Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe
Resource
win10v2004-20220812-en
General
-
Target
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe
-
Size
208KB
-
MD5
6bced378bbab315fc87849cb22ed31b2
-
SHA1
633477e412766a04ef492824b1343979822eba4e
-
SHA256
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8
-
SHA512
c2ec1396f96a82ed942d7fbf215f120bb28fa6bb941471ad63302a17218bd8118c8bf1373242ddb7a2b57dbc990caafbe7ef9a5f14aaf3f1b465157d783ca5c4
-
SSDEEP
3072:WRXOwh64jOy7IgrQbAT/28ep1PLNiEn07nVcTFi:a2B5Et
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2928-140-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/2928-141-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/2928-142-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/2928-146-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1040-153-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1040-156-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/912-163-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/912-166-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/952-173-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/952-176-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/3756-183-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/3756-186-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1784-193-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1784-196-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4356-203-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4356-206-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4636-213-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4636-216-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1928-223-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1928-226-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4472-233-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/4472-236-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1972-243-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 behavioral2/memory/1972-246-0x0000000000400000-0x0000000000421000-memory.dmp modiloader_stage2 -
Executes dropped EXE 23 IoCs
Processes:
Service.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exeazerhost.exeService.exepid process 2928 Service.exe 1044 azerhost.exe 1040 Service.exe 2452 azerhost.exe 912 Service.exe 3440 azerhost.exe 952 Service.exe 4592 azerhost.exe 3756 Service.exe 2252 azerhost.exe 1784 Service.exe 1492 azerhost.exe 4356 Service.exe 3544 azerhost.exe 4636 Service.exe 4132 azerhost.exe 1928 Service.exe 2404 azerhost.exe 4472 Service.exe 112 azerhost.exe 1972 Service.exe 4744 azerhost.exe 1512 Service.exe -
Processes:
resource yara_rule behavioral2/memory/2928-135-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-138-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-139-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-140-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-142-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2928-146-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1040-153-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1040-156-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/912-163-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/912-166-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/952-173-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/952-176-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3756-183-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3756-186-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1784-193-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1784-196-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4356-203-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4356-206-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4636-213-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4636-216-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1928-223-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1928-226-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4472-233-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4472-236-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1972-243-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1972-246-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Service.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Service.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FacbookUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\FacbookUpdate.exe" e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe -
Suspicious use of SetThreadContext 12 IoCs
Processes:
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exedescription pid process target process PID 1064 set thread context of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 4356 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 4636 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 1928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 4472 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 1972 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 set thread context of 1512 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 11 IoCs
Processes:
Service.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exeService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Service.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exepid process 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exedescription pid process Token: SeDebugPrivilege 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exeService.exeService.exeService.exeService.exeService.exeService.exedescription pid process target process PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 2928 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 2928 wrote to memory of 1044 2928 Service.exe azerhost.exe PID 2928 wrote to memory of 1044 2928 Service.exe azerhost.exe PID 2928 wrote to memory of 1044 2928 Service.exe azerhost.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1040 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1040 wrote to memory of 2452 1040 Service.exe azerhost.exe PID 1040 wrote to memory of 2452 1040 Service.exe azerhost.exe PID 1040 wrote to memory of 2452 1040 Service.exe azerhost.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 912 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 912 wrote to memory of 3440 912 Service.exe azerhost.exe PID 912 wrote to memory of 3440 912 Service.exe azerhost.exe PID 912 wrote to memory of 3440 912 Service.exe azerhost.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 952 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 952 wrote to memory of 4592 952 Service.exe azerhost.exe PID 952 wrote to memory of 4592 952 Service.exe azerhost.exe PID 952 wrote to memory of 4592 952 Service.exe azerhost.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 3756 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 3756 wrote to memory of 2252 3756 Service.exe azerhost.exe PID 3756 wrote to memory of 2252 3756 Service.exe azerhost.exe PID 3756 wrote to memory of 2252 3756 Service.exe azerhost.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1064 wrote to memory of 1784 1064 e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe Service.exe PID 1784 wrote to memory of 1492 1784 Service.exe azerhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe"C:\Users\Admin\AppData\Local\Temp\e1c30cccdb98279665c7564db62ace0c02980b7ecff50dee51df4ccda84b7eb8.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\Documents\Services\azerhost.exe"C:\Users\Admin\Documents\Services\azerhost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\Services\azerhost.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/112-234-0x0000000000000000-mapping.dmp
-
memory/912-163-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/912-157-0x0000000000000000-mapping.dmp
-
memory/912-166-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/952-167-0x0000000000000000-mapping.dmp
-
memory/952-173-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/952-176-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1040-147-0x0000000000000000-mapping.dmp
-
memory/1040-156-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1040-153-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1044-143-0x0000000000000000-mapping.dmp
-
memory/1064-133-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/1064-132-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/1492-194-0x0000000000000000-mapping.dmp
-
memory/1512-247-0x0000000000000000-mapping.dmp
-
memory/1784-187-0x0000000000000000-mapping.dmp
-
memory/1784-193-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1784-196-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-226-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-223-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-217-0x0000000000000000-mapping.dmp
-
memory/1972-243-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1972-246-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1972-237-0x0000000000000000-mapping.dmp
-
memory/2252-184-0x0000000000000000-mapping.dmp
-
memory/2404-224-0x0000000000000000-mapping.dmp
-
memory/2452-154-0x0000000000000000-mapping.dmp
-
memory/2928-140-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-138-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-142-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-139-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-134-0x0000000000000000-mapping.dmp
-
memory/2928-135-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2928-146-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3440-164-0x0000000000000000-mapping.dmp
-
memory/3544-204-0x0000000000000000-mapping.dmp
-
memory/3756-186-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3756-183-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3756-177-0x0000000000000000-mapping.dmp
-
memory/4132-214-0x0000000000000000-mapping.dmp
-
memory/4356-206-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4356-203-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4356-197-0x0000000000000000-mapping.dmp
-
memory/4472-233-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4472-236-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4472-227-0x0000000000000000-mapping.dmp
-
memory/4592-174-0x0000000000000000-mapping.dmp
-
memory/4636-216-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4636-213-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4636-207-0x0000000000000000-mapping.dmp
-
memory/4744-244-0x0000000000000000-mapping.dmp