Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 15:35
Static task
static1
Behavioral task
behavioral1
Sample
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe
Resource
win10v2004-20220812-en
General
-
Target
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe
-
Size
308KB
-
MD5
c4393c6d88954cd6324200e23dea8bd2
-
SHA1
20db80d76140cf09171e8f129f057a3a98e86c55
-
SHA256
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31
-
SHA512
d7cc17ad0c8bfa8b48a8ecc57d8093ecf92f74c840e33032b5f7d2ffe450da5abcf9bb4b5ff158f41a44d218ebca72c9fa42f2c9a226b98aa018fcd3a22fdf24
-
SSDEEP
6144:vTYqLfjOll8VR8GOED7Od54/0yuTPe2KT/Ns3v0En2E1a:vTbLjOlwLL/O74yeJNs3v0Uv
Malware Config
Extracted
redline
rozena1113
jalocliche.xyz:81
chardhesha.xyz:81
-
auth_value
a670b3d452a168677a236f3679080dea
Extracted
raccoon
dbffbdbc9786a5c270e6dd2d647e18ea
http://79.137.205.87/
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Amadey credential stealer module 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module behavioral1/memory/2472-297-0x0000000001F40000-0x0000000001F64000-memory.dmp amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4324-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/5092-231-0x0000000000400000-0x0000000000428000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exe family_redline behavioral1/memory/1184-251-0x0000000000570000-0x0000000000598000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 111 2472 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
F429.exe291.exe6C8.exe93A.exerovwer.exe45676.exeCrypted.exeCrypted.exeCrypted.exeCrypted.exemana.exelinda5.exerovwer.exerovwer.exepid process 4864 F429.exe 4480 291.exe 4228 6C8.exe 4704 93A.exe 3260 rovwer.exe 4896 45676.exe 1684 Crypted.exe 1416 Crypted.exe 4924 Crypted.exe 1380 Crypted.exe 1184 mana.exe 4168 linda5.exe 4768 rovwer.exe 872 rovwer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1000067000\45676.exe upx C:\Users\Admin\AppData\Roaming\1000067000\45676.exe upx behavioral1/memory/4896-208-0x00000000007B0000-0x00000000015C9000-memory.dmp upx behavioral1/memory/4896-210-0x00000000007B0000-0x00000000015C9000-memory.dmp upx behavioral1/memory/4772-277-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/4772-279-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/4772-280-0x0000000000400000-0x0000000000BEB000-memory.dmp upx behavioral1/memory/4772-281-0x0000000000400000-0x0000000000BEB000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
93A.exerovwer.exelinda5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 93A.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation rovwer.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation linda5.exe -
Loads dropped DLL 7 IoCs
Processes:
Crypted.exerundll32.exerundll32.exerundll32.exepid process 1380 Crypted.exe 1380 Crypted.exe 1380 Crypted.exe 4936 rundll32.exe 904 rundll32.exe 2472 rundll32.exe 2472 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45676.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000067000\\45676.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Crypted.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000075000\\Crypted.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mana.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000082001\\mana.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000085001\\linda5.exe" rovwer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
6C8.exeCrypted.exe291.exedescription pid process target process PID 4228 set thread context of 5092 4228 6C8.exe ngentask.exe PID 4924 set thread context of 1380 4924 Crypted.exe Crypted.exe PID 4480 set thread context of 4772 4480 291.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4132 4704 WerFault.exe 93A.exe 3232 4864 WerFault.exe F429.exe 4536 4768 WerFault.exe rovwer.exe 3100 872 WerFault.exe rovwer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 109 Go-http-client/1.1 -
Modifies registry class 1 IoCs
Processes:
linda5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings linda5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exepid process 4324 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe 4324 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2864 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exepid process 4324 99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 -
Suspicious use of AdjustPrivilegeToken 55 IoCs
Processes:
F429.exengentask.exemana.exedescription pid process Token: SeDebugPrivilege 4864 F429.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeDebugPrivilege 5092 ngentask.exe Token: SeDebugPrivilege 1184 mana.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93A.exerovwer.execmd.exedescription pid process target process PID 2864 wrote to memory of 4864 2864 F429.exe PID 2864 wrote to memory of 4864 2864 F429.exe PID 2864 wrote to memory of 4864 2864 F429.exe PID 2864 wrote to memory of 4480 2864 291.exe PID 2864 wrote to memory of 4480 2864 291.exe PID 2864 wrote to memory of 4228 2864 6C8.exe PID 2864 wrote to memory of 4228 2864 6C8.exe PID 2864 wrote to memory of 4228 2864 6C8.exe PID 2864 wrote to memory of 4704 2864 93A.exe PID 2864 wrote to memory of 4704 2864 93A.exe PID 2864 wrote to memory of 4704 2864 93A.exe PID 2864 wrote to memory of 2064 2864 explorer.exe PID 2864 wrote to memory of 2064 2864 explorer.exe PID 2864 wrote to memory of 2064 2864 explorer.exe PID 2864 wrote to memory of 2064 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 4512 2864 explorer.exe PID 2864 wrote to memory of 4512 2864 explorer.exe PID 2864 wrote to memory of 4512 2864 explorer.exe PID 2864 wrote to memory of 4512 2864 explorer.exe PID 2864 wrote to memory of 1100 2864 explorer.exe PID 2864 wrote to memory of 1100 2864 explorer.exe PID 2864 wrote to memory of 1100 2864 explorer.exe PID 4704 wrote to memory of 3260 4704 93A.exe rovwer.exe PID 4704 wrote to memory of 3260 4704 93A.exe rovwer.exe PID 4704 wrote to memory of 3260 4704 93A.exe rovwer.exe PID 2864 wrote to memory of 856 2864 explorer.exe PID 2864 wrote to memory of 856 2864 explorer.exe PID 2864 wrote to memory of 856 2864 explorer.exe PID 2864 wrote to memory of 856 2864 explorer.exe PID 2864 wrote to memory of 3048 2864 explorer.exe PID 2864 wrote to memory of 3048 2864 explorer.exe PID 2864 wrote to memory of 3048 2864 explorer.exe PID 2864 wrote to memory of 3048 2864 explorer.exe PID 3260 wrote to memory of 1068 3260 rovwer.exe schtasks.exe PID 3260 wrote to memory of 1068 3260 rovwer.exe schtasks.exe PID 3260 wrote to memory of 1068 3260 rovwer.exe schtasks.exe PID 2864 wrote to memory of 4032 2864 explorer.exe PID 2864 wrote to memory of 4032 2864 explorer.exe PID 2864 wrote to memory of 4032 2864 explorer.exe PID 2864 wrote to memory of 4032 2864 explorer.exe PID 3260 wrote to memory of 1820 3260 rovwer.exe cmd.exe PID 3260 wrote to memory of 1820 3260 rovwer.exe cmd.exe PID 3260 wrote to memory of 1820 3260 rovwer.exe cmd.exe PID 1820 wrote to memory of 4596 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 4596 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 4596 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 1248 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 1248 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 1248 1820 cmd.exe cacls.exe PID 2864 wrote to memory of 1924 2864 explorer.exe PID 2864 wrote to memory of 1924 2864 explorer.exe PID 2864 wrote to memory of 1924 2864 explorer.exe PID 1820 wrote to memory of 4568 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 4568 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 4568 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 1960 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 1960 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 1960 1820 cmd.exe cmd.exe PID 1820 wrote to memory of 1216 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 1216 1820 cmd.exe cacls.exe PID 1820 wrote to memory of 1216 1820 cmd.exe cacls.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe"C:\Users\Admin\AppData\Local\Temp\99e0aa316be4068244b32eacf062d244b9830118cf3d51d1e4b3f27426860c31.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F429.exeC:\Users\Admin\AppData\Local\Temp\F429.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 18202⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\291.exeC:\Users\Admin\AppData\Local\Temp\291.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\6C8.exeC:\Users\Admin\AppData\Local\Temp\6C8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\93A.exeC:\Users\Admin\AppData\Local\Temp\93A.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵
-
C:\Users\Admin\AppData\Roaming\1000067000\45676.exe"C:\Users\Admin\AppData\Roaming\1000067000\45676.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Roaming\1000067000\45676.exe4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 05⤵
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exe"C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000085001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000085001\linda5.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\3PDMV.Cpl",4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3PDMV.Cpl",5⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3PDMV.Cpl",6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\3PDMV.Cpl",7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 12842⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4704 -ip 47041⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4864 -ip 48641⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 4202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4768 -ip 47681⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 4202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 872 -ip 8721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Temp\1000082001\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Temp\1000085001\linda5.exeFilesize
1.8MB
MD589e90f9fe724b61c2f0f6000d9e36c33
SHA1433448bd92d4f3a2289a38bd59edfd9764a30a56
SHA256cd1df6c394986f3b472d7355e78d4078f3c8135b5be592a2495adf8ffb17871e
SHA512654ec7638f5d90d5b7b617615048b54589a955d3ce1acc5d0674eccf49ad2c6bde60295d577b23183f6b0160780fc14dbd998226b6376ad798457777c23292e4
-
C:\Users\Admin\AppData\Local\Temp\1000085001\linda5.exeFilesize
1.8MB
MD589e90f9fe724b61c2f0f6000d9e36c33
SHA1433448bd92d4f3a2289a38bd59edfd9764a30a56
SHA256cd1df6c394986f3b472d7355e78d4078f3c8135b5be592a2495adf8ffb17871e
SHA512654ec7638f5d90d5b7b617615048b54589a955d3ce1acc5d0674eccf49ad2c6bde60295d577b23183f6b0160780fc14dbd998226b6376ad798457777c23292e4
-
C:\Users\Admin\AppData\Local\Temp\291.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\291.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\3PDMV.CplFilesize
2.1MB
MD51310beb87e4be056010f860a9c6adbac
SHA1faea733366b0f22cb1c55317110ff998b6bcf399
SHA2567894db6ae6d787b40099076aa6698e7b40b7aeee360b1eae71ac3b40ed299589
SHA512129d4e1684b4adc8ace9097d6bd10a141285a90d61c3bb91b90b993714d1024dea28b195b0f1377ed8384d6f8d2f37cef86e5e4f232793d6f879c1a654b52cff
-
C:\Users\Admin\AppData\Local\Temp\3PDMV.cplFilesize
2.1MB
MD51310beb87e4be056010f860a9c6adbac
SHA1faea733366b0f22cb1c55317110ff998b6bcf399
SHA2567894db6ae6d787b40099076aa6698e7b40b7aeee360b1eae71ac3b40ed299589
SHA512129d4e1684b4adc8ace9097d6bd10a141285a90d61c3bb91b90b993714d1024dea28b195b0f1377ed8384d6f8d2f37cef86e5e4f232793d6f879c1a654b52cff
-
C:\Users\Admin\AppData\Local\Temp\3PDMV.cplFilesize
2.1MB
MD51310beb87e4be056010f860a9c6adbac
SHA1faea733366b0f22cb1c55317110ff998b6bcf399
SHA2567894db6ae6d787b40099076aa6698e7b40b7aeee360b1eae71ac3b40ed299589
SHA512129d4e1684b4adc8ace9097d6bd10a141285a90d61c3bb91b90b993714d1024dea28b195b0f1377ed8384d6f8d2f37cef86e5e4f232793d6f879c1a654b52cff
-
C:\Users\Admin\AppData\Local\Temp\6C8.exeFilesize
1.1MB
MD59d08ef5ab4b63074314ae1b1330cbfd3
SHA1e48c82648b7a3468e70c7c2c9fac9a4ab5e1eb60
SHA2560644a30b11859702c0a3e2ffd44ded16b47d52e6369ba59b334ffd03cea61bbe
SHA512b28ea36aa3dd0a9e41d8b5bfb1ae2acb63c3c47b4faa92b1d8461e89805c73a5092b589947df2ab6bed19f2270563bb91a91c02b35ce08fecb9dc6fbebe79420
-
C:\Users\Admin\AppData\Local\Temp\6C8.exeFilesize
1.1MB
MD59d08ef5ab4b63074314ae1b1330cbfd3
SHA1e48c82648b7a3468e70c7c2c9fac9a4ab5e1eb60
SHA2560644a30b11859702c0a3e2ffd44ded16b47d52e6369ba59b334ffd03cea61bbe
SHA512b28ea36aa3dd0a9e41d8b5bfb1ae2acb63c3c47b4faa92b1d8461e89805c73a5092b589947df2ab6bed19f2270563bb91a91c02b35ce08fecb9dc6fbebe79420
-
C:\Users\Admin\AppData\Local\Temp\93A.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\93A.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
346KB
MD594cfb05ebec8347824c6a47b1f134cf1
SHA1be422dfc6d32411c8e28fb83c0d77eb28103dc9a
SHA2560e33b9e1a35c18a87afd29b937ea7e04c246392939c616bd17c448632163aa8e
SHA5123b7ed9e8cebf8a32180906615d07ed97b16c47aebfd5a18e1778dacbbc8a0889ff0a4a826334e39654e13f6b565340e76dae313aacf1448f9539345a0cb8c130
-
C:\Users\Admin\AppData\Local\Temp\F429.exeFilesize
316KB
MD5f3fcdca43aa7f5ceccf66d9ae014eb35
SHA1190cbf37dfe6902c6238701242dd357b669d64c4
SHA25610f5cfcf83182e1738b67c8856dec5890ac2f40e8728e65595be80699a7cfe3f
SHA512710b20144f8109ab6f1284f3b146e8cc43c4511cc275661b0d84f90c07ec887491dc42ed2f4592f974ad0c394127c92e141d446a106f298e30eb11aa5e7c50a1
-
C:\Users\Admin\AppData\Local\Temp\F429.exeFilesize
316KB
MD5f3fcdca43aa7f5ceccf66d9ae014eb35
SHA1190cbf37dfe6902c6238701242dd357b669d64c4
SHA25610f5cfcf83182e1738b67c8856dec5890ac2f40e8728e65595be80699a7cfe3f
SHA512710b20144f8109ab6f1284f3b146e8cc43c4511cc275661b0d84f90c07ec887491dc42ed2f4592f974ad0c394127c92e141d446a106f298e30eb11aa5e7c50a1
-
C:\Users\Admin\AppData\Roaming\1000067000\45676.exeFilesize
4.3MB
MD530be8d7ef914a7baf9a3796cb892aa02
SHA1ee79a60ddf9f578404e697564e694fe5d09706d9
SHA256a2385d07f033b36d08d4ceb976820d2db8ca7b29339cb72ff3f74a4a90806c54
SHA512985c3a3c404c590403cd0c46f88b912bb9d4994ae0f7c921176a1b3180d8f96e3be86f74e1cc672a6598fc6ccbbce6ece5e8567635f594f173bce8f968cf56f9
-
C:\Users\Admin\AppData\Roaming\1000067000\45676.exeFilesize
4.3MB
MD530be8d7ef914a7baf9a3796cb892aa02
SHA1ee79a60ddf9f578404e697564e694fe5d09706d9
SHA256a2385d07f033b36d08d4ceb976820d2db8ca7b29339cb72ff3f74a4a90806c54
SHA512985c3a3c404c590403cd0c46f88b912bb9d4994ae0f7c921176a1b3180d8f96e3be86f74e1cc672a6598fc6ccbbce6ece5e8567635f594f173bce8f968cf56f9
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exeFilesize
976KB
MD5ac039cca27fd7d9b40dea205b4527a79
SHA1d36779a4613a108ffa5bc1e1e0fa80ba4b6f9130
SHA2568afe2857096c348a787abff7ba7739fdb8f4c82bf0fae6c14a80204e69df1788
SHA5126f8cf94d4df8b15300444622dea0537270062e3d64ee505b3ea4e51b492c9610495c0bf3ae9ece5d0b300265cc81123f4750c4ee98e55b5db38618857f3cb6de
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exeFilesize
976KB
MD5ac039cca27fd7d9b40dea205b4527a79
SHA1d36779a4613a108ffa5bc1e1e0fa80ba4b6f9130
SHA2568afe2857096c348a787abff7ba7739fdb8f4c82bf0fae6c14a80204e69df1788
SHA5126f8cf94d4df8b15300444622dea0537270062e3d64ee505b3ea4e51b492c9610495c0bf3ae9ece5d0b300265cc81123f4750c4ee98e55b5db38618857f3cb6de
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exeFilesize
976KB
MD5ac039cca27fd7d9b40dea205b4527a79
SHA1d36779a4613a108ffa5bc1e1e0fa80ba4b6f9130
SHA2568afe2857096c348a787abff7ba7739fdb8f4c82bf0fae6c14a80204e69df1788
SHA5126f8cf94d4df8b15300444622dea0537270062e3d64ee505b3ea4e51b492c9610495c0bf3ae9ece5d0b300265cc81123f4750c4ee98e55b5db38618857f3cb6de
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exeFilesize
976KB
MD5ac039cca27fd7d9b40dea205b4527a79
SHA1d36779a4613a108ffa5bc1e1e0fa80ba4b6f9130
SHA2568afe2857096c348a787abff7ba7739fdb8f4c82bf0fae6c14a80204e69df1788
SHA5126f8cf94d4df8b15300444622dea0537270062e3d64ee505b3ea4e51b492c9610495c0bf3ae9ece5d0b300265cc81123f4750c4ee98e55b5db38618857f3cb6de
-
C:\Users\Admin\AppData\Roaming\1000075000\Crypted.exeFilesize
976KB
MD5ac039cca27fd7d9b40dea205b4527a79
SHA1d36779a4613a108ffa5bc1e1e0fa80ba4b6f9130
SHA2568afe2857096c348a787abff7ba7739fdb8f4c82bf0fae6c14a80204e69df1788
SHA5126f8cf94d4df8b15300444622dea0537270062e3d64ee505b3ea4e51b492c9610495c0bf3ae9ece5d0b300265cc81123f4750c4ee98e55b5db38618857f3cb6de
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
memory/856-176-0x0000000000000000-mapping.dmp
-
memory/856-177-0x0000000000D70000-0x0000000000D92000-memory.dmpFilesize
136KB
-
memory/856-178-0x0000000000D40000-0x0000000000D67000-memory.dmpFilesize
156KB
-
memory/856-240-0x0000000000D70000-0x0000000000D92000-memory.dmpFilesize
136KB
-
memory/904-284-0x00000000037C0000-0x0000000003887000-memory.dmpFilesize
796KB
-
memory/904-285-0x0000000003890000-0x0000000003942000-memory.dmpFilesize
712KB
-
memory/904-273-0x0000000000000000-mapping.dmp
-
memory/1068-185-0x0000000000000000-mapping.dmp
-
memory/1100-175-0x00000000005F0000-0x00000000005FC000-memory.dmpFilesize
48KB
-
memory/1100-174-0x0000000000800000-0x0000000000806000-memory.dmpFilesize
24KB
-
memory/1100-238-0x0000000000800000-0x0000000000806000-memory.dmpFilesize
24KB
-
memory/1100-169-0x0000000000000000-mapping.dmp
-
memory/1184-248-0x0000000000000000-mapping.dmp
-
memory/1184-251-0x0000000000570000-0x0000000000598000-memory.dmpFilesize
160KB
-
memory/1216-198-0x0000000000000000-mapping.dmp
-
memory/1224-199-0x0000000000000000-mapping.dmp
-
memory/1248-191-0x0000000000000000-mapping.dmp
-
memory/1380-239-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1380-232-0x0000000000000000-mapping.dmp
-
memory/1380-233-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1380-236-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1380-263-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1416-223-0x0000000000000000-mapping.dmp
-
memory/1492-206-0x0000000000B80000-0x0000000000B88000-memory.dmpFilesize
32KB
-
memory/1492-200-0x0000000000000000-mapping.dmp
-
memory/1492-207-0x0000000000B70000-0x0000000000B7B000-memory.dmpFilesize
44KB
-
memory/1492-255-0x0000000000B80000-0x0000000000B88000-memory.dmpFilesize
32KB
-
memory/1684-218-0x0000000000000000-mapping.dmp
-
memory/1820-189-0x0000000000000000-mapping.dmp
-
memory/1924-254-0x00000000006B0000-0x00000000006B7000-memory.dmpFilesize
28KB
-
memory/1924-195-0x0000000000000000-mapping.dmp
-
memory/1924-202-0x00000000006A0000-0x00000000006AD000-memory.dmpFilesize
52KB
-
memory/1924-201-0x00000000006B0000-0x00000000006B7000-memory.dmpFilesize
28KB
-
memory/1960-197-0x0000000000000000-mapping.dmp
-
memory/2064-158-0x0000000000000000-mapping.dmp
-
memory/2064-216-0x0000000001230000-0x0000000001237000-memory.dmpFilesize
28KB
-
memory/2064-159-0x0000000001230000-0x0000000001237000-memory.dmpFilesize
28KB
-
memory/2064-160-0x0000000001220000-0x000000000122B000-memory.dmpFilesize
44KB
-
memory/2252-225-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/2252-161-0x0000000000000000-mapping.dmp
-
memory/2252-164-0x00000000004D0000-0x00000000004DF000-memory.dmpFilesize
60KB
-
memory/2252-163-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/2472-297-0x0000000001F40000-0x0000000001F64000-memory.dmpFilesize
144KB
-
memory/2472-293-0x0000000000000000-mapping.dmp
-
memory/2964-272-0x0000000000000000-mapping.dmp
-
memory/3048-179-0x0000000000000000-mapping.dmp
-
memory/3048-183-0x0000000000B40000-0x0000000000B45000-memory.dmpFilesize
20KB
-
memory/3048-242-0x0000000000B40000-0x0000000000B45000-memory.dmpFilesize
20KB
-
memory/3048-184-0x0000000000B30000-0x0000000000B39000-memory.dmpFilesize
36KB
-
memory/3260-243-0x0000000000400000-0x0000000000859000-memory.dmpFilesize
4.3MB
-
memory/3260-186-0x0000000000400000-0x0000000000859000-memory.dmpFilesize
4.3MB
-
memory/3260-170-0x0000000000000000-mapping.dmp
-
memory/3260-182-0x0000000000903000-0x0000000000922000-memory.dmpFilesize
124KB
-
memory/3344-259-0x0000000000000000-mapping.dmp
-
memory/3828-221-0x0000000000000000-mapping.dmp
-
memory/3960-209-0x0000000000000000-mapping.dmp
-
memory/4032-193-0x0000000001090000-0x0000000001096000-memory.dmpFilesize
24KB
-
memory/4032-247-0x0000000001090000-0x0000000001096000-memory.dmpFilesize
24KB
-
memory/4032-188-0x0000000000000000-mapping.dmp
-
memory/4032-194-0x0000000001080000-0x000000000108B000-memory.dmpFilesize
44KB
-
memory/4092-212-0x0000000000000000-mapping.dmp
-
memory/4168-256-0x0000000000000000-mapping.dmp
-
memory/4228-157-0x0000000002C55000-0x000000000314B000-memory.dmpFilesize
5.0MB
-
memory/4228-214-0x0000000002C55000-0x000000000314B000-memory.dmpFilesize
5.0MB
-
memory/4228-213-0x000000000E850000-0x000000000E9A6000-memory.dmpFilesize
1.3MB
-
memory/4228-151-0x0000000000000000-mapping.dmp
-
memory/4228-241-0x0000000003151000-0x000000000324A000-memory.dmpFilesize
996KB
-
memory/4228-211-0x0000000003151000-0x000000000324A000-memory.dmpFilesize
996KB
-
memory/4228-215-0x000000000E850000-0x000000000E9A6000-memory.dmpFilesize
1.3MB
-
memory/4324-134-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4324-135-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4324-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4324-132-0x0000000000AF2000-0x0000000000B07000-memory.dmpFilesize
84KB
-
memory/4480-144-0x0000000000000000-mapping.dmp
-
memory/4512-237-0x0000000000C80000-0x0000000000C85000-memory.dmpFilesize
20KB
-
memory/4512-168-0x0000000000C70000-0x0000000000C79000-memory.dmpFilesize
36KB
-
memory/4512-162-0x0000000000000000-mapping.dmp
-
memory/4512-173-0x0000000000C80000-0x0000000000C85000-memory.dmpFilesize
20KB
-
memory/4568-196-0x0000000000000000-mapping.dmp
-
memory/4596-190-0x0000000000000000-mapping.dmp
-
memory/4704-180-0x0000000000A83000-0x0000000000AA2000-memory.dmpFilesize
124KB
-
memory/4704-165-0x0000000000A83000-0x0000000000AA2000-memory.dmpFilesize
124KB
-
memory/4704-166-0x0000000000980000-0x00000000009BE000-memory.dmpFilesize
248KB
-
memory/4704-167-0x0000000000400000-0x0000000000859000-memory.dmpFilesize
4.3MB
-
memory/4704-181-0x0000000000400000-0x0000000000859000-memory.dmpFilesize
4.3MB
-
memory/4704-154-0x0000000000000000-mapping.dmp
-
memory/4772-279-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4772-277-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4772-281-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4772-280-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4772-278-0x0000000000BE8EA0-mapping.dmp
-
memory/4864-141-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4864-149-0x0000000004E70000-0x0000000004E82000-memory.dmpFilesize
72KB
-
memory/4864-217-0x0000000007400000-0x00000000075C2000-memory.dmpFilesize
1.8MB
-
memory/4864-187-0x0000000005E80000-0x0000000005EE6000-memory.dmpFilesize
408KB
-
memory/4864-148-0x00000000054A0000-0x00000000055AA000-memory.dmpFilesize
1.0MB
-
memory/4864-147-0x00000000055E0000-0x0000000005BF8000-memory.dmpFilesize
6.1MB
-
memory/4864-140-0x0000000000800000-0x000000000083E000-memory.dmpFilesize
248KB
-
memory/4864-192-0x0000000000879000-0x00000000008AA000-memory.dmpFilesize
196KB
-
memory/4864-136-0x0000000000000000-mapping.dmp
-
memory/4864-253-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4864-143-0x0000000004D10000-0x0000000004DA2000-memory.dmpFilesize
584KB
-
memory/4864-142-0x0000000004EF0000-0x0000000005494000-memory.dmpFilesize
5.6MB
-
memory/4864-150-0x0000000004E90000-0x0000000004ECC000-memory.dmpFilesize
240KB
-
memory/4864-139-0x0000000000879000-0x00000000008AA000-memory.dmpFilesize
196KB
-
memory/4864-222-0x00000000075E0000-0x0000000007B0C000-memory.dmpFilesize
5.2MB
-
memory/4864-252-0x0000000000879000-0x00000000008AA000-memory.dmpFilesize
196KB
-
memory/4896-203-0x0000000000000000-mapping.dmp
-
memory/4896-208-0x00000000007B0000-0x00000000015C9000-memory.dmpFilesize
14.1MB
-
memory/4896-210-0x00000000007B0000-0x00000000015C9000-memory.dmpFilesize
14.1MB
-
memory/4924-226-0x0000000000000000-mapping.dmp
-
memory/4936-269-0x0000000003260000-0x0000000003312000-memory.dmpFilesize
712KB
-
memory/4936-268-0x0000000003190000-0x0000000003257000-memory.dmpFilesize
796KB
-
memory/4936-260-0x0000000000000000-mapping.dmp
-
memory/5092-228-0x0000000000000000-mapping.dmp
-
memory/5092-229-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5092-231-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB