywjhgn.exeDF37.exedescription pid process target process PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 2776 wrote to memory of 2308 2776 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe 90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe PID 3004 wrote to memory of 3692 3004 22F5.exe PID 3004 wrote to memory of 3692 3004 22F5.exe PID 3004 wrote to memory of 3692 3004 22F5.exe PID 3004 wrote to memory of 3248 3004 8402.exe PID 3004 wrote to memory of 3248 3004 8402.exe PID 3004 wrote to memory of 3248 3004 8402.exe PID 3004 wrote to memory of 2676 3004 8A4C.exe PID 3004 wrote to memory of 2676 3004 8A4C.exe PID 3004 wrote to memory of 2676 3004 8A4C.exe PID 3004 wrote to memory of 3396 3004 96B1.exe PID 3004 wrote to memory of 3396 3004 96B1.exe PID 3004 wrote to memory of 3396 3004 96B1.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3248 wrote to memory of 4028 3248 8402.exe 8402.exe PID 3004 wrote to memory of 1532 3004 BD84.exe PID 3004 wrote to memory of 1532 3004 BD84.exe PID 3004 wrote to memory of 1532 3004 BD84.exe PID 3004 wrote to memory of 2088 3004 C267.exe PID 3004 wrote to memory of 2088 3004 C267.exe PID 3004 wrote to memory of 2088 3004 C267.exe PID 2088 wrote to memory of 744 2088 C267.exe cmd.exe PID 2088 wrote to memory of 744 2088 C267.exe cmd.exe PID 2088 wrote to memory of 744 2088 C267.exe cmd.exe PID 2088 wrote to memory of 996 2088 C267.exe cmd.exe PID 2088 wrote to memory of 996 2088 C267.exe cmd.exe PID 2088 wrote to memory of 996 2088 C267.exe cmd.exe PID 2088 wrote to memory of 1816 2088 C267.exe sc.exe PID 2088 wrote to memory of 1816 2088 C267.exe sc.exe PID 2088 wrote to memory of 1816 2088 C267.exe sc.exe PID 2088 wrote to memory of 1796 2088 C267.exe sc.exe PID 2088 wrote to memory of 1796 2088 C267.exe sc.exe PID 2088 wrote to memory of 1796 2088 C267.exe sc.exe PID 2088 wrote to memory of 3856 2088 C267.exe sc.exe PID 2088 wrote to memory of 3856 2088 C267.exe sc.exe PID 2088 wrote to memory of 3856 2088 C267.exe sc.exe PID 3004 wrote to memory of 3852 3004 DF37.exe PID 3004 wrote to memory of 3852 3004 DF37.exe PID 3004 wrote to memory of 3852 3004 DF37.exe PID 2088 wrote to memory of 2776 2088 C267.exe netsh.exe PID 2088 wrote to memory of 2776 2088 C267.exe netsh.exe PID 2088 wrote to memory of 2776 2088 C267.exe netsh.exe PID 3004 wrote to memory of 3764 3004 E41A.exe PID 3004 wrote to memory of 3764 3004 E41A.exe PID 3004 wrote to memory of 3764 3004 E41A.exe PID 3004 wrote to memory of 2836 3004 explorer.exe PID 3004 wrote to memory of 2836 3004 explorer.exe PID 3004 wrote to memory of 2836 3004 explorer.exe PID 3004 wrote to memory of 2836 3004 explorer.exe PID 1016 wrote to memory of 404 1016 uqywjhgn.exe svchost.exe PID 1016 wrote to memory of 404 1016 uqywjhgn.exe svchost.exe PID 1016 wrote to memory of 404 1016 uqywjhgn.exe svchost.exe PID 1016 wrote to memory of 404 1016 uqywjhgn.exe svchost.exe PID 1016 wrote to memory of 404 1016 uqywjhgn.exe svchost.exe PID 3852 wrote to memory of 1672 3852 DF37.exe tkools.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe"C:\Users\Admin\AppData\Local\Temp\90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe"C:\Users\Admin\AppData\Local\Temp\90affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\22F5.exeC:\Users\Admin\AppData\Local\Temp\22F5.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8402.exeC:\Users\Admin\AppData\Local\Temp\8402.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8402.exeC:\Users\Admin\AppData\Local\Temp\8402.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8A4C.exeC:\Users\Admin\AppData\Local\Temp\8A4C.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\96B1.exeC:\Users\Admin\AppData\Local\Temp\96B1.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BD84.exeC:\Users\Admin\AppData\Local\Temp\BD84.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C267.exeC:\Users\Admin\AppData\Local\Temp\C267.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rdugblti\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\uqywjhgn.exe" C:\Windows\SysWOW64\rdugblti\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create rdugblti binPath= "C:\Windows\SysWOW64\rdugblti\uqywjhgn.exe /d\"C:\Users\Admin\AppData\Local\Temp\C267.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description rdugblti "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start rdugblti2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\rdugblti\uqywjhgn.exeC:\Windows\SysWOW64\rdugblti\uqywjhgn.exe /d"C:\Users\Admin\AppData\Local\Temp\C267.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\DF37.exeC:\Users\Admin\AppData\Local\Temp\DF37.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\E41A.exeC:\Users\Admin\AppData\Local\Temp\E41A.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 8562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exeC:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\56BA.exeC:\Users\Admin\AppData\Local\Temp\56BA.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22F5.exeMD5
65fd5caa0beaf2c6915e5b05004e5ba8
SHA14a1e5e5c188ef1e8a3e5bf7fa7db17f0307c6912
SHA256ef0d3b336aeef7f0a0aeb78ec08f1f20592d8006bcbe3fbb559e18aebcf060a3
SHA512c3dee0f304f45f274e28a737ac11506f99066abae57576f75c1b8151c0c8cee5c9e377ab2bc79929f5cf7f7f0f0b77947e657454daecd0e5fcea998df9c85d11
-
C:\Users\Admin\AppData\Local\Temp\22F5.exeMD5
65fd5caa0beaf2c6915e5b05004e5ba8
SHA14a1e5e5c188ef1e8a3e5bf7fa7db17f0307c6912
SHA256ef0d3b336aeef7f0a0aeb78ec08f1f20592d8006bcbe3fbb559e18aebcf060a3
SHA512c3dee0f304f45f274e28a737ac11506f99066abae57576f75c1b8151c0c8cee5c9e377ab2bc79929f5cf7f7f0f0b77947e657454daecd0e5fcea998df9c85d11
-
C:\Users\Admin\AppData\Local\Temp\56BA.exeMD5
a3fdebc978000f4111270ac5b79f1e07
SHA1e40996eba2206b918f142ee094ac3816fc2fbfed
SHA25698a9fb3ddbb57367b3d5ebe2e1eb725b5a9a30e657605ff1b98a0e765419639d
SHA512a1f9d8b68b7fab4dbcef561eeaf4ffa30cad6df7f38c583307ccb2196207d060ff96f036ec08fc8c3e180b2a43706d4dadc8ada86d3abbfe6468c444004f5301
-
C:\Users\Admin\AppData\Local\Temp\56BA.exeMD5
a3fdebc978000f4111270ac5b79f1e07
SHA1e40996eba2206b918f142ee094ac3816fc2fbfed
SHA25698a9fb3ddbb57367b3d5ebe2e1eb725b5a9a30e657605ff1b98a0e765419639d
SHA512a1f9d8b68b7fab4dbcef561eeaf4ffa30cad6df7f38c583307ccb2196207d060ff96f036ec08fc8c3e180b2a43706d4dadc8ada86d3abbfe6468c444004f5301
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exeMD5
2ef6fe31e93909b0fd17c05b0ed5d7d4
SHA12f7651624c0adb3ae8fda5fb6b5df42423bee38d
SHA256fc60164d3da978e1140d70085a511d9862c946b6a02e9dc4202c8155de14b682
SHA512c5e0771a1ada5ba3149d3c394c576006701ec86f14cb2a91c3b264a00e951fb6c829c22a6daf716ec763ea9c21bbc8ba58dc88131ebac7ca53833871348d409a
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exeMD5
2ef6fe31e93909b0fd17c05b0ed5d7d4
SHA12f7651624c0adb3ae8fda5fb6b5df42423bee38d
SHA256fc60164d3da978e1140d70085a511d9862c946b6a02e9dc4202c8155de14b682
SHA512c5e0771a1ada5ba3149d3c394c576006701ec86f14cb2a91c3b264a00e951fb6c829c22a6daf716ec763ea9c21bbc8ba58dc88131ebac7ca53833871348d409a
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exeMD5
2ef6fe31e93909b0fd17c05b0ed5d7d4
SHA12f7651624c0adb3ae8fda5fb6b5df42423bee38d
SHA256fc60164d3da978e1140d70085a511d9862c946b6a02e9dc4202c8155de14b682
SHA512c5e0771a1ada5ba3149d3c394c576006701ec86f14cb2a91c3b264a00e951fb6c829c22a6daf716ec763ea9c21bbc8ba58dc88131ebac7ca53833871348d409a
-
C:\Users\Admin\AppData\Local\Temp\8402.exeMD5
9a0911d600dd954edbf1275fcee37af9
SHA1222fc2bb19a6874b2b92534430a3b6b6bef8822b
SHA25690affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc
SHA5125c99bdf04d3210c4d0dcdfe3a0bab763a7f9c662038ac1caed29d3dfea245ebb7fd32448b127a7e02f65dc0161fadc65b25a1729165438cdb6b2c1781270576b
-
C:\Users\Admin\AppData\Local\Temp\8402.exeMD5
9a0911d600dd954edbf1275fcee37af9
SHA1222fc2bb19a6874b2b92534430a3b6b6bef8822b
SHA25690affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc
SHA5125c99bdf04d3210c4d0dcdfe3a0bab763a7f9c662038ac1caed29d3dfea245ebb7fd32448b127a7e02f65dc0161fadc65b25a1729165438cdb6b2c1781270576b
-
C:\Users\Admin\AppData\Local\Temp\8402.exeMD5
9a0911d600dd954edbf1275fcee37af9
SHA1222fc2bb19a6874b2b92534430a3b6b6bef8822b
SHA25690affebea4298033244e88d18f2d5236d2a66fa4d2f0cb776ff37544187769cc
SHA5125c99bdf04d3210c4d0dcdfe3a0bab763a7f9c662038ac1caed29d3dfea245ebb7fd32448b127a7e02f65dc0161fadc65b25a1729165438cdb6b2c1781270576b
-
C:\Users\Admin\AppData\Local\Temp\8A4C.exeMD5
0cefed061e2a2241ecd302d7790a2f80
SHA15f119195af2db118c5fbac21634bea00f5d5b8da
SHA256014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983
SHA5127b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba
-
C:\Users\Admin\AppData\Local\Temp\8A4C.exeMD5
0cefed061e2a2241ecd302d7790a2f80
SHA15f119195af2db118c5fbac21634bea00f5d5b8da
SHA256014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983
SHA5127b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba
-
C:\Users\Admin\AppData\Local\Temp\96B1.exeMD5
c5b6dee0bdd57086d955bad03812b71f
SHA1122221b7a9fabf95349e00f00efbdc7ad4662a6d
SHA256b39c858766d31fba41aa2266a4e518446c87e9f724e1092d79a24f009a9ec2ef
SHA5124efe9eb6ac6d7c76289ae27213c3bff156dbb507430e053aa2a676664132f8a9a31ccc19f0da9ad3336e91246e74ff0a99eb8bd98023134f07be59ac92f8c849
-
C:\Users\Admin\AppData\Local\Temp\96B1.exeMD5
c5b6dee0bdd57086d955bad03812b71f
SHA1122221b7a9fabf95349e00f00efbdc7ad4662a6d
SHA256b39c858766d31fba41aa2266a4e518446c87e9f724e1092d79a24f009a9ec2ef
SHA5124efe9eb6ac6d7c76289ae27213c3bff156dbb507430e053aa2a676664132f8a9a31ccc19f0da9ad3336e91246e74ff0a99eb8bd98023134f07be59ac92f8c849
-
C:\Users\Admin\AppData\Local\Temp\98686542063830006056MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\98686542063830006056MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\BD84.exeMD5
65fd5caa0beaf2c6915e5b05004e5ba8
SHA14a1e5e5c188ef1e8a3e5bf7fa7db17f0307c6912
SHA256ef0d3b336aeef7f0a0aeb78ec08f1f20592d8006bcbe3fbb559e18aebcf060a3
SHA512c3dee0f304f45f274e28a737ac11506f99066abae57576f75c1b8151c0c8cee5c9e377ab2bc79929f5cf7f7f0f0b77947e657454daecd0e5fcea998df9c85d11
-
C:\Users\Admin\AppData\Local\Temp\BD84.exeMD5
65fd5caa0beaf2c6915e5b05004e5ba8
SHA14a1e5e5c188ef1e8a3e5bf7fa7db17f0307c6912
SHA256ef0d3b336aeef7f0a0aeb78ec08f1f20592d8006bcbe3fbb559e18aebcf060a3
SHA512c3dee0f304f45f274e28a737ac11506f99066abae57576f75c1b8151c0c8cee5c9e377ab2bc79929f5cf7f7f0f0b77947e657454daecd0e5fcea998df9c85d11
-
C:\Users\Admin\AppData\Local\Temp\C267.exeMD5
181295bfd785585c26ebbd580051cb13
SHA10f75a4d4f72c53787758fb3a0fa3cd1f72250b2b
SHA256fcaeb0a55f154d50f9367de832e87ff037a7ed8846ad5a89747b96d94e847649
SHA5124d792c061f5165986cb97ffdee7eb3ee26999da8f0bc55cee4752b5187430ed456100554dd4db6410a6e82c1b8855d93a775087c048cdfb8f62496458646702e
-
C:\Users\Admin\AppData\Local\Temp\C267.exeMD5
181295bfd785585c26ebbd580051cb13
SHA10f75a4d4f72c53787758fb3a0fa3cd1f72250b2b
SHA256fcaeb0a55f154d50f9367de832e87ff037a7ed8846ad5a89747b96d94e847649
SHA5124d792c061f5165986cb97ffdee7eb3ee26999da8f0bc55cee4752b5187430ed456100554dd4db6410a6e82c1b8855d93a775087c048cdfb8f62496458646702e
-
C:\Users\Admin\AppData\Local\Temp\DF37.exeMD5
2ef6fe31e93909b0fd17c05b0ed5d7d4
SHA12f7651624c0adb3ae8fda5fb6b5df42423bee38d
SHA256fc60164d3da978e1140d70085a511d9862c946b6a02e9dc4202c8155de14b682
SHA512c5e0771a1ada5ba3149d3c394c576006701ec86f14cb2a91c3b264a00e951fb6c829c22a6daf716ec763ea9c21bbc8ba58dc88131ebac7ca53833871348d409a
-
C:\Users\Admin\AppData\Local\Temp\DF37.exeMD5
2ef6fe31e93909b0fd17c05b0ed5d7d4
SHA12f7651624c0adb3ae8fda5fb6b5df42423bee38d
SHA256fc60164d3da978e1140d70085a511d9862c946b6a02e9dc4202c8155de14b682
SHA512c5e0771a1ada5ba3149d3c394c576006701ec86f14cb2a91c3b264a00e951fb6c829c22a6daf716ec763ea9c21bbc8ba58dc88131ebac7ca53833871348d409a
-
C:\Users\Admin\AppData\Local\Temp\E41A.exeMD5
fcf030085e86da948a7cca2076687a91
SHA1a9fd9e62e0e4714478dc9b06857f82a4ab0014d2
SHA25667539484b73f85bcedfb8c39d1591e6472546d037ec483a477a7273bae4cb6be
SHA512567ff3b17537573fde2c88265d830743525752f9fe70cc39316947d60a0f980096673bdcf228a30ff886ba52c97ae49d0771f3255ae6f4edfb7e03ce499afbee
-
C:\Users\Admin\AppData\Local\Temp\E41A.exeMD5
fcf030085e86da948a7cca2076687a91
SHA1a9fd9e62e0e4714478dc9b06857f82a4ab0014d2
SHA25667539484b73f85bcedfb8c39d1591e6472546d037ec483a477a7273bae4cb6be
SHA512567ff3b17537573fde2c88265d830743525752f9fe70cc39316947d60a0f980096673bdcf228a30ff886ba52c97ae49d0771f3255ae6f4edfb7e03ce499afbee
-
C:\Users\Admin\AppData\Local\Temp\uqywjhgn.exeMD5
2f3c524e1ba6de98ab7bda0fa88397dd
SHA11fa9982e65ac25357faa483ce285e0a4864f76e0
SHA256171fe2eddb010ae7427c254c66dcb9abdcd3daaf97a875192219680af3e51c51
SHA5129710e2805b4f41dd74d8a47804630bbb77f60534f2afba368630ecf813060762a5aee7695f492f1e688e0086f351100f90d18bca1cd53d2af0296f5b68918b9e
-
C:\Windows\SysWOW64\rdugblti\uqywjhgn.exeMD5
2f3c524e1ba6de98ab7bda0fa88397dd
SHA11fa9982e65ac25357faa483ce285e0a4864f76e0
SHA256171fe2eddb010ae7427c254c66dcb9abdcd3daaf97a875192219680af3e51c51
SHA5129710e2805b4f41dd74d8a47804630bbb77f60534f2afba368630ecf813060762a5aee7695f492f1e688e0086f351100f90d18bca1cd53d2af0296f5b68918b9e
-
memory/396-255-0x0000000000000000-mapping.dmp
-
memory/404-235-0x0000000000800000-0x0000000000815000-memory.dmpFilesize
84KB
-
memory/404-242-0x0000000000800000-0x0000000000815000-memory.dmpFilesize
84KB
-
memory/404-240-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/404-239-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/404-236-0x0000000000809A6B-mapping.dmp
-
memory/744-195-0x0000000000000000-mapping.dmp
-
memory/996-198-0x0000000000000000-mapping.dmp
-
memory/996-261-0x00000000001C0000-0x00000000001F8000-memory.dmpFilesize
224KB
-
memory/996-262-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1016-245-0x0000000000400000-0x0000000000824000-memory.dmpFilesize
4.1MB
-
memory/1016-244-0x0000000000870000-0x0000000000883000-memory.dmpFilesize
76KB
-
memory/1100-263-0x0000000000000000-mapping.dmp
-
memory/1100-266-0x00000000012C0000-0x0000000001305000-memory.dmpFilesize
276KB
-
memory/1424-257-0x0000000000000000-mapping.dmp
-
memory/1532-187-0x0000000000000000-mapping.dmp
-
memory/1532-194-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/1672-258-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/1672-247-0x0000000000000000-mapping.dmp
-
memory/1672-253-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/1796-202-0x0000000000000000-mapping.dmp
-
memory/1816-201-0x0000000000000000-mapping.dmp
-
memory/2088-196-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB
-
memory/2088-197-0x0000000000830000-0x00000000008DE000-memory.dmpFilesize
696KB
-
memory/2088-199-0x0000000000400000-0x0000000000824000-memory.dmpFilesize
4.1MB
-
memory/2088-190-0x0000000000000000-mapping.dmp
-
memory/2308-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2308-116-0x0000000000402F47-mapping.dmp
-
memory/2632-250-0x0000000000000000-mapping.dmp
-
memory/2632-251-0x0000000001240000-0x0000000001247000-memory.dmpFilesize
28KB
-
memory/2632-252-0x0000000001230000-0x000000000123C000-memory.dmpFilesize
48KB
-
memory/2676-148-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/2676-141-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/2676-185-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/2676-149-0x00000000707A0000-0x00000000707EB000-memory.dmpFilesize
300KB
-
memory/2676-178-0x00000000068F0000-0x00000000068F1000-memory.dmpFilesize
4KB
-
memory/2676-177-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/2676-176-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/2676-175-0x0000000005E40000-0x0000000005E41000-memory.dmpFilesize
4KB
-
memory/2676-174-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB
-
memory/2676-147-0x0000000073DF0000-0x0000000075138000-memory.dmpFilesize
19.3MB
-
memory/2676-146-0x0000000076C20000-0x00000000771A4000-memory.dmpFilesize
5.5MB
-
memory/2676-145-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/2676-144-0x0000000002F20000-0x0000000002F65000-memory.dmpFilesize
276KB
-
memory/2676-143-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2676-142-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/2676-130-0x0000000000000000-mapping.dmp
-
memory/2676-133-0x0000000000320000-0x0000000000389000-memory.dmpFilesize
420KB
-
memory/2676-134-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/2676-135-0x00000000769D0000-0x0000000076B92000-memory.dmpFilesize
1.8MB
-
memory/2676-186-0x0000000007AE0000-0x0000000007AE1000-memory.dmpFilesize
4KB
-
memory/2676-136-0x0000000075B20000-0x0000000075C11000-memory.dmpFilesize
964KB
-
memory/2676-140-0x0000000006090000-0x0000000006091000-memory.dmpFilesize
4KB
-
memory/2676-137-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/2676-139-0x0000000071D70000-0x0000000071DF0000-memory.dmpFilesize
512KB
-
memory/2776-208-0x0000000000000000-mapping.dmp
-
memory/2776-118-0x0000000000900000-0x0000000000A4A000-memory.dmpFilesize
1.3MB
-
memory/2776-117-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2836-234-0x0000000000000000-mapping.dmp
-
memory/2836-238-0x00000000009F0000-0x0000000000A5B000-memory.dmpFilesize
428KB
-
memory/2836-237-0x0000000000A60000-0x0000000000AD4000-memory.dmpFilesize
464KB
-
memory/3004-126-0x0000000002E40000-0x0000000002E56000-memory.dmpFilesize
88KB
-
memory/3004-119-0x0000000000F20000-0x0000000000F36000-memory.dmpFilesize
88KB
-
memory/3004-221-0x00000000056E0000-0x00000000056F6000-memory.dmpFilesize
88KB
-
memory/3004-179-0x0000000004810000-0x0000000004826000-memory.dmpFilesize
88KB
-
memory/3248-127-0x0000000000000000-mapping.dmp
-
memory/3248-173-0x0000000000820000-0x000000000096A000-memory.dmpFilesize
1.3MB
-
memory/3396-157-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/3396-153-0x0000000000370000-0x0000000000484000-memory.dmpFilesize
1.1MB
-
memory/3396-169-0x0000000003630000-0x0000000003631000-memory.dmpFilesize
4KB
-
memory/3396-168-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/3396-155-0x00000000769D0000-0x0000000076B92000-memory.dmpFilesize
1.8MB
-
memory/3396-156-0x0000000075B20000-0x0000000075C11000-memory.dmpFilesize
964KB
-
memory/3396-159-0x0000000071D70000-0x0000000071DF0000-memory.dmpFilesize
512KB
-
memory/3396-167-0x00000000707A0000-0x00000000707EB000-memory.dmpFilesize
300KB
-
memory/3396-165-0x0000000073DF0000-0x0000000075138000-memory.dmpFilesize
19.3MB
-
memory/3396-233-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/3396-154-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/3396-150-0x0000000000000000-mapping.dmp
-
memory/3396-164-0x0000000076C20000-0x00000000771A4000-memory.dmpFilesize
5.5MB
-
memory/3692-124-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3692-125-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3692-120-0x0000000000000000-mapping.dmp
-
memory/3764-214-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-222-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-225-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-216-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-226-0x0000000077300000-0x000000007748E000-memory.dmpFilesize
1.6MB
-
memory/3764-224-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-215-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-213-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-212-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-218-0x00000000769D0000-0x0000000076B92000-memory.dmpFilesize
1.8MB
-
memory/3764-227-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-209-0x0000000000000000-mapping.dmp
-
memory/3764-220-0x0000000075B20000-0x0000000075C11000-memory.dmpFilesize
964KB
-
memory/3764-217-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/3764-229-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-228-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-230-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-223-0x00000000000E0000-0x0000000000644000-memory.dmpFilesize
5.4MB
-
memory/3764-219-0x0000000000C60000-0x0000000000CA5000-memory.dmpFilesize
276KB
-
memory/3852-204-0x0000000000000000-mapping.dmp
-
memory/3852-241-0x00000000001E0000-0x00000000001FD000-memory.dmpFilesize
116KB
-
memory/3852-246-0x0000000000400000-0x0000000000834000-memory.dmpFilesize
4.2MB
-
memory/3852-243-0x0000000000940000-0x0000000000A8A000-memory.dmpFilesize
1.3MB
-
memory/3856-203-0x0000000000000000-mapping.dmp
-
memory/3988-256-0x0000000000000000-mapping.dmp
-
memory/4028-171-0x0000000000402F47-mapping.dmp