Analysis
-
max time kernel
1763s -
max time network
1708s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 20:10
Static task
static1
Behavioral task
behavioral1
Sample
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe
Resource
win10v2004-20220414-en
General
-
Target
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe
-
Size
1.3MB
-
MD5
03f39d4df6508064da95ed5a273a6979
-
SHA1
60cb1fa320b0d8ac4082f8af7bf59e54de6b9ccb
-
SHA256
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33
-
SHA512
89212c00bfdc1addfa063d1786c96c3f69d932cdd678f9be3be58dfb89ed571417105ad8034b7ad88d4801f35755a847961f8ff6f1e91c26bf372d8be4da485c
Malware Config
Signatures
-
Allows Chrome notifications for new domains 1 TTPs 8 IoCs
Processes:
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls\1 = "https://[*.]nineteducer.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome\NotificationsAllowedForUrls\1 = "https://[*.]nineteducer.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls\2 = "https://[*.]estilysee.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome\NotificationsAllowedForUrls\2 = "https://[*.]estilysee.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls\3 = "https://[*.]stimafigu.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome\NotificationsAllowedForUrls\3 = "https://[*.]stimafigu.info" 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome\NotificationsAllowedForUrls 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe -
Executes dropped EXE 2 IoCs
Processes:
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeWaterMark.exepid process 4180 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe 1664 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4180-135-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4180-136-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4180-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1664-148-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1664-206-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1664-207-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1664-208-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 5 IoCs
Processes:
setup.exe37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cd0422c7-5ad0-468b-a52a-5340e7160d3f.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220705201052.pma setup.exe File opened for modification C:\Program Files (x86)\Microsoft\px8590.tmp 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3528 2472 WerFault.exe svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{83BB82B5-FC9E-11EC-AD90-7E149D876A3C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970027" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30970027" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1482297935" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970027" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363816807" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1520364612" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1482141057" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
WaterMark.exe37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 1664 WaterMark.exe 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe 1144 msedge.exe 1144 msedge.exe 3428 msedge.exe 3428 msedge.exe 3664 identity_helper.exe 3664 identity_helper.exe 5612 msedge.exe 5612 msedge.exe 5612 msedge.exe 5612 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 1664 WaterMark.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exemsedge.exepid process 1780 iexplore.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1780 iexplore.exe 1780 iexplore.exe 220 IEXPLORE.EXE 220 IEXPLORE.EXE 220 IEXPLORE.EXE 220 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeWaterMark.exepid process 4180 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe 1664 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeWaterMark.exeiexplore.exemsedge.exedescription pid process target process PID 4564 wrote to memory of 4180 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe PID 4564 wrote to memory of 4180 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe PID 4564 wrote to memory of 4180 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe PID 4180 wrote to memory of 1664 4180 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe WaterMark.exe PID 4180 wrote to memory of 1664 4180 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe WaterMark.exe PID 4180 wrote to memory of 1664 4180 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe WaterMark.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 2472 1664 WaterMark.exe svchost.exe PID 1664 wrote to memory of 4420 1664 WaterMark.exe iexplore.exe PID 1664 wrote to memory of 4420 1664 WaterMark.exe iexplore.exe PID 1664 wrote to memory of 1780 1664 WaterMark.exe iexplore.exe PID 1664 wrote to memory of 1780 1664 WaterMark.exe iexplore.exe PID 1780 wrote to memory of 220 1780 iexplore.exe IEXPLORE.EXE PID 1780 wrote to memory of 220 1780 iexplore.exe IEXPLORE.EXE PID 1780 wrote to memory of 220 1780 iexplore.exe IEXPLORE.EXE PID 4564 wrote to memory of 3428 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe msedge.exe PID 4564 wrote to memory of 3428 4564 37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe msedge.exe PID 3428 wrote to memory of 4900 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 4900 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe PID 3428 wrote to memory of 2096 3428 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe"C:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33.exe"1⤵
- Allows Chrome notifications for new domains
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeC:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nineteducer.info/?tag_id=715349&sub_id1=59&sub_id2=E8A61F40-9792-4601-B496-6A4BAD8F00C2&cookie_id=2c7a2658-1166-4e8e-b7f6-c01b4ff97801&lp=blank&tb=redirect&allb=redirect&ob=redirect&href=https://estilysee.info/?tag_id=715349%26sub_id1=59%26sub_id2=E8A61F40-9792-4601-B496-6A4BAD8F00C2%26cookie_id=2c7a2658-1166-4e8e-b7f6-c01b4ff97801%26lp=blank%26tb=redirect%26allb=redirect%26ob=redirect%26href=https://stimafigu.info/?tag_id=715349%2526sub_id1=59%2526sub_id2=E8A61F40-9792-4601-B496-6A4BAD8F00C2%2526cookie_id=2c7a2658-1166-4e8e-b7f6-c01b4ff97801%2526lp=blank%2526tb=redirect%2526allb=redirect%2526ob=redirect2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb565a46f8,0x7ffb565a4708,0x7ffb565a47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4492 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5808 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0xdc,0xe0,0x104,0xe4,0x7ff7b52c5460,0x7ff7b52c5470,0x7ff7b52c54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11666736450029314216,8892830026993785446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2472 -ip 24721⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
184KB
MD5d059e448bae51f521010cbce8f23643a
SHA174925d1dc5b0da8ffa87c694a1fef4e8a9697ec0
SHA256c3dc9ae1a07d82a0f41a54d54eea09dfd4a0e12baeaedb278ce207c59ae05655
SHA5127e8fa21ec13d787b1655a1ef794dd812f2f607508af6ba006344a450dc4515d70bd4a338619bc49861583acfbf693c456cc23179950aac02dd41aaf1eeb7b64e
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
184KB
MD5d059e448bae51f521010cbce8f23643a
SHA174925d1dc5b0da8ffa87c694a1fef4e8a9697ec0
SHA256c3dc9ae1a07d82a0f41a54d54eea09dfd4a0e12baeaedb278ce207c59ae05655
SHA5127e8fa21ec13d787b1655a1ef794dd812f2f607508af6ba006344a450dc4515d70bd4a338619bc49861583acfbf693c456cc23179950aac02dd41aaf1eeb7b64e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63Filesize
1KB
MD58e083387851379fefd2338a72d6c081d
SHA138e15888f3fa38abf2f1f355312e7f277dcb606d
SHA25659c169f61ddc880c986f13c85159e6eb666c92a1c8b19391976bef901c7b0a32
SHA5128ebb5f815a2a41141489799654c7935f0982795618368a5bfc402db2de7f9b84ca7a5534e63d4e34078de8f264da61cfefe5f31e4f6feee6743dc5d6e09a1b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5831399867695e8e2e44f24eb7b73313c
SHA1403e123384b3ba656e3e1cd3815dad4a1664b224
SHA256833cb46e5f4be363e955f5f3fcd655f1e610d5e33b0ae6c83a714ebfc9723f8c
SHA51217e637f6508aaa1589cde6e4d9e230b6dc02256c2bf1d0dddeea7958496b57582944e1d9fd17b323573f3214f73c99dbf4455cb7ba00075605a498749725ff16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63Filesize
434B
MD59574595d8de8ae68b7a5067cb4c21457
SHA13fd46919c7244396bdcb98dd36c44ef6e24ca89c
SHA25676bc8ab86ab670d0cf8c25526bc51661555be9a6d0d05410513fa26b76b1eb4e
SHA512b1355613b7eac942302fad73704eef63f06f81f70ff32bf1972fc709540888bca6e442cab4e042b5b5e4446f5eed36f37336069ad43dc98fe1c0fb572f4926b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5ff2fe82c8fcd235ab550a2a4fe14189b
SHA166d378754fd1ac192b8dc9b6b867c9e5a3dfa4e4
SHA25610cc910b72982395d4e0633b50310994887338db2d269dbedfd8e93135c4633c
SHA512a29f687859d4864d6c6ad5a7b5e178fa49e8d84bdd35c21ba309177ceca6b93ff2f7acb152aa61d852066783196da835cb06169082ea9779dcdadbbdb11ea8e2
-
C:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeFilesize
184KB
MD5d059e448bae51f521010cbce8f23643a
SHA174925d1dc5b0da8ffa87c694a1fef4e8a9697ec0
SHA256c3dc9ae1a07d82a0f41a54d54eea09dfd4a0e12baeaedb278ce207c59ae05655
SHA5127e8fa21ec13d787b1655a1ef794dd812f2f607508af6ba006344a450dc4515d70bd4a338619bc49861583acfbf693c456cc23179950aac02dd41aaf1eeb7b64e
-
C:\Users\Admin\AppData\Local\Temp\37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33mgr.exeFilesize
184KB
MD5d059e448bae51f521010cbce8f23643a
SHA174925d1dc5b0da8ffa87c694a1fef4e8a9697ec0
SHA256c3dc9ae1a07d82a0f41a54d54eea09dfd4a0e12baeaedb278ce207c59ae05655
SHA5127e8fa21ec13d787b1655a1ef794dd812f2f607508af6ba006344a450dc4515d70bd4a338619bc49861583acfbf693c456cc23179950aac02dd41aaf1eeb7b64e
-
\??\pipe\LOCAL\crashpad_3428_KPSKVMDMPKSYPNBZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/816-222-0x0000000000000000-mapping.dmp
-
memory/1016-244-0x0000000000000000-mapping.dmp
-
memory/1144-220-0x0000000000000000-mapping.dmp
-
memory/1212-241-0x0000000000000000-mapping.dmp
-
memory/1664-206-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1664-137-0x0000000000000000-mapping.dmp
-
memory/1664-207-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1664-148-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1664-208-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2096-219-0x0000000000000000-mapping.dmp
-
memory/2188-235-0x0000000000000000-mapping.dmp
-
memory/2472-146-0x0000000000000000-mapping.dmp
-
memory/2568-257-0x0000000000000000-mapping.dmp
-
memory/2588-240-0x0000000000000000-mapping.dmp
-
memory/3068-239-0x0000000000000000-mapping.dmp
-
memory/3428-215-0x0000000000000000-mapping.dmp
-
memory/3664-242-0x0000000000000000-mapping.dmp
-
memory/4180-135-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4180-136-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4180-130-0x0000000000000000-mapping.dmp
-
memory/4180-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4344-227-0x0000000000000000-mapping.dmp
-
memory/4556-233-0x0000000000000000-mapping.dmp
-
memory/4560-237-0x0000000000000000-mapping.dmp
-
memory/4564-188-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-205-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-172-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-173-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-174-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-175-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-176-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-177-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-179-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-178-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-180-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-181-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-183-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-184-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-182-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-186-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-187-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-171-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-185-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-190-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-189-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-191-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-192-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-193-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-194-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-196-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-197-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-198-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-195-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-199-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-200-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-201-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-202-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-203-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-204-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-155-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-170-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-169-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-168-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-209-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-211-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-213-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-167-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-147-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-164-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-166-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-165-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-163-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-149-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-162-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-150-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-151-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-161-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-160-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-159-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-158-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-157-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-156-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-154-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-152-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4564-153-0x00000000101C0000-0x000000001030E000-memory.dmpFilesize
1.3MB
-
memory/4728-231-0x0000000000000000-mapping.dmp
-
memory/4788-229-0x0000000000000000-mapping.dmp
-
memory/4900-217-0x0000000000000000-mapping.dmp
-
memory/5044-255-0x0000000000000000-mapping.dmp
-
memory/5076-225-0x0000000000000000-mapping.dmp
-
memory/5336-248-0x0000000000000000-mapping.dmp
-
memory/5504-252-0x0000000000000000-mapping.dmp
-
memory/5612-253-0x0000000000000000-mapping.dmp