Analysis
-
max time kernel
158s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
26-01-2022 05:07
Static task
static1
Behavioral task
behavioral1
Sample
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe
Resource
win10v2004-en-20220112
General
-
Target
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe
-
Size
334KB
-
MD5
005e445db353075922c066d7a792f78f
-
SHA1
79aa6671076b491c0b016275161e6145b7a7a7c1
-
SHA256
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0
-
SHA512
d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1544 created 1120 1544 WerFault.exe explorer.exe PID 2664 created 2800 2664 WerFault.exe DllHost.exe PID 2656 created 1280 2656 WerFault.exe DllHost.exe PID 116 created 460 116 WerFault.exe DllHost.exe PID 204 created 3076 204 WerFault.exe DllHost.exe PID 1876 created 528 1876 WerFault.exe DllHost.exe -
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 1 IoCs
Processes:
TiWorker.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3516 1120 WerFault.exe explorer.exe 3108 2800 WerFault.exe DllHost.exe 3720 1280 WerFault.exe DllHost.exe 2556 460 WerFault.exe DllHost.exe 384 3076 WerFault.exe DllHost.exe 3828 528 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe -
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2340 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda00000000020000000000106600000001000020000000d25f3b77d4f48a4e1d5b70a315f4e9e4feed068f6fa7277b4788178f399c433b000000000e8000000002000020000000e875d4e6799a40a804d983d4257bf79a5db252269221ab9d17750be5aa49332b200000004145312ad5b7e3d388805a1f07ca03f60554212291c3dd5f5e131bb7fddda846400000005ca117681abd7d27fb3053151519377c77e60be5d392e1d85b29e375558256588617efbe18a88bee27e339f5ebbee37d835a8b95a85b11f656a27ca1ebbd65fd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda000000000200000000001066000000010000200000000b51f6b61d1d5df33ac490df6d938379bd84df004e7ee08bdfc93650ae662c69000000000e80000000020000200000007be8ab50a44f3b165eb736891773b4a3d7e0fbb06e91c06849d5d4ffeec423cb20000000ead6b5aa8a54d87f87752504c2648ad6893639a4c2055556a7336a1ef2cbcc83400000009b726a266a7bbfe400d8b6539714233d70635339e44002005f3e0117a482456bfe6b0d63b256be0749c07d01c223c07558aa8f8201621c465e25db1bbe473532 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "162635857" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "130135128" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30937715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0727a0c7312d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937715" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937715" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a5620c7312d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{32E5BC14-7E66-11EC-82D0-5ECADF14C037} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "130135128" iexplore.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exepid process 1240 e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe 1240 e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 2520 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2520 -
Suspicious behavior: MapViewOfSection 61 IoCs
Processes:
e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1240 e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe 2520 2520 2520 2520 2520 2520 3840 explorer.exe 3840 explorer.exe 2520 2520 3864 explorer.exe 3864 explorer.exe 2520 2520 4008 explorer.exe 4008 explorer.exe 2520 2520 2660 explorer.exe 2660 explorer.exe 2520 2520 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2308 explorer.exe 2520 2520 3140 explorer.exe 3140 explorer.exe 2308 explorer.exe 2308 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe 3140 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe Token: SeProfSingleProcessPrivilege 3780 WMIC.exe Token: SeIncBasePriorityPrivilege 3780 WMIC.exe Token: SeCreatePagefilePrivilege 3780 WMIC.exe Token: SeBackupPrivilege 3780 WMIC.exe Token: SeRestorePrivilege 3780 WMIC.exe Token: SeShutdownPrivilege 3780 WMIC.exe Token: SeDebugPrivilege 3780 WMIC.exe Token: SeSystemEnvironmentPrivilege 3780 WMIC.exe Token: SeRemoteShutdownPrivilege 3780 WMIC.exe Token: SeUndockPrivilege 3780 WMIC.exe Token: SeManageVolumePrivilege 3780 WMIC.exe Token: 33 3780 WMIC.exe Token: 34 3780 WMIC.exe Token: 35 3780 WMIC.exe Token: 36 3780 WMIC.exe Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe Token: SeProfSingleProcessPrivilege 3780 WMIC.exe Token: SeIncBasePriorityPrivilege 3780 WMIC.exe Token: SeCreatePagefilePrivilege 3780 WMIC.exe Token: SeBackupPrivilege 3780 WMIC.exe Token: SeRestorePrivilege 3780 WMIC.exe Token: SeShutdownPrivilege 3780 WMIC.exe Token: SeDebugPrivilege 3780 WMIC.exe Token: SeSystemEnvironmentPrivilege 3780 WMIC.exe Token: SeRemoteShutdownPrivilege 3780 WMIC.exe Token: SeUndockPrivilege 3780 WMIC.exe Token: SeManageVolumePrivilege 3780 WMIC.exe Token: 33 3780 WMIC.exe Token: 34 3780 WMIC.exe Token: 35 3780 WMIC.exe Token: 36 3780 WMIC.exe Token: SeIncreaseQuotaPrivilege 3104 WMIC.exe Token: SeSecurityPrivilege 3104 WMIC.exe Token: SeTakeOwnershipPrivilege 3104 WMIC.exe Token: SeLoadDriverPrivilege 3104 WMIC.exe Token: SeSystemProfilePrivilege 3104 WMIC.exe Token: SeSystemtimePrivilege 3104 WMIC.exe Token: SeProfSingleProcessPrivilege 3104 WMIC.exe Token: SeIncBasePriorityPrivilege 3104 WMIC.exe Token: SeCreatePagefilePrivilege 3104 WMIC.exe Token: SeBackupPrivilege 3104 WMIC.exe Token: SeRestorePrivilege 3104 WMIC.exe Token: SeShutdownPrivilege 3104 WMIC.exe Token: SeDebugPrivilege 3104 WMIC.exe Token: SeSystemEnvironmentPrivilege 3104 WMIC.exe Token: SeRemoteShutdownPrivilege 3104 WMIC.exe Token: SeUndockPrivilege 3104 WMIC.exe Token: SeManageVolumePrivilege 3104 WMIC.exe Token: 33 3104 WMIC.exe Token: 34 3104 WMIC.exe Token: 35 3104 WMIC.exe Token: 36 3104 WMIC.exe Token: SeIncreaseQuotaPrivilege 3104 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2236 iexplore.exe 2236 iexplore.exe 3916 IEXPLORE.EXE 3916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeiexplore.exeexplorer.exeWerFault.exeexplorer.exedescription pid process target process PID 2520 wrote to memory of 3176 2520 cmd.exe PID 2520 wrote to memory of 3176 2520 cmd.exe PID 3176 wrote to memory of 3780 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3780 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3104 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3104 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 952 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 952 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3196 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3196 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1252 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1252 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 2304 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 2304 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 796 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 796 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 4056 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 4056 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3432 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3432 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1168 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1168 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3440 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3440 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3284 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3284 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1608 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 1608 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3668 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 3668 3176 cmd.exe WMIC.exe PID 3176 wrote to memory of 2340 3176 cmd.exe ipconfig.exe PID 3176 wrote to memory of 2340 3176 cmd.exe ipconfig.exe PID 3176 wrote to memory of 3676 3176 cmd.exe ROUTE.EXE PID 3176 wrote to memory of 3676 3176 cmd.exe ROUTE.EXE PID 3176 wrote to memory of 3076 3176 cmd.exe netsh.exe PID 3176 wrote to memory of 3076 3176 cmd.exe netsh.exe PID 3176 wrote to memory of 1344 3176 cmd.exe systeminfo.exe PID 3176 wrote to memory of 1344 3176 cmd.exe systeminfo.exe PID 2236 wrote to memory of 3916 2236 iexplore.exe IEXPLORE.EXE PID 2236 wrote to memory of 3916 2236 iexplore.exe IEXPLORE.EXE PID 2236 wrote to memory of 3916 2236 iexplore.exe IEXPLORE.EXE PID 2520 wrote to memory of 1120 2520 explorer.exe PID 2520 wrote to memory of 1120 2520 explorer.exe PID 2520 wrote to memory of 1120 2520 explorer.exe PID 2520 wrote to memory of 1120 2520 explorer.exe PID 2520 wrote to memory of 864 2520 explorer.exe PID 2520 wrote to memory of 864 2520 explorer.exe PID 2520 wrote to memory of 864 2520 explorer.exe PID 2520 wrote to memory of 3840 2520 explorer.exe PID 2520 wrote to memory of 3840 2520 explorer.exe PID 2520 wrote to memory of 3840 2520 explorer.exe PID 2520 wrote to memory of 3840 2520 explorer.exe PID 3840 wrote to memory of 3916 3840 explorer.exe IEXPLORE.EXE PID 3840 wrote to memory of 3916 3840 explorer.exe IEXPLORE.EXE PID 1544 wrote to memory of 1120 1544 WerFault.exe explorer.exe PID 1544 wrote to memory of 1120 1544 WerFault.exe explorer.exe PID 2520 wrote to memory of 3864 2520 explorer.exe PID 2520 wrote to memory of 3864 2520 explorer.exe PID 2520 wrote to memory of 3864 2520 explorer.exe PID 3864 wrote to memory of 2236 3864 explorer.exe iexplore.exe PID 3864 wrote to memory of 2236 3864 explorer.exe iexplore.exe PID 2520 wrote to memory of 4008 2520 explorer.exe PID 2520 wrote to memory of 4008 2520 explorer.exe PID 2520 wrote to memory of 4008 2520 explorer.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2800 -s 9642⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Temp\e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe"C:\Users\Admin\AppData\Local\Temp\e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 8363d1e133f559253abfb6f2ba463f87 omc2//L2GE+ip2xL58nQkA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 8762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1120 -ip 11201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 2800 -ip 28001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1280 -s 8322⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 1280 -ip 12801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 460 -s 7962⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 460 -ip 4601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3076 -s 8042⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 3076 -ip 30761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 528 -s 8042⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 528 -ip 5281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-382-0x000001EC69010000-0x000001EC69011000-memory.dmpFilesize
4KB
-
memory/576-590-0x000001EC69010000-0x000001EC69011000-memory.dmpFilesize
4KB
-
memory/864-137-0x0000000000360000-0x0000000000367000-memory.dmpFilesize
28KB
-
memory/864-138-0x0000000000350000-0x000000000035C000-memory.dmpFilesize
48KB
-
memory/1120-136-0x0000000000180000-0x00000000001EB000-memory.dmpFilesize
428KB
-
memory/1120-135-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/1240-130-0x00000000006A0000-0x00000000006CB000-memory.dmpFilesize
172KB
-
memory/1240-132-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1240-131-0x00000000005C0000-0x00000000005C9000-memory.dmpFilesize
36KB
-
memory/2296-153-0x000001F3AC7D0000-0x000001F3AC7D1000-memory.dmpFilesize
4KB
-
memory/2308-148-0x00000000001F0000-0x00000000001FB000-memory.dmpFilesize
44KB
-
memory/2308-147-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2320-156-0x0000023857160000-0x0000023857161000-memory.dmpFilesize
4KB
-
memory/2368-157-0x000001B0D63D0000-0x000001B0D63D1000-memory.dmpFilesize
4KB
-
memory/2520-134-0x0000000001330000-0x000000000133F000-memory.dmpFilesize
60KB
-
memory/2520-133-0x0000000001390000-0x00000000013A6000-memory.dmpFilesize
88KB
-
memory/2612-158-0x0000019E3DA00000-0x0000019E3DA01000-memory.dmpFilesize
4KB
-
memory/2660-146-0x0000000001090000-0x000000000109C000-memory.dmpFilesize
48KB
-
memory/2660-145-0x00000000010A0000-0x00000000010A6000-memory.dmpFilesize
24KB
-
memory/2908-159-0x000002AD98970000-0x000002AD98971000-memory.dmpFilesize
4KB
-
memory/2972-371-0x000002699B880000-0x000002699B881000-memory.dmpFilesize
4KB
-
memory/3120-150-0x0000000005340000-0x000000000534B000-memory.dmpFilesize
44KB
-
memory/3120-149-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3140-151-0x0000000000B40000-0x0000000000B47000-memory.dmpFilesize
28KB
-
memory/3140-152-0x0000000000B30000-0x0000000000B3D000-memory.dmpFilesize
52KB
-
memory/3236-381-0x0000021BD08F0000-0x0000021BD08F1000-memory.dmpFilesize
4KB
-
memory/3516-154-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3516-155-0x0000000004EC0000-0x0000000004ECB000-memory.dmpFilesize
44KB
-
memory/3840-140-0x0000000002A50000-0x0000000002A5B000-memory.dmpFilesize
44KB
-
memory/3840-139-0x0000000002A60000-0x0000000002A67000-memory.dmpFilesize
28KB
-
memory/3864-142-0x00000000005A0000-0x00000000005AE000-memory.dmpFilesize
56KB
-
memory/3864-141-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/4008-144-0x0000000002B40000-0x0000000002B49000-memory.dmpFilesize
36KB
-
memory/4008-143-0x0000000002B50000-0x0000000002B55000-memory.dmpFilesize
20KB