Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2022 10:11
Static task
static1
Behavioral task
behavioral1
Sample
52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe
Resource
win7-20220901-en
General
-
Target
52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe
-
Size
276KB
-
MD5
abde7b0ebac2e5962cc6b2bfab4f3663
-
SHA1
9a350711568ea98fd6e105fc013fed415d87a77d
-
SHA256
52e27a4ebee3e1493a18018565b505353e84eb5fcdde94131f0c29507ff82627
-
SHA512
e46434c12a954e997c37257c811e47bb5dd2c405e3090ed7d73b583b0b10866134ebfc21a4fac427d140f9ab77b9ee18d1f8afce3ef19370d37ad480c1a0d0d9
-
SSDEEP
6144:kU3ZJs6g11WYbJRr+5Yp2OC/OrJ/odREGtB/zLc9/:L3wEYbr+qpQWr6PrB/zLs
Malware Config
Extracted
danabot
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
embedded_hash
569235DCA8F16ED8310BBACCB674F896
-
type
loader
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4204-133-0x0000000004980000-0x0000000004989000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 84 3020 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
FCE3.exeFCE3.exe2740.exepid process 3892 FCE3.exe 3996 FCE3.exe 3876 2740.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2740.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 2740.exe -
Loads dropped DLL 3 IoCs
Processes:
2740.exepid process 3876 2740.exe 3876 2740.exe 3876 2740.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
FCE3.exeFCE3.exedescription pid process target process PID 3892 set thread context of 3996 3892 FCE3.exe FCE3.exe PID 3996 set thread context of 3020 3996 FCE3.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 380 3876 WerFault.exe 2740.exe -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exe52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe -
Checks processor information in registry 2 TTPs 45 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FCE3.exerundll32.exe2740.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz FCE3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2740.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier FCE3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz FCE3.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FCE3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision FCE3.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FCE3.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2740.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status FCE3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 FCE3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4484 timeout.exe -
Processes:
description ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar -
Modifies registry class 21 IoCs
Processes:
rundll32.exeOpenWith.exeFCE3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings FCE3.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 2864 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exepid process 4204 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe 4204 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2864 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exepid process 4204 52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2272 svchost.exe Token: SeShutdownPrivilege 2272 svchost.exe Token: SeCreatePagefilePrivilege 2272 svchost.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 3020 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
OpenWith.exepid process 1084 OpenWith.exe 2864 2864 -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
FCE3.exeFCE3.exe2740.execmd.exedescription pid process target process PID 2864 wrote to memory of 3892 2864 FCE3.exe PID 2864 wrote to memory of 3892 2864 FCE3.exe PID 2864 wrote to memory of 3892 2864 FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3892 wrote to memory of 3996 3892 FCE3.exe FCE3.exe PID 3996 wrote to memory of 2064 3996 FCE3.exe agentactivationruntimestarter.exe PID 3996 wrote to memory of 2064 3996 FCE3.exe agentactivationruntimestarter.exe PID 3996 wrote to memory of 2064 3996 FCE3.exe agentactivationruntimestarter.exe PID 2864 wrote to memory of 3876 2864 2740.exe PID 2864 wrote to memory of 3876 2864 2740.exe PID 2864 wrote to memory of 3876 2864 2740.exe PID 3876 wrote to memory of 3524 3876 2740.exe cmd.exe PID 3876 wrote to memory of 3524 3876 2740.exe cmd.exe PID 3876 wrote to memory of 3524 3876 2740.exe cmd.exe PID 3524 wrote to memory of 4484 3524 cmd.exe timeout.exe PID 3524 wrote to memory of 4484 3524 cmd.exe timeout.exe PID 3524 wrote to memory of 4484 3524 cmd.exe timeout.exe PID 3996 wrote to memory of 3020 3996 FCE3.exe rundll32.exe PID 3996 wrote to memory of 3020 3996 FCE3.exe rundll32.exe PID 3996 wrote to memory of 3020 3996 FCE3.exe rundll32.exe PID 3996 wrote to memory of 3020 3996 FCE3.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe"C:\Users\Admin\AppData\Local\Temp\52E27A4EBEE3E1493A18018565B505353E84EB5FCDDE9.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FCE3.exeC:\Users\Admin\AppData\Local\Temp\FCE3.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FCE3.exeC:\Users\Admin\AppData\Local\Temp\FCE3.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#613⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x4f41⤵
-
C:\Users\Admin\AppData\Local\Temp\2740.exeC:\Users\Admin\AppData\Local\Temp\2740.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2740.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 20202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3876 -ip 38761⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\sqlite3.dllFilesize
1.1MB
MD51f44d4d3087c2b202cf9c90ee9d04b0f
SHA1106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA2564841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
SHA512b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
-
C:\Users\Admin\AppData\Local\Temp\2740.exeFilesize
318KB
MD5e58c70e8e2cde5c7aee3975db0a2e559
SHA14c88ba2a9c7cd614c74fdb34d17ee5d82fc6a4fe
SHA2562a929266c1c731452ab4171a4c6cb980d6c84a6cc81e2bec5b1dacec075113bf
SHA512b4a49e871630b96e94833ca794c2982e96ceb03052fcfbe58e7b3c7e2868a5d2f837f0ed8173bef0b22ba38be28ec22584fabd0d199b0706ae71b9481880adf8
-
C:\Users\Admin\AppData\Local\Temp\2740.exeFilesize
318KB
MD5e58c70e8e2cde5c7aee3975db0a2e559
SHA14c88ba2a9c7cd614c74fdb34d17ee5d82fc6a4fe
SHA2562a929266c1c731452ab4171a4c6cb980d6c84a6cc81e2bec5b1dacec075113bf
SHA512b4a49e871630b96e94833ca794c2982e96ceb03052fcfbe58e7b3c7e2868a5d2f837f0ed8173bef0b22ba38be28ec22584fabd0d199b0706ae71b9481880adf8
-
C:\Users\Admin\AppData\Local\Temp\2740.exeFilesize
318KB
MD5e58c70e8e2cde5c7aee3975db0a2e559
SHA14c88ba2a9c7cd614c74fdb34d17ee5d82fc6a4fe
SHA2562a929266c1c731452ab4171a4c6cb980d6c84a6cc81e2bec5b1dacec075113bf
SHA512b4a49e871630b96e94833ca794c2982e96ceb03052fcfbe58e7b3c7e2868a5d2f837f0ed8173bef0b22ba38be28ec22584fabd0d199b0706ae71b9481880adf8
-
C:\Users\Admin\AppData\Local\Temp\53e6a9ff-6628-4c05-9f9e-5740d15f61de.tmpFilesize
19KB
MD5613b4d43b64a6d9630f389c4e12295b4
SHA106bef00ff378997f9b05d77c78563e01fb713e2d
SHA256bbe5def034f4c1e6c16beb775ecbbbbe5e6f1aa8100639e87997c9f656a002c6
SHA5123d48d3dbd49750d6154a3ecde4f60b7ba0cdfbf4781357971102222707ff9a6ee34f5cdbbb64111e3b43bf3946c1fdfb5024d1bcf710e13a850b257c61e5a365
-
C:\Users\Admin\AppData\Local\Temp\607cd18f-98c4-4c86-94ad-33f9ee772d45.tmpFilesize
25KB
MD59f670566b87be47f09e3871cd67ed6d9
SHA18b49dd7fb4bf06df0a16cfc03a42832b78bdfabd
SHA256d7089602fa181dfd161165dc1bb34271e7481f88ee2ca06230da2a2269a68c80
SHA5126e53a2d3c4329114f7e562d84bcb6345176ce4d7006c9d699d6dab9886d5aa277b5b8fe5cfb9e574a49e0c1de6414efa913cf9b3ffecd95e9fafa28370fc2456
-
C:\Users\Admin\AppData\Local\Temp\FCE3.exeFilesize
8.4MB
MD53281a9332d11287529ddbac19387f603
SHA16554cbd72d5b8bd516f61a23b660973a459ce99a
SHA256f535fcf255b18e63f0191b3d9d396bb7fc7e42c7d770263863b9b8de7062e296
SHA512f1822a94db5cd93d1d1a53c126c5cea45fbf2cc7f0a9629291ed6a4c13f0d1cb4d1b642de137e9aad17709faf83025014b553ca3a707f0f9ccbb734305d349e5
-
C:\Users\Admin\AppData\Local\Temp\FCE3.exeFilesize
8.4MB
MD53281a9332d11287529ddbac19387f603
SHA16554cbd72d5b8bd516f61a23b660973a459ce99a
SHA256f535fcf255b18e63f0191b3d9d396bb7fc7e42c7d770263863b9b8de7062e296
SHA512f1822a94db5cd93d1d1a53c126c5cea45fbf2cc7f0a9629291ed6a4c13f0d1cb4d1b642de137e9aad17709faf83025014b553ca3a707f0f9ccbb734305d349e5
-
C:\Users\Admin\AppData\Local\Temp\FCE3.exeFilesize
8.4MB
MD53281a9332d11287529ddbac19387f603
SHA16554cbd72d5b8bd516f61a23b660973a459ce99a
SHA256f535fcf255b18e63f0191b3d9d396bb7fc7e42c7d770263863b9b8de7062e296
SHA512f1822a94db5cd93d1d1a53c126c5cea45fbf2cc7f0a9629291ed6a4c13f0d1cb4d1b642de137e9aad17709faf83025014b553ca3a707f0f9ccbb734305d349e5
-
C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmpFilesize
3.3MB
MD513d0ff809f24a408728fd6fe00241020
SHA1fde8484da982eceb86cf6959460ffc4ce33271a9
SHA256db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
SHA51238dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768
-
C:\Users\Admin\AppData\Local\Temp\XZIOFAVD-20220812-1951.logFilesize
56KB
MD5d431794afa91c4c3745055b53d795183
SHA1ca518aa0948e9e8af5ec5a89bc613d7e4fc6c9d5
SHA2562290c5fc19f04b088974b297c2677e0e848900c9188382d3b24611a02685ae03
SHA5121ae72c1da9b766b3bea44aa3244ab028f7ed8c6e715b284ca111f6f22d3300dbc54a89639f3af0b0371c62c7cab81d4b8b76d807e9738f9d5aa4b329f25fdd64
-
C:\Users\Admin\AppData\Local\Temp\aria-debug-4844.logFilesize
470B
MD5467995413210c7391415743b595525c4
SHA1f3ca1cf58a0e3285359840b39bcb30d49a7424d6
SHA256cf0b731d7efcb55d5bf659817e88dcbb0aa3c6a0fe66d11ad965f1812eb3689e
SHA512eb8987cd31907911197a818a84c790584c13a55d7a104afb542c066b66b0bd9d7c34b4fb07601bb6d31d9829d5d04eb3ad3947e7ea25c5915128ab96b9e42247
-
C:\Users\Admin\AppData\Local\Temp\b7a972bc-9460-4c6f-93c0-e6dd9473f34f.tmpFilesize
23KB
MD52e0a52964e4f43a9830f01775bcb061b
SHA1deedc2124380dcc834798466b7ae8ca986aba82f
SHA2563884df97009ac7e97143743660ed8e010d5f77edcf611bf85276e876fc70754b
SHA51256c28175bfeb1adfa70761dbf3d46f60b3545de1dd879b346658a2701a173c5fd1959dcb6ecb931f7589f8178fa46d026da0edcfef0471f0fc9d65df7bc6ea44
-
C:\Users\Admin\AppData\Local\Temp\chrome_installer.logFilesize
1KB
MD593e7cb32c0803cd4f10f40068afb5ebb
SHA1388fb2b6a393f807f5d36a320bea35a696004f9f
SHA256fbba51574a6ba44ae6525df959ec9a14e4a1f65dbd74d2d6cd36d415b5a8bf98
SHA51202c8f31973611f5161e5022fa4c1b042790e04bdb40221fa656e74701dd9fa2bb2b4f49dc17c8119b0d6b8838675c8755fc075545e0f091d0e96ea9aa3c8b642
-
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txtFilesize
1KB
MD55d031b12263e4c18b48a434aafc8209e
SHA1ed12ea0255d2c7dc4a4afaa30de511cec539e44c
SHA2564d5adb4dd1a5d269e017680797a0403cfca1106411c061ce8753bfe9b4cbd5e4
SHA5126b7a2e3d3d0b082ec3272229d0e5215d2269c96fb6993671e8614c8ce55e232463f5a812ff3f41aae806aae8681e18a5506c465ef20787eabd0f2257c1c2a2d0
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI645A.txtFilesize
426KB
MD5d6bf37e485af183339e35423cdd4f8e9
SHA1c7974725701dee5fcfb0e70f73f198d4d0ce3eeb
SHA256b2d7382b176b11d055ca783cd6ad59db1607ddd99766b2437e1d558b801f8367
SHA5122ac89bb21d98105e202357a33d555110be2f10f5f44472f1e5ed8c8070b7c541dbc04952c555addff4ac24a77a6ebf467d823e64ede71db1cc3b1d53d8730933
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI6492.txtFilesize
11KB
MD53deb951d119c378dff3d7911fa48dd12
SHA1b74cbbddb4b37d46456da7a3e86260a3d8144e17
SHA2560cf9936341117c121cc50582950760d7b24f1117749b451d82a45202f5aad461
SHA512d9fc285be218af35e81d17b6bd78644d9bad8995cbfc466a0a671f171012f5ff760863e359ea49c9329c951a2280fa5b8e08e72c431e2c961e9fbc65bba7ce80
-
C:\Users\Admin\AppData\Local\Temp\e60d62fd-4f64-4839-9b40-06d8d042b5b1.tmpFilesize
242KB
MD5541f52e24fe1ef9f8e12377a6ccae0c0
SHA1189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA25681e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
SHA512d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
-
C:\Users\Admin\AppData\Local\Temp\msedge_installer.logFilesize
3KB
MD56546d4da7c6194f907e8ce017b7fc87a
SHA10141e7cfd64447560c70d6a22ad94b7daa3f0a20
SHA256a22d9512b262abdca444253594637115919e73a5d213a39652107ad52582a5aa
SHA51207884f94c17f4fb3d7ff2c4950b2a77e168d5a3e4bf9147d73f4e2de385497909665330c5e3b03d78897365a406f245dd37fb31858eeaedf7f149003a48c6b6c
-
C:\Users\Admin\AppData\Local\Temp\wct5E8C.tmpFilesize
62KB
MD57185e716980842db27c3b3a88e1fe804
SHA1e4615379cd4797629b4cc3da157f4d4a5412fb2b
SHA256094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
SHA512dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
697B
MD516a993a13d195d20dca07319d0725671
SHA12642524456da144d2db89ea760fdd788461d74db
SHA2564f17ddbb8ccc7da41e95a5f5bd1c4c7c99f7bf321cfdf67988e32591a4e375f2
SHA512afaea880275fa137598f5bb676059966e5b3df29473ad978ae1e4e378b674d9e52cb79629a0be5399c02170306658a635d909efe8b82daa848328858d1cf0be0
-
memory/2064-145-0x0000000000000000-mapping.dmp
-
memory/3020-194-0x0000000003670000-0x0000000004122000-memory.dmpFilesize
10.7MB
-
memory/3020-174-0x0000000000000000-mapping.dmp
-
memory/3020-197-0x0000000003670000-0x0000000004122000-memory.dmpFilesize
10.7MB
-
memory/3020-179-0x0000000001200000-0x0000000001B92000-memory.dmpFilesize
9.6MB
-
memory/3020-177-0x0000000004130000-0x0000000004270000-memory.dmpFilesize
1.2MB
-
memory/3020-176-0x0000000004130000-0x0000000004270000-memory.dmpFilesize
1.2MB
-
memory/3020-175-0x0000000003670000-0x0000000004122000-memory.dmpFilesize
10.7MB
-
memory/3524-157-0x0000000000000000-mapping.dmp
-
memory/3876-148-0x0000000000000000-mapping.dmp
-
memory/3876-160-0x0000000000400000-0x0000000002C3D000-memory.dmpFilesize
40.2MB
-
memory/3876-151-0x0000000002FE3000-0x000000000300F000-memory.dmpFilesize
176KB
-
memory/3876-152-0x0000000002DE0000-0x0000000002E29000-memory.dmpFilesize
292KB
-
memory/3876-153-0x0000000000400000-0x0000000002C3D000-memory.dmpFilesize
40.2MB
-
memory/3876-159-0x0000000002FE3000-0x000000000300F000-memory.dmpFilesize
176KB
-
memory/3892-143-0x0000000003714000-0x0000000003F50000-memory.dmpFilesize
8.2MB
-
memory/3892-146-0x0000000005900000-0x00000000062D6000-memory.dmpFilesize
9.8MB
-
memory/3892-136-0x0000000000000000-mapping.dmp
-
memory/3996-166-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-161-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-147-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-162-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-173-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-170-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-169-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-144-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-167-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-168-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-171-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/3996-196-0x0000000003AF0000-0x00000000045A2000-memory.dmpFilesize
10.7MB
-
memory/3996-163-0x0000000003AF0000-0x00000000045A2000-memory.dmpFilesize
10.7MB
-
memory/3996-164-0x0000000003AF0000-0x00000000045A2000-memory.dmpFilesize
10.7MB
-
memory/3996-195-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-142-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-165-0x0000000003AF0000-0x00000000045A2000-memory.dmpFilesize
10.7MB
-
memory/3996-140-0x0000000000400000-0x0000000000DE1000-memory.dmpFilesize
9.9MB
-
memory/3996-139-0x0000000000000000-mapping.dmp
-
memory/3996-172-0x0000000004760000-0x00000000048A0000-memory.dmpFilesize
1.2MB
-
memory/4204-135-0x0000000000400000-0x0000000002C44000-memory.dmpFilesize
40.3MB
-
memory/4204-134-0x0000000000400000-0x0000000002C44000-memory.dmpFilesize
40.3MB
-
memory/4204-132-0x0000000002F8D000-0x0000000002F9D000-memory.dmpFilesize
64KB
-
memory/4204-133-0x0000000004980000-0x0000000004989000-memory.dmpFilesize
36KB
-
memory/4484-158-0x0000000000000000-mapping.dmp