Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 13:43
Static task
static1
General
-
Target
AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe
-
Size
2.6MB
-
MD5
b81a72714c586f9b634b059b73da8a3a
-
SHA1
2aad87da256f1b26c40e1243f4ec7ea15c2f4690
-
SHA256
ab479d019576efd4dd391e0bf3fc1bedb10367e1ece7157d609a283873a43645
-
SHA512
07f076ccf6b4174a4c9848795dcd86b59d4f2a6b7ab2827d25ac8b2808dad47c2ca20bf6d712c1b8c6fa17427fbf0648c5e24f13fc066d22c8e3f5752125c56c
Malware Config
Extracted
vidar
39.7
933
https://shpak125.tumblr.com/
-
profile_id
933
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1244 3136 rUNdlL32.eXe -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2020-217-0x0000000004730000-0x00000000047CD000-memory.dmp family_vidar behavioral2/memory/2020-218-0x0000000000400000-0x0000000002BD7000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dll aspack_v212_v242 -
Executes dropped EXE 10 IoCs
Processes:
setup_installer.exesetup_install.exesahiba_1.exesahiba_4.exesahiba_3.exesahiba_2.exesahiba_5.exesahiba_6.exesahiba_7.exesahiba_1.exepid process 944 setup_installer.exe 3348 setup_install.exe 3288 sahiba_1.exe 1836 sahiba_4.exe 2020 sahiba_3.exe 4212 sahiba_2.exe 396 sahiba_5.exe 1888 sahiba_6.exe 2060 sahiba_7.exe 4544 sahiba_1.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sahiba_1.exeAB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exesetup_installer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation sahiba_1.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation setup_installer.exe -
Loads dropped DLL 9 IoCs
Processes:
setup_install.exesahiba_2.exerundll32.exepid process 3348 setup_install.exe 3348 setup_install.exe 3348 setup_install.exe 3348 setup_install.exe 3348 setup_install.exe 3348 setup_install.exe 3348 setup_install.exe 4212 sahiba_2.exe 2380 rundll32.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ipinfo.io 4 ipinfo.io -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{898D2EF9-745D-425C-9276-FD9B5EB0D951}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{71151BD8-70BB-4DFB-83EC-0227CC31C118}.catalogItem svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4536 3348 WerFault.exe setup_install.exe 204 2380 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exesahiba_2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe -
Modifies data under HKEY_USERS 36 IoCs
Processes:
dwm.exedwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 4212 sahiba_2.exe 4212 sahiba_2.exe 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sahiba_2.exepid process 4212 sahiba_2.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
sahiba_4.exesahiba_5.exedwm.exedwm.exedescription pid process Token: SeDebugPrivilege 1836 sahiba_4.exe Token: SeDebugPrivilege 396 sahiba_5.exe Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeCreateGlobalPrivilege 1192 dwm.exe Token: SeChangeNotifyPrivilege 1192 dwm.exe Token: 33 1192 dwm.exe Token: SeIncBasePriorityPrivilege 1192 dwm.exe Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeCreateGlobalPrivilege 1016 dwm.exe Token: SeChangeNotifyPrivilege 1016 dwm.exe Token: 33 1016 dwm.exe Token: SeIncBasePriorityPrivilege 1016 dwm.exe Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 Token: SeShutdownPrivilege 768 Token: SeCreatePagefilePrivilege 768 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
pid process 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
pid process 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 768 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_1.exerUNdlL32.eXedescription pid process target process PID 3108 wrote to memory of 944 3108 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 3108 wrote to memory of 944 3108 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 3108 wrote to memory of 944 3108 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 944 wrote to memory of 3348 944 setup_installer.exe setup_install.exe PID 944 wrote to memory of 3348 944 setup_installer.exe setup_install.exe PID 944 wrote to memory of 3348 944 setup_installer.exe setup_install.exe PID 3348 wrote to memory of 3156 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3156 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3156 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 5000 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 5000 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 5000 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 4984 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 4984 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 4984 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 816 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 816 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 816 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3516 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3516 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3516 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3676 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3676 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 3676 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 904 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 904 3348 setup_install.exe cmd.exe PID 3348 wrote to memory of 904 3348 setup_install.exe cmd.exe PID 3156 wrote to memory of 3288 3156 cmd.exe sahiba_1.exe PID 3156 wrote to memory of 3288 3156 cmd.exe sahiba_1.exe PID 3156 wrote to memory of 3288 3156 cmd.exe sahiba_1.exe PID 816 wrote to memory of 1836 816 cmd.exe sahiba_4.exe PID 816 wrote to memory of 1836 816 cmd.exe sahiba_4.exe PID 4984 wrote to memory of 2020 4984 cmd.exe sahiba_3.exe PID 4984 wrote to memory of 2020 4984 cmd.exe sahiba_3.exe PID 4984 wrote to memory of 2020 4984 cmd.exe sahiba_3.exe PID 5000 wrote to memory of 4212 5000 cmd.exe sahiba_2.exe PID 5000 wrote to memory of 4212 5000 cmd.exe sahiba_2.exe PID 5000 wrote to memory of 4212 5000 cmd.exe sahiba_2.exe PID 3516 wrote to memory of 396 3516 cmd.exe sahiba_5.exe PID 3516 wrote to memory of 396 3516 cmd.exe sahiba_5.exe PID 3676 wrote to memory of 1888 3676 cmd.exe sahiba_6.exe PID 3676 wrote to memory of 1888 3676 cmd.exe sahiba_6.exe PID 3676 wrote to memory of 1888 3676 cmd.exe sahiba_6.exe PID 904 wrote to memory of 2060 904 cmd.exe sahiba_7.exe PID 904 wrote to memory of 2060 904 cmd.exe sahiba_7.exe PID 3288 wrote to memory of 4544 3288 sahiba_1.exe sahiba_1.exe PID 3288 wrote to memory of 4544 3288 sahiba_1.exe sahiba_1.exe PID 3288 wrote to memory of 4544 3288 sahiba_1.exe sahiba_1.exe PID 1244 wrote to memory of 2380 1244 rUNdlL32.eXe rundll32.exe PID 1244 wrote to memory of 2380 1244 rUNdlL32.eXe rundll32.exe PID 1244 wrote to memory of 2380 1244 rUNdlL32.eXe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe"C:\Users\Admin\AppData\Local\Temp\AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.exesahiba_1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_2.exesahiba_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_3.exesahiba_3.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_4.exesahiba_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_5.exesahiba_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_6.exesahiba_6.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_7.exesahiba_7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 5604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3348 -ip 33481⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 23801⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_1.txtFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_2.exeFilesize
222KB
MD5bab311e39c6dc75106c93e7d9571d7f1
SHA1d6fb876a06eb79281c21df7894fd957747c7c83b
SHA256e27c4b45b60d39cc2c66ca3e5fe2c095e8fc6bc6fcdeac26758f3cbb5f604821
SHA512f8076fc400d0c9f91e63041c3e7aaad0b19c29643f6201acae8998fcca2579df6e494f5212273eea16c13685cf774e69dda06fad78fd5210563df6a0d6b18ba1
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_2.txtFilesize
222KB
MD5bab311e39c6dc75106c93e7d9571d7f1
SHA1d6fb876a06eb79281c21df7894fd957747c7c83b
SHA256e27c4b45b60d39cc2c66ca3e5fe2c095e8fc6bc6fcdeac26758f3cbb5f604821
SHA512f8076fc400d0c9f91e63041c3e7aaad0b19c29643f6201acae8998fcca2579df6e494f5212273eea16c13685cf774e69dda06fad78fd5210563df6a0d6b18ba1
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_3.exeFilesize
588KB
MD56535e592ad1f85965569a8a19a45d842
SHA145fec86cc8bf1b64425d8ad4c1d12f16e8306bfd
SHA25617353e7514997fb0dd0e5f93aa34950ba17c26f650b38cbaf0c83cc093de941a
SHA51276d83e203c9b3ae865ce5125de98c85c27472b3c96baa8c84a9c573bcc8d4254ee1d4aaab175b6c11b5c869f7b97496b2ac8cbe244310bec6d304b78e354567c
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_3.txtFilesize
588KB
MD56535e592ad1f85965569a8a19a45d842
SHA145fec86cc8bf1b64425d8ad4c1d12f16e8306bfd
SHA25617353e7514997fb0dd0e5f93aa34950ba17c26f650b38cbaf0c83cc093de941a
SHA51276d83e203c9b3ae865ce5125de98c85c27472b3c96baa8c84a9c573bcc8d4254ee1d4aaab175b6c11b5c869f7b97496b2ac8cbe244310bec6d304b78e354567c
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_4.exeFilesize
8KB
MD5aa76e329fd4fc560c0f8f6b2f224d3da
SHA1bbbd3c4843bed7d90d7d3c5ce62c6e47639f8a14
SHA256dd5ac4469562c4d32e10983c14285e3c33849267cbf4c198d0427b21c56c49b2
SHA512d79753c703dc0bc34c56e1d9afcf47c5bbaad37527339b95c7e9d7f7ab17ee67320f254575049b622bc4a8ef572d526b13f01a8a707d4c57da3599c548c83934
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_4.txtFilesize
8KB
MD5aa76e329fd4fc560c0f8f6b2f224d3da
SHA1bbbd3c4843bed7d90d7d3c5ce62c6e47639f8a14
SHA256dd5ac4469562c4d32e10983c14285e3c33849267cbf4c198d0427b21c56c49b2
SHA512d79753c703dc0bc34c56e1d9afcf47c5bbaad37527339b95c7e9d7f7ab17ee67320f254575049b622bc4a8ef572d526b13f01a8a707d4c57da3599c548c83934
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_5.exeFilesize
213KB
MD51cc35bf07b551ce45921ae41602ec87d
SHA15eca79da173ad9912d669d85133561501976c12c
SHA2561371046b187faec8708e3732fc760515a7b96236c62094598340b1dc6331ac05
SHA512852134d0f6e4bbb2930225655068a468d49c7b980f604ef31ce308abc4534c3fed4086adf93e8df9287de6ec9f3734c7468ef5c6f436f08cc7112a30e816afc9
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_5.txtFilesize
213KB
MD51cc35bf07b551ce45921ae41602ec87d
SHA15eca79da173ad9912d669d85133561501976c12c
SHA2561371046b187faec8708e3732fc760515a7b96236c62094598340b1dc6331ac05
SHA512852134d0f6e4bbb2930225655068a468d49c7b980f604ef31ce308abc4534c3fed4086adf93e8df9287de6ec9f3734c7468ef5c6f436f08cc7112a30e816afc9
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_6.exeFilesize
1.0MB
MD5e44b6cb9e7111de178fbabf3ac1cba76
SHA1b15d8d52864a548c42a331a574828824a65763ff
SHA256c74894fe98864ade516c9e54f2258a23ed451feadfa2de53a7c626385b549b22
SHA51224129e1de024d61bcc23654450f416307be3e7911de2baced47476e02cd7df737ce012f379eb0ea5d84367113619f53d6a80971ccc652a569d6b494150bbb6bf
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_6.txtFilesize
1.0MB
MD5e44b6cb9e7111de178fbabf3ac1cba76
SHA1b15d8d52864a548c42a331a574828824a65763ff
SHA256c74894fe98864ade516c9e54f2258a23ed451feadfa2de53a7c626385b549b22
SHA51224129e1de024d61bcc23654450f416307be3e7911de2baced47476e02cd7df737ce012f379eb0ea5d84367113619f53d6a80971ccc652a569d6b494150bbb6bf
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_7.exeFilesize
244KB
MD50bc56e17cb974ddd06782939dcee2606
SHA1459f61b929c5925327eaa8495bf401cac9e2814f
SHA25676ef9d99c7e37d132f6803ec46f8e2663b1cc282a5d2022946f1598965673fa1
SHA512d260597ac09d2e6109fdbf7e5ca5817b73f3ed690529da067d2dbcde8d35959018837beb3ea7183f6f4ce52b911996d07f0b9712274021cc20bfbcc2c5e7fc1e
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\sahiba_7.txtFilesize
244KB
MD50bc56e17cb974ddd06782939dcee2606
SHA1459f61b929c5925327eaa8495bf401cac9e2814f
SHA25676ef9d99c7e37d132f6803ec46f8e2663b1cc282a5d2022946f1598965673fa1
SHA512d260597ac09d2e6109fdbf7e5ca5817b73f3ed690529da067d2dbcde8d35959018837beb3ea7183f6f4ce52b911996d07f0b9712274021cc20bfbcc2c5e7fc1e
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exeFilesize
287KB
MD5b9165f937e3873eb97693ab2c201ffbd
SHA1beb46f3fd71a24a74d9f29647ce2cdacf74060e7
SHA2568c926f7a08b94ddae207573185c512685c2a0c84ec2ee8a086baa51a508a9c74
SHA5127564293a6e609d8ac2c1782790b45441ce5da52260762ae2d5c794836c20aa521facae87f61b50bc98290b177bfed0567b97a83e9519806017a9ee575a2c216b
-
C:\Users\Admin\AppData\Local\Temp\7zS0B3B0CB6\setup_install.exeFilesize
287KB
MD5b9165f937e3873eb97693ab2c201ffbd
SHA1beb46f3fd71a24a74d9f29647ce2cdacf74060e7
SHA2568c926f7a08b94ddae207573185c512685c2a0c84ec2ee8a086baa51a508a9c74
SHA5127564293a6e609d8ac2c1782790b45441ce5da52260762ae2d5c794836c20aa521facae87f61b50bc98290b177bfed0567b97a83e9519806017a9ee575a2c216b
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.6MB
MD504e682e306c4a8720a7aba6ff54a991a
SHA130d43db52ea51648e37b736bcdf3f46099650b6d
SHA256a46ea98ad0ea5abc3bf267a93c0af04c785ffe3811154b1670b9661e264d8aa2
SHA5124def0bd15ddee8f1dc91e0fb3a76928325f29ed51711bec672d2dc1ada396b3c848cdc3b24bcdf620edf8dc8474b744c12362091425d70d0521ba934aaf69aae
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.6MB
MD504e682e306c4a8720a7aba6ff54a991a
SHA130d43db52ea51648e37b736bcdf3f46099650b6d
SHA256a46ea98ad0ea5abc3bf267a93c0af04c785ffe3811154b1670b9661e264d8aa2
SHA5124def0bd15ddee8f1dc91e0fb3a76928325f29ed51711bec672d2dc1ada396b3c848cdc3b24bcdf620edf8dc8474b744c12362091425d70d0521ba934aaf69aae
-
memory/396-198-0x0000000000160000-0x000000000019E000-memory.dmpFilesize
248KB
-
memory/396-221-0x00007FF84D730000-0x00007FF84E1F1000-memory.dmpFilesize
10.8MB
-
memory/396-192-0x0000000000000000-mapping.dmp
-
memory/396-200-0x00007FF84D730000-0x00007FF84E1F1000-memory.dmpFilesize
10.8MB
-
memory/816-179-0x0000000000000000-mapping.dmp
-
memory/904-182-0x0000000000000000-mapping.dmp
-
memory/944-130-0x0000000000000000-mapping.dmp
-
memory/1836-220-0x00007FF84D730000-0x00007FF84E1F1000-memory.dmpFilesize
10.8MB
-
memory/1836-199-0x00007FF84D730000-0x00007FF84E1F1000-memory.dmpFilesize
10.8MB
-
memory/1836-185-0x0000000000000000-mapping.dmp
-
memory/1836-190-0x0000000000940000-0x0000000000948000-memory.dmpFilesize
32KB
-
memory/1888-193-0x0000000000000000-mapping.dmp
-
memory/2020-218-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/2020-186-0x0000000000000000-mapping.dmp
-
memory/2020-222-0x0000000002EAD000-0x0000000002F11000-memory.dmpFilesize
400KB
-
memory/2020-217-0x0000000004730000-0x00000000047CD000-memory.dmpFilesize
628KB
-
memory/2020-216-0x0000000002EAD000-0x0000000002F11000-memory.dmpFilesize
400KB
-
memory/2060-195-0x0000000000000000-mapping.dmp
-
memory/2380-210-0x0000000000000000-mapping.dmp
-
memory/3156-176-0x0000000000000000-mapping.dmp
-
memory/3288-183-0x0000000000000000-mapping.dmp
-
memory/3348-154-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3348-205-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3348-133-0x0000000000000000-mapping.dmp
-
memory/3348-148-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3348-149-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3348-168-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-167-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-152-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-156-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3348-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3348-158-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3348-161-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3348-163-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3348-166-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-165-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-164-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-151-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3348-203-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-204-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3348-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3348-207-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3348-206-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3348-162-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3348-160-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3348-159-0x00000000007A0000-0x000000000082F000-memory.dmpFilesize
572KB
-
memory/3348-157-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3348-155-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3516-180-0x0000000000000000-mapping.dmp
-
memory/3676-181-0x0000000000000000-mapping.dmp
-
memory/4212-214-0x0000000002BF0000-0x0000000002BF9000-memory.dmpFilesize
36KB
-
memory/4212-213-0x0000000002D3D000-0x0000000002D46000-memory.dmpFilesize
36KB
-
memory/4212-215-0x0000000000400000-0x0000000002B7B000-memory.dmpFilesize
39.5MB
-
memory/4212-187-0x0000000000000000-mapping.dmp
-
memory/4212-219-0x0000000000400000-0x0000000002B7B000-memory.dmpFilesize
39.5MB
-
memory/4544-201-0x0000000000000000-mapping.dmp
-
memory/4984-178-0x0000000000000000-mapping.dmp
-
memory/5000-177-0x0000000000000000-mapping.dmp