Analysis
-
max time kernel
186s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 16:52
Static task
static1
Behavioral task
behavioral1
Sample
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe
Resource
win10v2004-20220812-en
General
-
Target
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe
-
Size
223KB
-
MD5
b492f211c6e0e7dd13d9019219223510
-
SHA1
fc2949ebcc447c0f16133a4d40557e6108e08a15
-
SHA256
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49
-
SHA512
dcf7dcb69a54913a3f035dc23ddeaa1827f497e62baee5e5974548f403a9f38c2bb491572abc3681072bc5dd05b1391da97c613d6c0ccc8467b1327d2dd25f94
-
SSDEEP
3072:sXpmgLvlrJxzA56VSuAK+IhAh2QJur805t72JLhnDeSNwLmj/+bh:oQgLRfR1+I5Z4ze2/Yh
Malware Config
Extracted
djvu
http://winnlinne.com/lancer/get.php
-
extension
.nury
-
offline_id
KFBzXY7hTnWvKHIgFKUOR1MsE6RDJJwQPj1ozPt1
-
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IfeNgr671e Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@fishmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0589Jhyjd
Extracted
redline
nam7
103.89.90.61:34589
-
auth_value
533c8fbdab4382453812c73ea2cee5b8
Extracted
redline
Google2
167.235.71.14:20469
-
auth_value
fb274d9691235ba015830da570a13578
Extracted
redline
slovarikinstalls
78.153.144.3:2510
-
auth_value
5f80b2ec82e3bd02a08a3a55d3180551
Extracted
vidar
55.1
517
https://t.me/tg_privatetalk
https://nerdculture.de/@yixehi33
-
profile_id
517
Signatures
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral1/memory/4024-168-0x0000000004860000-0x000000000497B000-memory.dmp family_djvu behavioral1/memory/1228-174-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1228-176-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1228-172-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1228-177-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1228-195-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2352-226-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2352-227-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2352-233-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2352-234-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4948-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral1/memory/2712-140-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral1/memory/4332-160-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-192-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/2200-200-0x0000000000CC0000-0x0000000000D1C000-memory.dmp family_redline behavioral1/memory/5040-205-0x0000000000530000-0x0000000000558000-memory.dmp family_redline behavioral1/memory/2092-210-0x0000000000E40000-0x0000000000E9C000-memory.dmp family_redline behavioral1/memory/3844-212-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/4480-217-0x0000000000880000-0x00000000008DC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
FBB5.exe2D75.exe2F6A.exe348C.exe348C.exeDAFF.exeDE8A.exe348C.exeE428.exe348C.exebuild2.exebuild2.exebuild3.exe4A07.exepid process 2712 FBB5.exe 4332 2D75.exe 3500 2F6A.exe 4024 348C.exe 1228 348C.exe 2200 DAFF.exe 2092 DE8A.exe 1124 348C.exe 4480 E428.exe 2352 348C.exe 2736 build2.exe 3320 build2.exe 4912 build3.exe 1316 4A07.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
348C.exe348C.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 348C.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 348C.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exebuild2.exepid process 1328 regsvr32.exe 3320 build2.exe 3320 build2.exe 3320 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
348C.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\698bc3e1-a604-40ee-94ea-aa6321fc6767\\348C.exe\" --AutoStart" 348C.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 api.2ip.ua 33 api.2ip.ua 70 api.2ip.ua -
Suspicious use of SetThreadContext 7 IoCs
Processes:
348C.exeDAFF.exeDE8A.exeE428.exe348C.exebuild2.exe4A07.exedescription pid process target process PID 4024 set thread context of 1228 4024 348C.exe 348C.exe PID 2200 set thread context of 1584 2200 DAFF.exe RegSvcs.exe PID 2092 set thread context of 5040 2092 DE8A.exe RegSvcs.exe PID 4480 set thread context of 3844 4480 E428.exe RegSvcs.exe PID 1124 set thread context of 2352 1124 348C.exe 348C.exe PID 2736 set thread context of 3320 2736 build2.exe build2.exe PID 1316 set thread context of 1464 1316 4A07.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 404 3500 WerFault.exe 2F6A.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exeFBB5.exe2D75.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FBB5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FBB5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2D75.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2D75.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FBB5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2D75.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exepid process 4948 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe 4948 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2804 -
Suspicious behavior: MapViewOfSection 25 IoCs
Processes:
2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exeFBB5.exe2D75.exepid process 4948 2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe 2712 FBB5.exe 2804 2804 2804 2804 4332 2D75.exe 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 2804 -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
RegSvcs.exeRegSvcs.exeRegSvcs.exevbc.exedescription pid process Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeDebugPrivilege 3844 RegSvcs.exe Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeDebugPrivilege 1584 RegSvcs.exe Token: SeDebugPrivilege 5040 RegSvcs.exe Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeShutdownPrivilege 2804 Token: SeCreatePagefilePrivilege 2804 Token: SeDebugPrivilege 1464 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe348C.exe348C.exeDAFF.exeDE8A.exeE428.exedescription pid process target process PID 2804 wrote to memory of 2712 2804 FBB5.exe PID 2804 wrote to memory of 2712 2804 FBB5.exe PID 2804 wrote to memory of 2712 2804 FBB5.exe PID 2804 wrote to memory of 4332 2804 2D75.exe PID 2804 wrote to memory of 4332 2804 2D75.exe PID 2804 wrote to memory of 4332 2804 2D75.exe PID 2804 wrote to memory of 3500 2804 2F6A.exe PID 2804 wrote to memory of 3500 2804 2F6A.exe PID 2804 wrote to memory of 3500 2804 2F6A.exe PID 2804 wrote to memory of 1304 2804 regsvr32.exe PID 2804 wrote to memory of 1304 2804 regsvr32.exe PID 2804 wrote to memory of 4024 2804 348C.exe PID 2804 wrote to memory of 4024 2804 348C.exe PID 2804 wrote to memory of 4024 2804 348C.exe PID 2804 wrote to memory of 3520 2804 explorer.exe PID 2804 wrote to memory of 3520 2804 explorer.exe PID 2804 wrote to memory of 3520 2804 explorer.exe PID 2804 wrote to memory of 3520 2804 explorer.exe PID 1304 wrote to memory of 1328 1304 regsvr32.exe regsvr32.exe PID 1304 wrote to memory of 1328 1304 regsvr32.exe regsvr32.exe PID 1304 wrote to memory of 1328 1304 regsvr32.exe regsvr32.exe PID 2804 wrote to memory of 3672 2804 explorer.exe PID 2804 wrote to memory of 3672 2804 explorer.exe PID 2804 wrote to memory of 3672 2804 explorer.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 4024 wrote to memory of 1228 4024 348C.exe 348C.exe PID 1228 wrote to memory of 1788 1228 348C.exe icacls.exe PID 1228 wrote to memory of 1788 1228 348C.exe icacls.exe PID 1228 wrote to memory of 1788 1228 348C.exe icacls.exe PID 2804 wrote to memory of 2200 2804 DAFF.exe PID 2804 wrote to memory of 2200 2804 DAFF.exe PID 2804 wrote to memory of 2200 2804 DAFF.exe PID 1228 wrote to memory of 1124 1228 348C.exe 348C.exe PID 1228 wrote to memory of 1124 1228 348C.exe 348C.exe PID 1228 wrote to memory of 1124 1228 348C.exe 348C.exe PID 2804 wrote to memory of 2092 2804 DE8A.exe PID 2804 wrote to memory of 2092 2804 DE8A.exe PID 2804 wrote to memory of 2092 2804 DE8A.exe PID 2200 wrote to memory of 1584 2200 DAFF.exe RegSvcs.exe PID 2200 wrote to memory of 1584 2200 DAFF.exe RegSvcs.exe PID 2200 wrote to memory of 1584 2200 DAFF.exe RegSvcs.exe PID 2200 wrote to memory of 1584 2200 DAFF.exe RegSvcs.exe PID 2200 wrote to memory of 1584 2200 DAFF.exe RegSvcs.exe PID 2804 wrote to memory of 4480 2804 E428.exe PID 2804 wrote to memory of 4480 2804 E428.exe PID 2804 wrote to memory of 4480 2804 E428.exe PID 2092 wrote to memory of 5040 2092 DE8A.exe RegSvcs.exe PID 2092 wrote to memory of 5040 2092 DE8A.exe RegSvcs.exe PID 2092 wrote to memory of 5040 2092 DE8A.exe RegSvcs.exe PID 2092 wrote to memory of 5040 2092 DE8A.exe RegSvcs.exe PID 2092 wrote to memory of 5040 2092 DE8A.exe RegSvcs.exe PID 4480 wrote to memory of 3844 4480 E428.exe RegSvcs.exe PID 4480 wrote to memory of 3844 4480 E428.exe RegSvcs.exe PID 4480 wrote to memory of 3844 4480 E428.exe RegSvcs.exe PID 4480 wrote to memory of 3844 4480 E428.exe RegSvcs.exe PID 4480 wrote to memory of 3844 4480 E428.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe"C:\Users\Admin\AppData\Local\Temp\2bee71d49abf8ecd9bb1f2c9bf9b88e7aeae486d914f8f9fb33e4fd755d74e49.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FBB5.exeC:\Users\Admin\AppData\Local\Temp\FBB5.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2D75.exeC:\Users\Admin\AppData\Local\Temp\2D75.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2F6A.exeC:\Users\Admin\AppData\Local\Temp\2F6A.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 3402⤵
- Program crash
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\32A7.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\32A7.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\348C.exeC:\Users\Admin\AppData\Local\Temp\348C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\348C.exeC:\Users\Admin\AppData\Local\Temp\348C.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\698bc3e1-a604-40ee-94ea-aa6321fc6767" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\348C.exe"C:\Users\Admin\AppData\Local\Temp\348C.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\348C.exe"C:\Users\Admin\AppData\Local\Temp\348C.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exe"C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exe"C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build3.exe"C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3500 -ip 35001⤵
-
C:\Users\Admin\AppData\Local\Temp\DAFF.exeC:\Users\Admin\AppData\Local\Temp\DAFF.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DE8A.exeC:\Users\Admin\AppData\Local\Temp\DE8A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\E428.exeC:\Users\Admin\AppData\Local\Temp\E428.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4A07.exeC:\Users\Admin\AppData\Local\Temp\4A07.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\sqlite3.dllFilesize
1.1MB
MD51f44d4d3087c2b202cf9c90ee9d04b0f
SHA1106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA2564841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
SHA512b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5bc68c4ccb08d2c94eb10c1918865ccae
SHA18256faeec3f3ec799819d5370195a60f0ec2bdb0
SHA25679313c35e9f5655225ab6d4564a396cf9d473d04909c04db10935c27959f677d
SHA512f6baa632cd93126c31a495e340e8f42e3f9b171b0975877e7a6725677fe57c8b51784be5366cedba022fea273cfe9ecfc5fce8546f2a76e1e6516e5865666933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD5ee895cd37d1bbafdf7a736b85dd47348
SHA15c182ae0d6ffc54c386763ad882256cedd8d0e7c
SHA256939346daba2e0757e14e822fd55350189708ac8d2d782b148e1744ee85c49aa5
SHA512b2f86fa2f14864ab155693804f0d5da4f13e0c9257743eb7376d49a6ce77d950f6e98bbda24030386578c0edb58f4ad3e50eaec2dcc10803a7dd314d703cf740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5050b4f1d371e60021629a7017be4f27c
SHA14a4111e17553ad70ff3a0fb4a166fe7c4dd262bb
SHA256484bc2593d9b76c234c7bc6853b8b1e9e80f24b56c6420c494e5129fef268c9e
SHA51220deba94ce5b5bc1b9a3bfb462dc9ab61ff2276c1b9c7520f84b2fecdc993d3edcdc74f332f58aa07c8f8169592bac5732ae44d223909a177157f1947468d9b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD542172ea18b2e776d75da27565c1e47c2
SHA18371cd25a6e10e93240f481906613de3cc890959
SHA256bbc27e4559bb3834057124d4edf388ff263a75683bbafe5c223caa5255b89f69
SHA512a587f315c041862c18b3872bd5665b66c195785e385c88117bb70dda73adf9f00313b7affccfea29b98bb138f93048507eeabfb136eeb3ddcc1ef41043091a1e
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exeFilesize
325KB
MD5e4e90e1dda4b51d199d449fa936db902
SHA170de6b213f872ba782ba11cad5a5d1294ca9e741
SHA2568ecc0426ea37a5c9e59d00b4fde1508175a950372ec3870965f1e527634b3419
SHA5123958e1c40d69d5439b5e85bdb5765bb38ec5bba24f38a8aafb9a53c167ebaffb5c202441613af3f2d968c9c902de35036f67d87f7777efeb4c66869a7fc3c4ed
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exeFilesize
325KB
MD5e4e90e1dda4b51d199d449fa936db902
SHA170de6b213f872ba782ba11cad5a5d1294ca9e741
SHA2568ecc0426ea37a5c9e59d00b4fde1508175a950372ec3870965f1e527634b3419
SHA5123958e1c40d69d5439b5e85bdb5765bb38ec5bba24f38a8aafb9a53c167ebaffb5c202441613af3f2d968c9c902de35036f67d87f7777efeb4c66869a7fc3c4ed
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build2.exeFilesize
325KB
MD5e4e90e1dda4b51d199d449fa936db902
SHA170de6b213f872ba782ba11cad5a5d1294ca9e741
SHA2568ecc0426ea37a5c9e59d00b4fde1508175a950372ec3870965f1e527634b3419
SHA5123958e1c40d69d5439b5e85bdb5765bb38ec5bba24f38a8aafb9a53c167ebaffb5c202441613af3f2d968c9c902de35036f67d87f7777efeb4c66869a7fc3c4ed
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\2a2e9e76-1d4a-4d53-bd89-9b898dc994b9\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\698bc3e1-a604-40ee-94ea-aa6321fc6767\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\2D75.exeFilesize
223KB
MD5e68e4a8ca0bdda6abb11242a7210d8b2
SHA1a1fa537ecd03a786c1a1de0e36e67f0a37d4bae7
SHA25661e862b0dfb18b8c89eeb3aa602c9893836430504df4e8bd060fbea9df73d83d
SHA512b4249cafad7be0fe5b0b8c8ca4720bd8b140fae48179af39a0740583386affce06399e190054e68ba3641d1680062a741738b7ed3a1de0147941d8e8434c42d9
-
C:\Users\Admin\AppData\Local\Temp\2D75.exeFilesize
223KB
MD5e68e4a8ca0bdda6abb11242a7210d8b2
SHA1a1fa537ecd03a786c1a1de0e36e67f0a37d4bae7
SHA25661e862b0dfb18b8c89eeb3aa602c9893836430504df4e8bd060fbea9df73d83d
SHA512b4249cafad7be0fe5b0b8c8ca4720bd8b140fae48179af39a0740583386affce06399e190054e68ba3641d1680062a741738b7ed3a1de0147941d8e8434c42d9
-
C:\Users\Admin\AppData\Local\Temp\2F6A.exeFilesize
223KB
MD57b6b48284e72e2ce9ff791a05e5c2aca
SHA140beae134c92db2ecd0b57bb4180f962196b7d73
SHA25642acfdc847546b5018f043b0acb15d93388d6233fd30a7f9a8c17f4c5148bce6
SHA51203d43955f911d84191e4014a24320a2ea8502c03495c8a848cd27cc7b575004d4a69ab016096f41fb5c78c4ff4ca4bd05e5159d3228535c500c4440e506dbc4c
-
C:\Users\Admin\AppData\Local\Temp\2F6A.exeFilesize
223KB
MD57b6b48284e72e2ce9ff791a05e5c2aca
SHA140beae134c92db2ecd0b57bb4180f962196b7d73
SHA25642acfdc847546b5018f043b0acb15d93388d6233fd30a7f9a8c17f4c5148bce6
SHA51203d43955f911d84191e4014a24320a2ea8502c03495c8a848cd27cc7b575004d4a69ab016096f41fb5c78c4ff4ca4bd05e5159d3228535c500c4440e506dbc4c
-
C:\Users\Admin\AppData\Local\Temp\32A7.dllFilesize
1.8MB
MD597f74cbcb7cb46d1a7e7fa4f4a502fac
SHA107927a768f83d28142617efecbd9d40e87ab5a4a
SHA25651a4a8b14a5fa129998b14b4bfb1ac6c38aaf230bf8b25527927bb73de63da98
SHA51275e72c2329d66442b60ef7859850506d663f00ae70db08dfa969ccb26ca362cab1040d3423a8ba9bcbbee87633c87d8cb9f8521abc7837ddfe83ff61b05033ba
-
C:\Users\Admin\AppData\Local\Temp\32A7.dllFilesize
1.8MB
MD597f74cbcb7cb46d1a7e7fa4f4a502fac
SHA107927a768f83d28142617efecbd9d40e87ab5a4a
SHA25651a4a8b14a5fa129998b14b4bfb1ac6c38aaf230bf8b25527927bb73de63da98
SHA51275e72c2329d66442b60ef7859850506d663f00ae70db08dfa969ccb26ca362cab1040d3423a8ba9bcbbee87633c87d8cb9f8521abc7837ddfe83ff61b05033ba
-
C:\Users\Admin\AppData\Local\Temp\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\348C.exeFilesize
721KB
MD5f1ed7c8df3b8844051673481c7a96fc9
SHA1f6ec99d577cadc4f990388874b2f942f5b501a8f
SHA256b274fb0387aa0d0c7b83cb09156e656a593a236a6881748f8a5d27a13c27ed18
SHA5126e976e4e366e5878c1cb8056ad07c418f6223e56f50a1283ace5582109cf480784700d53bfa8d6c1919c343308282b35af66bafaf95217a8e75dee507ca54a1e
-
C:\Users\Admin\AppData\Local\Temp\4A07.exeFilesize
3.6MB
MD5d2c9d7a9031f37f53dc751a5ab55faca
SHA181a9fc92bb5d525c20b3c22490154934f895af5e
SHA25663111c4dc154915dc37a32820a08062fd1832d745e2f18df96ad55e1151d672d
SHA512f0455d21904d408b0c69757fc1f8d960f89364755dcecc6c70db8cbe8856b5ab13a3d2bfbbb856e81699a73f6c2d397e9833c75cedb82a6729d0167141476aef
-
C:\Users\Admin\AppData\Local\Temp\4A07.exeFilesize
3.6MB
MD5d2c9d7a9031f37f53dc751a5ab55faca
SHA181a9fc92bb5d525c20b3c22490154934f895af5e
SHA25663111c4dc154915dc37a32820a08062fd1832d745e2f18df96ad55e1151d672d
SHA512f0455d21904d408b0c69757fc1f8d960f89364755dcecc6c70db8cbe8856b5ab13a3d2bfbbb856e81699a73f6c2d397e9833c75cedb82a6729d0167141476aef
-
C:\Users\Admin\AppData\Local\Temp\DAFF.exeFilesize
355KB
MD5de9cc8f0aca4cbab79ae9ed574ad9d79
SHA1a1f8f805a2fcb1253fd006ac5710ef7cd77fbb8a
SHA256c64cb4f10302ee642e3f4448366075af371219e7ca9743e97d6574ab222ff294
SHA5126b913c8dc69790775daa47d08d54d17747c2fc76ff96ea61065dc7bea11960556cefed8ff366e9867db5c0633661665ed6eb099b48117018662aa1b03164f118
-
C:\Users\Admin\AppData\Local\Temp\DAFF.exeFilesize
355KB
MD5de9cc8f0aca4cbab79ae9ed574ad9d79
SHA1a1f8f805a2fcb1253fd006ac5710ef7cd77fbb8a
SHA256c64cb4f10302ee642e3f4448366075af371219e7ca9743e97d6574ab222ff294
SHA5126b913c8dc69790775daa47d08d54d17747c2fc76ff96ea61065dc7bea11960556cefed8ff366e9867db5c0633661665ed6eb099b48117018662aa1b03164f118
-
C:\Users\Admin\AppData\Local\Temp\DE8A.exeFilesize
355KB
MD57a25eee3fa668991ae69109ec2869215
SHA1a88f1dc1487fad8e6a962b4d627d48aef427fd74
SHA256a79e4053a5374ee515e6a83c1d43f1bd87829a24170ef343791a2d246fbe067c
SHA5124780d946cb52d7f248321baab266a3101ab472a04d21055e9075a48864a80e24bde250508dfdf4b08daaee748dcab784aa307e0c24f4bd5cd8c1f546ac3bab5c
-
C:\Users\Admin\AppData\Local\Temp\DE8A.exeFilesize
355KB
MD57a25eee3fa668991ae69109ec2869215
SHA1a88f1dc1487fad8e6a962b4d627d48aef427fd74
SHA256a79e4053a5374ee515e6a83c1d43f1bd87829a24170ef343791a2d246fbe067c
SHA5124780d946cb52d7f248321baab266a3101ab472a04d21055e9075a48864a80e24bde250508dfdf4b08daaee748dcab784aa307e0c24f4bd5cd8c1f546ac3bab5c
-
C:\Users\Admin\AppData\Local\Temp\E428.exeFilesize
355KB
MD57a300f675d38cc88faf96932a58048ee
SHA16331bc68fa7d08fde37d186ea5010368f4460462
SHA25684ce0cd38735c91e76d0533db9b1ce4990a0e8f418e8a51018c1d5bda93948f0
SHA51226fff6de8b38c5ef8d9a4c206af4d4752a2899204f74ff9d65e1bf6f607017acc83a475b7667d16a19b440541450482be3d50b8bd845889d35e799deb4a83d1c
-
C:\Users\Admin\AppData\Local\Temp\E428.exeFilesize
355KB
MD57a300f675d38cc88faf96932a58048ee
SHA16331bc68fa7d08fde37d186ea5010368f4460462
SHA25684ce0cd38735c91e76d0533db9b1ce4990a0e8f418e8a51018c1d5bda93948f0
SHA51226fff6de8b38c5ef8d9a4c206af4d4752a2899204f74ff9d65e1bf6f607017acc83a475b7667d16a19b440541450482be3d50b8bd845889d35e799deb4a83d1c
-
C:\Users\Admin\AppData\Local\Temp\FBB5.exeFilesize
223KB
MD55a4ee1cb4de2423c7d026a2bd912580c
SHA12b609df88ca33117d245cc2a385b37f2d8262757
SHA2563d935c5250ea511804279cdb199bb3200239eeaa514d8d8c6554370d835014fe
SHA512f9c747217c268a2a258f8e460dea6d0a51f1ce62af5b9c122176ae4406abe92fdc0478369e646509317a62aef6ecc5a2a829de572e482fed72c6a1b39d6e6204
-
C:\Users\Admin\AppData\Local\Temp\FBB5.exeFilesize
223KB
MD55a4ee1cb4de2423c7d026a2bd912580c
SHA12b609df88ca33117d245cc2a385b37f2d8262757
SHA2563d935c5250ea511804279cdb199bb3200239eeaa514d8d8c6554370d835014fe
SHA512f9c747217c268a2a258f8e460dea6d0a51f1ce62af5b9c122176ae4406abe92fdc0478369e646509317a62aef6ecc5a2a829de572e482fed72c6a1b39d6e6204
-
memory/116-301-0x0000000000590000-0x0000000000599000-memory.dmpFilesize
36KB
-
memory/116-293-0x0000000000000000-mapping.dmp
-
memory/116-299-0x00000000005A0000-0x00000000005A5000-memory.dmpFilesize
20KB
-
memory/316-275-0x0000000001030000-0x0000000001036000-memory.dmpFilesize
24KB
-
memory/316-274-0x0000000000000000-mapping.dmp
-
memory/316-276-0x0000000001020000-0x000000000102C000-memory.dmpFilesize
48KB
-
memory/1124-193-0x0000000000000000-mapping.dmp
-
memory/1124-223-0x0000000002EB3000-0x0000000002F44000-memory.dmpFilesize
580KB
-
memory/1228-171-0x0000000000000000-mapping.dmp
-
memory/1228-174-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1228-176-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1228-172-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1228-177-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1228-195-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1288-255-0x0000000000000000-mapping.dmp
-
memory/1304-148-0x0000000000000000-mapping.dmp
-
memory/1316-256-0x0000000000000000-mapping.dmp
-
memory/1328-182-0x0000000003610000-0x0000000003703000-memory.dmpFilesize
972KB
-
memory/1328-179-0x00000000037E0000-0x0000000003892000-memory.dmpFilesize
712KB
-
memory/1328-178-0x0000000003710000-0x00000000037D8000-memory.dmpFilesize
800KB
-
memory/1328-155-0x0000000000000000-mapping.dmp
-
memory/1328-167-0x0000000003610000-0x0000000003703000-memory.dmpFilesize
972KB
-
memory/1328-166-0x0000000003410000-0x0000000003503000-memory.dmpFilesize
972KB
-
memory/1464-284-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-280-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-283-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-260-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-285-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-259-0x0000000000000000-mapping.dmp
-
memory/1464-289-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-292-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-294-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-297-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-300-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-302-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1464-305-0x0000000000700000-0x0000000000864000-memory.dmpFilesize
1.4MB
-
memory/1524-270-0x00000000004C0000-0x00000000004CF000-memory.dmpFilesize
60KB
-
memory/1524-266-0x0000000000000000-mapping.dmp
-
memory/1524-269-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/1560-273-0x0000000000470000-0x0000000000479000-memory.dmpFilesize
36KB
-
memory/1560-271-0x0000000000000000-mapping.dmp
-
memory/1560-272-0x0000000000480000-0x0000000000485000-memory.dmpFilesize
20KB
-
memory/1584-192-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1584-235-0x0000000007300000-0x0000000007392000-memory.dmpFilesize
584KB
-
memory/1584-191-0x0000000000000000-mapping.dmp
-
memory/1584-240-0x00000000073A0000-0x0000000007406000-memory.dmpFilesize
408KB
-
memory/1584-219-0x0000000005F90000-0x000000000609A000-memory.dmpFilesize
1.0MB
-
memory/1788-183-0x0000000000000000-mapping.dmp
-
memory/2092-188-0x0000000000000000-mapping.dmp
-
memory/2092-210-0x0000000000E40000-0x0000000000E9C000-memory.dmpFilesize
368KB
-
memory/2200-200-0x0000000000CC0000-0x0000000000D1C000-memory.dmpFilesize
368KB
-
memory/2200-185-0x0000000000000000-mapping.dmp
-
memory/2352-227-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2352-234-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2352-233-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2352-222-0x0000000000000000-mapping.dmp
-
memory/2352-226-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2712-139-0x0000000002CF3000-0x0000000002D08000-memory.dmpFilesize
84KB
-
memory/2712-150-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/2712-141-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/2712-136-0x0000000000000000-mapping.dmp
-
memory/2712-140-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/2736-248-0x0000000000965000-0x000000000098D000-memory.dmpFilesize
160KB
-
memory/2736-249-0x00000000006F0000-0x0000000000734000-memory.dmpFilesize
272KB
-
memory/2736-236-0x0000000000000000-mapping.dmp
-
memory/3320-247-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3320-246-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3320-254-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3320-250-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3320-244-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3320-243-0x0000000000000000-mapping.dmp
-
memory/3500-164-0x0000000002E53000-0x0000000002E69000-memory.dmpFilesize
88KB
-
memory/3500-165-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/3500-145-0x0000000000000000-mapping.dmp
-
memory/3520-159-0x00000000010F0000-0x000000000115B000-memory.dmpFilesize
428KB
-
memory/3520-175-0x00000000010F0000-0x000000000115B000-memory.dmpFilesize
428KB
-
memory/3520-158-0x0000000001160000-0x00000000011D5000-memory.dmpFilesize
468KB
-
memory/3520-153-0x0000000000000000-mapping.dmp
-
memory/3672-157-0x0000000000000000-mapping.dmp
-
memory/3672-277-0x0000000000000000-mapping.dmp
-
memory/3672-161-0x0000000000770000-0x000000000077C000-memory.dmpFilesize
48KB
-
memory/3672-279-0x0000000000450000-0x0000000000477000-memory.dmpFilesize
156KB
-
memory/3672-278-0x0000000000480000-0x00000000004A2000-memory.dmpFilesize
136KB
-
memory/3844-286-0x0000000006C90000-0x0000000006CE0000-memory.dmpFilesize
320KB
-
memory/3844-211-0x0000000000000000-mapping.dmp
-
memory/3844-237-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/3844-212-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3844-282-0x0000000006C10000-0x0000000006C86000-memory.dmpFilesize
472KB
-
memory/4024-149-0x0000000000000000-mapping.dmp
-
memory/4024-169-0x0000000002DBF000-0x0000000002E50000-memory.dmpFilesize
580KB
-
memory/4024-168-0x0000000004860000-0x000000000497B000-memory.dmpFilesize
1.1MB
-
memory/4332-170-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4332-160-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4332-163-0x0000000002FB3000-0x0000000002FC9000-memory.dmpFilesize
88KB
-
memory/4332-162-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4332-142-0x0000000000000000-mapping.dmp
-
memory/4480-217-0x0000000000880000-0x00000000008DC000-memory.dmpFilesize
368KB
-
memory/4480-201-0x0000000000000000-mapping.dmp
-
memory/4632-313-0x0000000000CF0000-0x0000000000CFB000-memory.dmpFilesize
44KB
-
memory/4632-312-0x0000000000D00000-0x0000000000D08000-memory.dmpFilesize
32KB
-
memory/4632-311-0x0000000000000000-mapping.dmp
-
memory/4856-265-0x0000000000000000-mapping.dmp
-
memory/4856-268-0x0000000001290000-0x000000000129B000-memory.dmpFilesize
44KB
-
memory/4856-267-0x00000000012A0000-0x00000000012A7000-memory.dmpFilesize
28KB
-
memory/4892-308-0x0000000000000000-mapping.dmp
-
memory/4892-310-0x0000000000790000-0x000000000079D000-memory.dmpFilesize
52KB
-
memory/4892-309-0x00000000007A0000-0x00000000007A7000-memory.dmpFilesize
28KB
-
memory/4912-251-0x0000000000000000-mapping.dmp
-
memory/4944-307-0x0000000000CF0000-0x0000000000CFB000-memory.dmpFilesize
44KB
-
memory/4944-303-0x0000000000000000-mapping.dmp
-
memory/4944-306-0x0000000000D00000-0x0000000000D06000-memory.dmpFilesize
24KB
-
memory/4948-132-0x0000000002CE2000-0x0000000002CF7000-memory.dmpFilesize
84KB
-
memory/4948-134-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4948-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4948-135-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/5040-241-0x0000000007E30000-0x0000000007FF2000-memory.dmpFilesize
1.8MB
-
memory/5040-220-0x0000000005350000-0x0000000005362000-memory.dmpFilesize
72KB
-
memory/5040-221-0x0000000007190000-0x00000000071CC000-memory.dmpFilesize
240KB
-
memory/5040-218-0x0000000005540000-0x0000000005B58000-memory.dmpFilesize
6.1MB
-
memory/5040-205-0x0000000000530000-0x0000000000558000-memory.dmpFilesize
160KB
-
memory/5040-204-0x0000000000000000-mapping.dmp
-
memory/5040-242-0x0000000008B00000-0x000000000902C000-memory.dmpFilesize
5.2MB