Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
Resource
win10v2004-20220901-en
General
-
Target
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe
-
Size
556KB
-
MD5
55113c969cc06b001416248a5fa292e4
-
SHA1
9046e539b20407a00237f07eab571e21cc1896b8
-
SHA256
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0
-
SHA512
5252afc3886b09d55139de6d298230f4c2c45deddc8824373364947de510ce45cf6e37d0eb9802f3d5c5587a3a4e03730d780c1a0906f98854c77167ca981089
-
SSDEEP
12288:J7Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:J7L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
NB4wr66jY4.exeheusi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heusi.exe -
Executes dropped EXE 10 IoCs
Processes:
NB4wr66jY4.exeheusi.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe2xek.exe3xek.exeXpid process 4880 NB4wr66jY4.exe 3780 heusi.exe 2868 2xek.exe 4636 2xek.exe 4268 2xek.exe 1904 2xek.exe 4924 2xek.exe 2320 2xek.exe 3924 3xek.exe 4284 X -
Processes:
resource yara_rule behavioral2/memory/4268-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-159-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1904-163-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4924-171-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1904-168-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4924-167-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4268-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-173-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2320-174-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2320-178-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2320-177-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2320-183-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1904-184-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4924-185-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4268-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NB4wr66jY4.exe037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation NB4wr66jY4.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 55 IoCs
Processes:
heusi.exeNB4wr66jY4.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /f" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /U" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /d" heusi.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /a" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /Y" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /y" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /u" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /N" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /V" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /X" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /H" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /B" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /Z" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /L" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /l" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /j" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /s" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /h" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /C" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /P" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /T" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /v" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /g" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /i" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /W" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /S" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /r" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /D" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /b" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /m" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /n" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /e" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /I" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /q" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /J" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /p" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /G" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /R" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /x" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /t" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /k" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /c" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /Q" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /A" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /K" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /E" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /M" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /O" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /s" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /F" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /z" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /o" heusi.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heusi = "C:\\Users\\Admin\\heusi.exe /w" heusi.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2xek.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2xek.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2xek.exedescription pid process target process PID 2868 set thread context of 4636 2868 2xek.exe 2xek.exe PID 2868 set thread context of 4268 2868 2xek.exe 2xek.exe PID 2868 set thread context of 1904 2868 2xek.exe 2xek.exe PID 2868 set thread context of 4924 2868 2xek.exe 2xek.exe PID 2868 set thread context of 2320 2868 2xek.exe 2xek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4264 4636 WerFault.exe 2xek.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1252 tasklist.exe 2028 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
NB4wr66jY4.exe2xek.exeheusi.exe3xek.exeXpid process 4880 NB4wr66jY4.exe 4880 NB4wr66jY4.exe 4880 NB4wr66jY4.exe 4880 NB4wr66jY4.exe 4268 2xek.exe 4268 2xek.exe 3780 heusi.exe 3780 heusi.exe 3924 3xek.exe 3924 3xek.exe 4284 X 4284 X 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 4268 2xek.exe 4268 2xek.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe 3780 heusi.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2056 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
tasklist.exe3xek.exeExplorer.EXEtasklist.exedescription pid process Token: SeDebugPrivilege 1252 tasklist.exe Token: SeDebugPrivilege 3924 3xek.exe Token: SeDebugPrivilege 3924 3xek.exe Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeDebugPrivilege 2028 tasklist.exe Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exeNB4wr66jY4.exeheusi.exe2xek.exe2xek.exe2xek.exepid process 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 4880 NB4wr66jY4.exe 3780 heusi.exe 2868 2xek.exe 4924 2xek.exe 2320 2xek.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exeNB4wr66jY4.execmd.exe2xek.exeheusi.exe3xek.exeXcmd.exedescription pid process target process PID 3548 wrote to memory of 4880 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 3548 wrote to memory of 4880 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 3548 wrote to memory of 4880 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe NB4wr66jY4.exe PID 4880 wrote to memory of 3780 4880 NB4wr66jY4.exe heusi.exe PID 4880 wrote to memory of 3780 4880 NB4wr66jY4.exe heusi.exe PID 4880 wrote to memory of 3780 4880 NB4wr66jY4.exe heusi.exe PID 3548 wrote to memory of 2868 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 3548 wrote to memory of 2868 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 3548 wrote to memory of 2868 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 2xek.exe PID 4880 wrote to memory of 4644 4880 NB4wr66jY4.exe cmd.exe PID 4880 wrote to memory of 4644 4880 NB4wr66jY4.exe cmd.exe PID 4880 wrote to memory of 4644 4880 NB4wr66jY4.exe cmd.exe PID 4644 wrote to memory of 1252 4644 cmd.exe tasklist.exe PID 4644 wrote to memory of 1252 4644 cmd.exe tasklist.exe PID 4644 wrote to memory of 1252 4644 cmd.exe tasklist.exe PID 2868 wrote to memory of 4636 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4636 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4636 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4636 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4268 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 1904 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 4924 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 2868 wrote to memory of 2320 2868 2xek.exe 2xek.exe PID 3548 wrote to memory of 3924 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 3548 wrote to memory of 3924 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 3548 wrote to memory of 3924 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe 3xek.exe PID 3780 wrote to memory of 1252 3780 heusi.exe tasklist.exe PID 3780 wrote to memory of 1252 3780 heusi.exe tasklist.exe PID 3924 wrote to memory of 4284 3924 3xek.exe X PID 3924 wrote to memory of 4284 3924 3xek.exe X PID 4284 wrote to memory of 2056 4284 X Explorer.EXE PID 3548 wrote to memory of 1788 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe cmd.exe PID 3548 wrote to memory of 1788 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe cmd.exe PID 3548 wrote to memory of 1788 3548 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe cmd.exe PID 1788 wrote to memory of 2028 1788 cmd.exe tasklist.exe PID 1788 wrote to memory of 2028 1788 cmd.exe tasklist.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe"C:\Users\Admin\AppData\Local\Temp\037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\heusi.exe"C:\Users\Admin\heusi.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 805⤵
- Program crash
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\33b020d7\X*0*bc*b54cbfe1*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 037bf2f69da15246646203c0a7bcbf602136b02f61601df3a5dd8ce1e8da65c0.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 46361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\2xek.exeFilesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
C:\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
C:\Users\Admin\3xek.exeFilesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
C:\Users\Admin\AppData\Local\33b020d7\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\AppData\Local\33b020d7\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
C:\Users\Admin\NB4wr66jY4.exeFilesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
C:\Users\Admin\heusi.exeFilesize
224KB
MD50e4e736e29447363a6fa335646a89e70
SHA1ec7e705cdea807d0bd7852998cda6b8de4883236
SHA2563b0310d2224072517608760b6ac2003b2c36444c3f27641ed8a640788aedfb50
SHA512577eaa6236d4dd0164a2fc464adddd4f8ca23c6d912007f715ccf15c6963f73457e1d4e66a5bdacece019e03d0bbe6da4e5f18ab24a27a488c16b797a82952a8
-
C:\Users\Admin\heusi.exeFilesize
224KB
MD50e4e736e29447363a6fa335646a89e70
SHA1ec7e705cdea807d0bd7852998cda6b8de4883236
SHA2563b0310d2224072517608760b6ac2003b2c36444c3f27641ed8a640788aedfb50
SHA512577eaa6236d4dd0164a2fc464adddd4f8ca23c6d912007f715ccf15c6963f73457e1d4e66a5bdacece019e03d0bbe6da4e5f18ab24a27a488c16b797a82952a8
-
memory/1252-150-0x0000000000000000-mapping.dmp
-
memory/1788-194-0x0000000000000000-mapping.dmp
-
memory/1904-157-0x0000000000000000-mapping.dmp
-
memory/1904-184-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1904-159-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1904-163-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1904-168-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2028-195-0x0000000000000000-mapping.dmp
-
memory/2056-230-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-236-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-258-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/2056-257-0x00000000028E0000-0x00000000028F0000-memory.dmpFilesize
64KB
-
memory/2056-256-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-255-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-254-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-253-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-252-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-251-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-250-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-249-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-248-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-247-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-246-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-245-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-242-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-243-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-244-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-241-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-240-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-239-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-238-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-237-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-235-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-197-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-198-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-199-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-200-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-201-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-202-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-203-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-204-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-205-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-208-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-207-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-206-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-209-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-211-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-210-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-212-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-213-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-214-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/2056-215-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-216-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-217-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-218-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-219-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-220-0x0000000002DA0000-0x0000000002DB0000-memory.dmpFilesize
64KB
-
memory/2056-221-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-222-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-223-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-224-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-225-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-226-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-227-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-228-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-229-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-234-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-231-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-232-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-233-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2320-172-0x0000000000000000-mapping.dmp
-
memory/2320-174-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2320-178-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2320-177-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2320-183-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2868-142-0x0000000000000000-mapping.dmp
-
memory/3780-139-0x0000000000000000-mapping.dmp
-
memory/3924-186-0x0000000000000000-mapping.dmp
-
memory/3924-192-0x0000000030670000-0x00000000306C7000-memory.dmpFilesize
348KB
-
memory/3924-193-0x0000000000651000-0x0000000000686000-memory.dmpFilesize
212KB
-
memory/4268-196-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4268-153-0x0000000000000000-mapping.dmp
-
memory/4268-154-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4268-165-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4268-158-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4268-161-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4284-189-0x0000000000000000-mapping.dmp
-
memory/4636-151-0x0000000000000000-mapping.dmp
-
memory/4644-147-0x0000000000000000-mapping.dmp
-
memory/4880-134-0x0000000000000000-mapping.dmp
-
memory/4924-167-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4924-173-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4924-171-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4924-164-0x0000000000000000-mapping.dmp
-
memory/4924-185-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB