Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:15
Behavioral task
behavioral1
Sample
01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe
Resource
win10v2004-20220901-en
General
-
Target
01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe
-
Size
324KB
-
MD5
18573585e9de0e250b2bce76d5e12c34
-
SHA1
3b7b32390b092d7aeb9c68991ef31e453261cf59
-
SHA256
01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e
-
SHA512
a77e4cb2458f33c2046c615f975a3d6dc45783254088199a7a5e688deeade454b3268b51e4b8acdd79cb26983a2a463fa132df5959d46b06596b147500123fb6
-
SSDEEP
6144:d/j5C+E23/4YIJ8m1MxUyRzoVOBlYQflIGE:d/s+hP4BJTM6++OBlYERE
Malware Config
Signatures
-
Processes:
resource yara_rule C:\0ad9516a.exe aspack_v212_v242 C:\0ad9516a.exe aspack_v212_v242 C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll aspack_v212_v242 \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll aspack_v212_v242 \??\c:\windows\SysWOW64\irmon.dll aspack_v212_v242 C:\Windows\SysWOW64\Irmon.dll aspack_v212_v242 C:\Windows\SysWOW64\Nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\ntmssvc.dll aspack_v212_v242 C:\Windows\SysWOW64\Ntmssvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwcworkstation.dll aspack_v212_v242 C:\Windows\SysWOW64\NWCWorkstation.dll aspack_v212_v242 C:\Windows\SysWOW64\Nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\srservice.dll aspack_v212_v242 C:\Windows\SysWOW64\SRService.dll aspack_v212_v242 \??\c:\windows\SysWOW64\wmdmpmsp.dll aspack_v212_v242 C:\Windows\SysWOW64\WmdmPmSp.dll aspack_v212_v242 \??\c:\windows\SysWOW64\logonhours.dll aspack_v212_v242 C:\Windows\SysWOW64\LogonHours.dll aspack_v212_v242 \??\c:\windows\SysWOW64\pcaudit.dll aspack_v212_v242 C:\Windows\SysWOW64\PCAudit.dll aspack_v212_v242 \??\c:\windows\SysWOW64\helpsvc.dll aspack_v212_v242 C:\Windows\SysWOW64\helpsvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\uploadmgr.dll aspack_v212_v242 C:\Windows\SysWOW64\uploadmgr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
0ad9516a.exepid process 1496 0ad9516a.exe -
Sets DLL path for service in the registry 2 TTPs 14 IoCs
Processes:
0ad9516a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 0ad9516a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 0ad9516a.exe -
Processes:
resource yara_rule C:\0ad9516a.exe upx C:\0ad9516a.exe upx behavioral2/memory/1496-135-0x0000000000320000-0x000000000036E000-memory.dmp upx behavioral2/memory/1496-136-0x0000000000320000-0x000000000036E000-memory.dmp upx behavioral2/memory/1780-137-0x0000000020000000-0x0000000020053000-memory.dmp upx behavioral2/memory/3852-140-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/3852-141-0x00000000759B0000-0x00000000759FE000-memory.dmp upx C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll upx \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll upx behavioral2/memory/3852-142-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\irmon.dll upx C:\Windows\SysWOW64\Irmon.dll upx behavioral2/memory/2020-146-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2020-147-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2020-148-0x00000000759B0000-0x00000000759FE000-memory.dmp upx C:\Windows\SysWOW64\Nla.dll upx \??\c:\windows\SysWOW64\nla.dll upx behavioral2/memory/944-152-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/944-151-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/944-153-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\ntmssvc.dll upx C:\Windows\SysWOW64\Ntmssvc.dll upx behavioral2/memory/3532-156-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/3532-157-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/3532-158-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\nwcworkstation.dll upx C:\Windows\SysWOW64\NWCWorkstation.dll upx behavioral2/memory/2088-162-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2088-164-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2088-163-0x00000000759B0000-0x00000000759FE000-memory.dmp upx C:\Windows\SysWOW64\Nwsapagent.dll upx \??\c:\windows\SysWOW64\nwsapagent.dll upx behavioral2/memory/2636-168-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2636-167-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/2636-169-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\srservice.dll upx C:\Windows\SysWOW64\SRService.dll upx behavioral2/memory/1428-172-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/1428-173-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/1428-174-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\wmdmpmsp.dll upx C:\Windows\SysWOW64\WmdmPmSp.dll upx behavioral2/memory/1876-177-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/1876-178-0x00000000759B0000-0x00000000759FE000-memory.dmp upx behavioral2/memory/1876-179-0x00000000759B0000-0x00000000759FE000-memory.dmp upx \??\c:\windows\SysWOW64\logonhours.dll upx C:\Windows\SysWOW64\LogonHours.dll upx behavioral2/memory/1280-183-0x00000000753A0000-0x00000000753EE000-memory.dmp upx behavioral2/memory/1280-182-0x00000000753A0000-0x00000000753EE000-memory.dmp upx behavioral2/memory/1280-184-0x00000000753A0000-0x00000000753EE000-memory.dmp upx behavioral2/memory/1780-185-0x0000000020000000-0x0000000020053000-memory.dmp upx \??\c:\windows\SysWOW64\pcaudit.dll upx C:\Windows\SysWOW64\PCAudit.dll upx behavioral2/memory/4364-188-0x0000000070C30000-0x0000000070C7E000-memory.dmp upx behavioral2/memory/4364-189-0x0000000070C30000-0x0000000070C7E000-memory.dmp upx behavioral2/memory/4364-190-0x0000000070C30000-0x0000000070C7E000-memory.dmp upx \??\c:\windows\SysWOW64\helpsvc.dll upx C:\Windows\SysWOW64\helpsvc.dll upx behavioral2/memory/820-194-0x0000000070BF0000-0x0000000070C3E000-memory.dmp upx behavioral2/memory/820-193-0x0000000070BF0000-0x0000000070C3E000-memory.dmp upx behavioral2/memory/820-195-0x0000000070BF0000-0x0000000070C3E000-memory.dmp upx \??\c:\windows\SysWOW64\uploadmgr.dll upx C:\Windows\SysWOW64\uploadmgr.dll upx behavioral2/memory/4280-199-0x0000000070830000-0x000000007087E000-memory.dmp upx -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 3852 svchost.exe 2020 svchost.exe 944 svchost.exe 3532 svchost.exe 2088 svchost.exe 2636 svchost.exe 1428 svchost.exe 1876 svchost.exe 1280 svchost.exe 4364 svchost.exe 820 svchost.exe 4280 svchost.exe -
Drops file in System32 directory 14 IoCs
Processes:
0ad9516a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Wmi.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 0ad9516a.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 0ad9516a.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3719623791" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000c6b3a334d84c8cff19dd14ba017b1d4f729ad5fc12771f5f08b6cbdc8620dc8f000000000e8000000002000020000000e2d7ab936206376e4e317d3a63f36c229da5966bc378a43683aae244581f6ed420000000c10816f878b5bf5d6c49f0d4a96f706440b674572a101774da1e466fd72b273a400000006f98a94f07de30d52fa8479f2fa45b2a9373eb0e47f316ae466aed4fc6d27d697c70a13aed74e7d96e115f3dc2946b7f3f1bf7c8923d0f0c6e5a1b7d13515ae1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3708216839" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3708216839" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000006dac734ba8c9837e43bec0ff34f9ed8e353bf509def5a857583fc5fc83f3c6df000000000e800000000200002000000087b39735e59626904c60bdd26ff4eb2f96c74ceb9ac9c38f76925df2a750fb972000000073d4fa3726b6b4be662c3cd0df01936f1329b9c2e8c8d24f9bb6cb0981b438744000000058b2c2f6b7b95b975cfdbf9553735392a3349467af2bfd98f74169dbec396fc8260f30b04dd39698b635b3911ea71e9cfc845b55057d1b098e867d5c6fdfbcfc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998427" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904a71de9bffd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{08773285-6B8F-11ED-A0EE-E6C35CACCF0B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c07ade9bffd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376014734" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0ad9516a.exepid process 1496 0ad9516a.exe 1496 0ad9516a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1812 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1812 iexplore.exe 1812 iexplore.exe 492 IEXPLORE.EXE 492 IEXPLORE.EXE 492 IEXPLORE.EXE 492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exeiexplore.exedescription pid process target process PID 1780 wrote to memory of 1496 1780 01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe 0ad9516a.exe PID 1780 wrote to memory of 1496 1780 01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe 0ad9516a.exe PID 1780 wrote to memory of 1496 1780 01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe 0ad9516a.exe PID 1780 wrote to memory of 1812 1780 01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe iexplore.exe PID 1780 wrote to memory of 1812 1780 01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe iexplore.exe PID 1812 wrote to memory of 492 1812 iexplore.exe IEXPLORE.EXE PID 1812 wrote to memory of 492 1812 iexplore.exe IEXPLORE.EXE PID 1812 wrote to memory of 492 1812 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe"C:\Users\Admin\AppData\Local\Temp\01f388c369337b3e30fd0ab226612f37dc1c0beeba2ddb443c15aab6ea4cbc2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\0ad9516a.exeC:\0ad9516a.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.macromedia.com/shockwave/download/?P1_Prod_Version=SWArchive10.0.02⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:492
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
PID:3852
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
PID:2020
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
PID:944
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
PID:3532
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
PID:2088
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
PID:2636
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
PID:1428
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
PID:1876
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
PID:1280
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
PID:4364
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
PID:820
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
PID:4280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\0ad9516a.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\0ad9516a.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5e32d02ce684c01ef3af05fae9066160e
SHA129c7a6e8ed553ac2765634265d1db041d6d422ec
SHA256b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71
SHA512e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD566728960194b66260dc13308d6314856
SHA1b19a0042ef2ce92b4384972c9aac6f63fd682228
SHA256cff711901b5d5857ae9351ad09d32bd02366acf797f147772acd078497f745ac
SHA512d31dacbce9b1055d4981680ce9c552e7f5beeec00fac791fe142ac373d4e2ae0a2953af58e54543454bcd3d17eea1a4d10a7253170e5c3ff6555bd5c5dd018b3
-
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\LogonHours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\NWCWorkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\PCAudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\SRService.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\WmdmPmSp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\logonhours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\pcaudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\srservice.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\wmdmpmsp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
memory/820-194-0x0000000070BF0000-0x0000000070C3E000-memory.dmpFilesize
312KB
-
memory/820-193-0x0000000070BF0000-0x0000000070C3E000-memory.dmpFilesize
312KB
-
memory/820-195-0x0000000070BF0000-0x0000000070C3E000-memory.dmpFilesize
312KB
-
memory/944-153-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/944-151-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/944-152-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1280-184-0x00000000753A0000-0x00000000753EE000-memory.dmpFilesize
312KB
-
memory/1280-182-0x00000000753A0000-0x00000000753EE000-memory.dmpFilesize
312KB
-
memory/1280-183-0x00000000753A0000-0x00000000753EE000-memory.dmpFilesize
312KB
-
memory/1428-173-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1428-172-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1428-174-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1496-143-0x0000000003070000-0x0000000007070000-memory.dmpFilesize
64.0MB
-
memory/1496-132-0x0000000000000000-mapping.dmp
-
memory/1496-201-0x0000000000320000-0x000000000036E000-memory.dmpFilesize
312KB
-
memory/1496-159-0x0000000003070000-0x0000000007070000-memory.dmpFilesize
64.0MB
-
memory/1496-135-0x0000000000320000-0x000000000036E000-memory.dmpFilesize
312KB
-
memory/1496-136-0x0000000000320000-0x000000000036E000-memory.dmpFilesize
312KB
-
memory/1780-137-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/1780-185-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/1876-178-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1876-179-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/1876-177-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2020-146-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2020-147-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2020-148-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2088-163-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2088-164-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2088-162-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2636-167-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2636-168-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/2636-169-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3532-158-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3532-156-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3532-157-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3852-140-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3852-141-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/3852-142-0x00000000759B0000-0x00000000759FE000-memory.dmpFilesize
312KB
-
memory/4280-198-0x0000000070830000-0x000000007087E000-memory.dmpFilesize
312KB
-
memory/4280-200-0x0000000070830000-0x000000007087E000-memory.dmpFilesize
312KB
-
memory/4280-199-0x0000000070830000-0x000000007087E000-memory.dmpFilesize
312KB
-
memory/4364-190-0x0000000070C30000-0x0000000070C7E000-memory.dmpFilesize
312KB
-
memory/4364-188-0x0000000070C30000-0x0000000070C7E000-memory.dmpFilesize
312KB
-
memory/4364-189-0x0000000070C30000-0x0000000070C7E000-memory.dmpFilesize
312KB