Resubmissions
21-02-2024 21:44
240221-1lqdrafg5w 1021-02-2024 18:39
240221-xanh8sdd21 1015-02-2023 18:24
230215-w18fnada5x 1015-02-2023 17:35
230215-v6c19scg9t 1010-02-2023 13:30
230210-qr8geaah9x 1010-02-2023 13:25
230210-qn1x6abc29 1010-02-2023 13:11
230210-qe8awaag29 1029-01-2023 06:15
230129-gzxv7sbe38 1029-01-2023 06:02
230129-grzptsbb44 10Analysis
-
max time kernel
171s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win10v2004-20221111-en
General
-
Target
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
-
Size
298KB
-
MD5
11511ba5fd4de1fc5051d0bcefb388ae
-
SHA1
5e9476f39df92e01d0952e703869e71f85d470cd
-
SHA256
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
-
SHA512
904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
SSDEEP
3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP
Malware Config
Extracted
djvu
http://bihsy.com/lancer/get.php
-
extension
.vvoo
-
offline_id
9c20OtJsXdFeF07b1IeFK5ERGv1zIb659YG380t1
-
payload_url
http://uaery.top/dl/build2.exe
http://bihsy.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IiDRZpWuwI Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0645JOsie
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral2/memory/1416-154-0x0000000002370000-0x000000000248B000-memory.dmp family_djvu behavioral2/memory/1108-169-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1108-171-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1108-172-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1108-179-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1108-198-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3496-227-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3496-228-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3496-231-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4304-133-0x0000000002060000-0x0000000002069000-memory.dmp family_smokeloader behavioral2/memory/4616-156-0x0000000000500000-0x0000000000509000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4584 3164 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4224 3164 rundll32.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
A421.exe6A8.exeB76E.exe7F03.exeliuj.exeliuj.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation A421.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6A8.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation B76E.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 7F03.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation liuj.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation liuj.exe -
Executes dropped EXE 20 IoCs
Processes:
7F03.exe9E06.exeA421.exeA9B0.exeACBF.exeB76E.exeA421.exe6A8.exe9B6.exellpb1133.exellpb1133.exeA421.exeliuj.exeliuj.exeliuj.exeliuj.exeXandETC.exeXandETC.exeA421.exesvcupdater.exepid process 4888 7F03.exe 1212 9E06.exe 1416 A421.exe 4616 A9B0.exe 4656 ACBF.exe 748 B76E.exe 1108 A421.exe 3920 6A8.exe 4384 9B6.exe 2452 llpb1133.exe 3120 llpb1133.exe 1452 A421.exe 1512 liuj.exe 2256 liuj.exe 1356 liuj.exe 4336 liuj.exe 1312 XandETC.exe 3996 XandETC.exe 3496 A421.exe 2652 svcupdater.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\llpb1133.exe vmprotect C:\Users\Admin\AppData\Local\Temp\llpb1133.exe vmprotect C:\Users\Admin\AppData\Local\Temp\llpb1133.exe vmprotect C:\Users\Admin\AppData\Local\Temp\llpb1133.exe vmprotect behavioral2/memory/2452-203-0x0000000140000000-0x0000000140620000-memory.dmp vmprotect behavioral2/memory/3120-204-0x0000000140000000-0x0000000140620000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
A421.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1d1178b7-669a-4f1e-9363-e3760139b259\\A421.exe\" --AutoStart" A421.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 57 api.2ip.ua 60 api.2ip.ua 77 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
A421.exeA421.exedescription pid process target process PID 1416 set thread context of 1108 1416 A421.exe A421.exe PID 1452 set thread context of 3496 1452 A421.exe A421.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3784 4656 WerFault.exe ACBF.exe 1972 4888 WerFault.exe 7F03.exe 3220 4384 WerFault.exe 9B6.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
A9B0.exe79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A9B0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A9B0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A9B0.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 71 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exepid process 4304 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 4304 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 772 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exeA9B0.exepid process 4304 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 4616 A9B0.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
A421.exeA421.exeB76E.exe6A8.exe7F03.exeliuj.exeliuj.exeA421.exedescription pid process target process PID 772 wrote to memory of 4888 772 7F03.exe PID 772 wrote to memory of 4888 772 7F03.exe PID 772 wrote to memory of 4888 772 7F03.exe PID 772 wrote to memory of 1212 772 9E06.exe PID 772 wrote to memory of 1212 772 9E06.exe PID 772 wrote to memory of 1212 772 9E06.exe PID 772 wrote to memory of 1416 772 A421.exe PID 772 wrote to memory of 1416 772 A421.exe PID 772 wrote to memory of 1416 772 A421.exe PID 772 wrote to memory of 4616 772 A9B0.exe PID 772 wrote to memory of 4616 772 A9B0.exe PID 772 wrote to memory of 4616 772 A9B0.exe PID 772 wrote to memory of 4656 772 ACBF.exe PID 772 wrote to memory of 4656 772 ACBF.exe PID 772 wrote to memory of 4656 772 ACBF.exe PID 772 wrote to memory of 748 772 B76E.exe PID 772 wrote to memory of 748 772 B76E.exe PID 772 wrote to memory of 748 772 B76E.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 1416 wrote to memory of 1108 1416 A421.exe A421.exe PID 772 wrote to memory of 3920 772 6A8.exe PID 772 wrote to memory of 3920 772 6A8.exe PID 772 wrote to memory of 3920 772 6A8.exe PID 772 wrote to memory of 4384 772 9B6.exe PID 772 wrote to memory of 4384 772 9B6.exe PID 772 wrote to memory of 4384 772 9B6.exe PID 1108 wrote to memory of 5004 1108 A421.exe icacls.exe PID 1108 wrote to memory of 5004 1108 A421.exe icacls.exe PID 1108 wrote to memory of 5004 1108 A421.exe icacls.exe PID 1108 wrote to memory of 1452 1108 A421.exe A421.exe PID 1108 wrote to memory of 1452 1108 A421.exe A421.exe PID 1108 wrote to memory of 1452 1108 A421.exe A421.exe PID 748 wrote to memory of 3120 748 B76E.exe llpb1133.exe PID 748 wrote to memory of 3120 748 B76E.exe llpb1133.exe PID 3920 wrote to memory of 2452 3920 6A8.exe llpb1133.exe PID 3920 wrote to memory of 2452 3920 6A8.exe llpb1133.exe PID 4888 wrote to memory of 1152 4888 7F03.exe schtasks.exe PID 4888 wrote to memory of 1152 4888 7F03.exe schtasks.exe PID 4888 wrote to memory of 1152 4888 7F03.exe schtasks.exe PID 748 wrote to memory of 1512 748 B76E.exe liuj.exe PID 748 wrote to memory of 1512 748 B76E.exe liuj.exe PID 748 wrote to memory of 1512 748 B76E.exe liuj.exe PID 3920 wrote to memory of 2256 3920 6A8.exe liuj.exe PID 3920 wrote to memory of 2256 3920 6A8.exe liuj.exe PID 3920 wrote to memory of 2256 3920 6A8.exe liuj.exe PID 2256 wrote to memory of 1356 2256 liuj.exe liuj.exe PID 2256 wrote to memory of 1356 2256 liuj.exe liuj.exe PID 2256 wrote to memory of 1356 2256 liuj.exe liuj.exe PID 1512 wrote to memory of 4336 1512 liuj.exe liuj.exe PID 1512 wrote to memory of 4336 1512 liuj.exe liuj.exe PID 1512 wrote to memory of 4336 1512 liuj.exe liuj.exe PID 3920 wrote to memory of 1312 3920 6A8.exe XandETC.exe PID 3920 wrote to memory of 1312 3920 6A8.exe XandETC.exe PID 748 wrote to memory of 3996 748 B76E.exe XandETC.exe PID 748 wrote to memory of 3996 748 B76E.exe XandETC.exe PID 1452 wrote to memory of 3496 1452 A421.exe A421.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7F03.exeC:\Users\Admin\AppData\Local\Temp\7F03.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 10842⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9E06.exeC:\Users\Admin\AppData\Local\Temp\9E06.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A421.exeC:\Users\Admin\AppData\Local\Temp\A421.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A421.exeC:\Users\Admin\AppData\Local\Temp\A421.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\1d1178b7-669a-4f1e-9363-e3760139b259" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\A421.exe"C:\Users\Admin\AppData\Local\Temp\A421.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A421.exe"C:\Users\Admin\AppData\Local\Temp\A421.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A9B0.exeC:\Users\Admin\AppData\Local\Temp\A9B0.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\ACBF.exeC:\Users\Admin\AppData\Local\Temp\ACBF.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 3322⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\B76E.exeC:\Users\Admin\AppData\Local\Temp\B76E.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\liuj.exe"C:\Users\Admin\AppData\Local\Temp\liuj.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\liuj.exe"C:\Users\Admin\AppData\Local\Temp\liuj.exe" -h3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4656 -ip 46561⤵
-
C:\Users\Admin\AppData\Local\Temp\6A8.exeC:\Users\Admin\AppData\Local\Temp\6A8.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\liuj.exe"C:\Users\Admin\AppData\Local\Temp\liuj.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\liuj.exe"C:\Users\Admin\AppData\Local\Temp\liuj.exe" -h3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9B6.exeC:\Users\Admin\AppData\Local\Temp\9B6.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4888 -ip 48881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4384 -ip 43841⤵
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD588c1baba352577878a6c51f9ef6523de
SHA15a2e09c7386f4e2aa1a1fa42708566fff97fa59c
SHA256582345ce77a9dca1a30e0f55591fb2bb1bff51ea3f169eb76afb6914fabd5029
SHA512fff3ad502996c43af8c4518fc94364c2a7ec74f27af01bd6e0438cb09550679d7c02b15735231c4414935dbb4398dc6238101de4898351fdbf06f7d381fddf62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD51b11a6392d2c43073e05c7ea57724b91
SHA1684593b291c26ba749c7bd07a76d1b6f1ff616e1
SHA2561166ec0c19ebb36567b96b919573eacb2279bdff4367ebd5abf6182c918976dc
SHA51287d9c26d11a95df4b6d08453f3183c9d7d77dbd420f9f52b73aed18122cac573f698a1a094effdcd8118f7f5bc519b9f7de1ebd64d5fc86e886f9546bff3052e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD547f9ec8577f97886cf2ee05ed1572eb0
SHA11f0db84d9063e45fdc57a39e80871331614f9880
SHA256597269047b19f2812506272d1be6da3c270dbccc5c7fbb9337fe7f93fa923e60
SHA5124567a7029674939f82dfb8b7b0aa38e363669bd268bc756488a69a867e8beb07ae6d6bfda0b758c587ddfbe53d7f74cae9c477f5ab5dc1428146fa81a07e6391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD530f6af86abc592ae3616f50d99f3edfe
SHA1ec91d1388c92aafc16b29b1ef1de43a78e10fdd7
SHA256cda0507d2d0f8b370c251423cb156f686def348596987d14605211051945bd15
SHA5122ddf7cb3dd13c53f755a75c85dbb68c2d92bde70468adc6d624e911949097da59e58db1dc1c7d503df1a11838231a595b456af524e10085f39720d15d90a6c59
-
C:\Users\Admin\AppData\Local\1d1178b7-669a-4f1e-9363-e3760139b259\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\6A8.exeFilesize
7.4MB
MD52850ccb10aa6f6700d555ca67f89f1e0
SHA1c55b593e654f822ed59d86bab7f8e081b331f132
SHA2564589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
SHA5128ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
-
C:\Users\Admin\AppData\Local\Temp\6A8.exeFilesize
7.4MB
MD52850ccb10aa6f6700d555ca67f89f1e0
SHA1c55b593e654f822ed59d86bab7f8e081b331f132
SHA2564589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
SHA5128ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
-
C:\Users\Admin\AppData\Local\Temp\7F03.exeFilesize
378KB
MD5b141bc58618c537917cc1da179cbe8ab
SHA1c76d3f5eeae9493e41a272a974b5dfec5f4e4724
SHA256fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e
SHA5125c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114
-
C:\Users\Admin\AppData\Local\Temp\7F03.exeFilesize
378KB
MD5b141bc58618c537917cc1da179cbe8ab
SHA1c76d3f5eeae9493e41a272a974b5dfec5f4e4724
SHA256fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e
SHA5125c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114
-
C:\Users\Admin\AppData\Local\Temp\9B6.exeFilesize
351KB
MD5692de8c91f98d23a083b03a42dc8ebbb
SHA1dd4239e40ea1c7c39ce51d6fe32d44406e3a5bae
SHA2563b5b370eaee8757dbe870a4d784ff79867d3a35df5bfe14dd7649e6c155d4c4a
SHA512a33f008492557b7ccd3201fd6d8d9f68b518a42f62f87bb9c07cd1c6537ca148a243e10a01d0b89631ca1645603b44fd130a72dd84e60f2407251ae2e912cb35
-
C:\Users\Admin\AppData\Local\Temp\9B6.exeFilesize
351KB
MD5692de8c91f98d23a083b03a42dc8ebbb
SHA1dd4239e40ea1c7c39ce51d6fe32d44406e3a5bae
SHA2563b5b370eaee8757dbe870a4d784ff79867d3a35df5bfe14dd7649e6c155d4c4a
SHA512a33f008492557b7ccd3201fd6d8d9f68b518a42f62f87bb9c07cd1c6537ca148a243e10a01d0b89631ca1645603b44fd130a72dd84e60f2407251ae2e912cb35
-
C:\Users\Admin\AppData\Local\Temp\9E06.exeFilesize
1.6MB
MD5dc4d8acbc96e90cd6d6af29fe5d45127
SHA184015889aaf56a01d8304fad09adfb7be70abe29
SHA256758a7414cdf99699a3caf38783bd4a45391b8f56734b6a5c7b5502ac142f1563
SHA512cb2befef94883dab2aa5f121206ca928065c810e3b3d34b3c9c03918f22d7086f6e1de6fb75a4dc245debb0d4a88062acd07f051f2015509d1a30b5166490cc8
-
C:\Users\Admin\AppData\Local\Temp\9E06.exeFilesize
1.6MB
MD5dc4d8acbc96e90cd6d6af29fe5d45127
SHA184015889aaf56a01d8304fad09adfb7be70abe29
SHA256758a7414cdf99699a3caf38783bd4a45391b8f56734b6a5c7b5502ac142f1563
SHA512cb2befef94883dab2aa5f121206ca928065c810e3b3d34b3c9c03918f22d7086f6e1de6fb75a4dc245debb0d4a88062acd07f051f2015509d1a30b5166490cc8
-
C:\Users\Admin\AppData\Local\Temp\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\A421.exeFilesize
847KB
MD59f5338b4b61243e58465cb849059be56
SHA15ca8fbb0356f1c5e2d75de93e6e1271e942a199f
SHA25691e6c80af515519f99e767a78845e29e09370f989461b44536fff1a0f54f21a2
SHA51238b2a734c46a06c9946596593b3e0a1650c800d85212ab1258c645799d53e8a7ae29bf4649c972bd48f40c64c151da502336cdcace09ad3b352376cd865fad6a
-
C:\Users\Admin\AppData\Local\Temp\A9B0.exeFilesize
357KB
MD560dcdff42c5c3aa63e369e224a938725
SHA1fba3a60bdcd0f685790d78f9ff6b6fc6726c3a4a
SHA256f520b31f3601ada662caf52733a7472d1d9d1c281c7a40e519c3830b9b556603
SHA51251d2fc04c0641f0c8234546d4eeaca11e0729bbd2711e5f2f7bd23a9b03786a49e314b0cc3fcb2bdb5e643d4cbde7901c96b088ba94eb7eb8d5e0dbeb579f961
-
C:\Users\Admin\AppData\Local\Temp\A9B0.exeFilesize
357KB
MD560dcdff42c5c3aa63e369e224a938725
SHA1fba3a60bdcd0f685790d78f9ff6b6fc6726c3a4a
SHA256f520b31f3601ada662caf52733a7472d1d9d1c281c7a40e519c3830b9b556603
SHA51251d2fc04c0641f0c8234546d4eeaca11e0729bbd2711e5f2f7bd23a9b03786a49e314b0cc3fcb2bdb5e643d4cbde7901c96b088ba94eb7eb8d5e0dbeb579f961
-
C:\Users\Admin\AppData\Local\Temp\ACBF.exeFilesize
349KB
MD52774ab48175d3a029c4106534954577c
SHA1892bf5d54652112cf198bc80bf86934ec5285f64
SHA256f67132cd3288ce9b7bd58ddee547ac519e217ae8f594d70b1551b48b0efab8c4
SHA512dc1adef58490895c277bb48e400870326b893aa04846fc1fd7645840e588f0135eba5e227073c22cb93dea40969a7e8645f4c407574338a5924fe7627b7e252b
-
C:\Users\Admin\AppData\Local\Temp\ACBF.exeFilesize
349KB
MD52774ab48175d3a029c4106534954577c
SHA1892bf5d54652112cf198bc80bf86934ec5285f64
SHA256f67132cd3288ce9b7bd58ddee547ac519e217ae8f594d70b1551b48b0efab8c4
SHA512dc1adef58490895c277bb48e400870326b893aa04846fc1fd7645840e588f0135eba5e227073c22cb93dea40969a7e8645f4c407574338a5924fe7627b7e252b
-
C:\Users\Admin\AppData\Local\Temp\B76E.exeFilesize
7.4MB
MD52850ccb10aa6f6700d555ca67f89f1e0
SHA1c55b593e654f822ed59d86bab7f8e081b331f132
SHA2564589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
SHA5128ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
-
C:\Users\Admin\AppData\Local\Temp\B76E.exeFilesize
7.4MB
MD52850ccb10aa6f6700d555ca67f89f1e0
SHA1c55b593e654f822ed59d86bab7f8e081b331f132
SHA2564589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
SHA5128ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exeFilesize
3.7MB
MD53006b49f3a30a80bb85074c279acc7df
SHA1728a7a867d13ad0034c29283939d94f0df6c19df
SHA256f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
SHA512e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD530d5f615722d12fdda4f378048221909
SHA1e94e3e3a6fae8b29f0f80128761ad1b69304a7eb
SHA256b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
SHA512a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD51b20e998d058e813dfc515867d31124f
SHA1c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA25624a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA51279849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\liuj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exeFilesize
3.5MB
MD581a0ecc23b44da5116d397c0a3104a05
SHA101efd55a04010ec4e7197bcac7ec351bb8e5bf07
SHA2563f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0
SHA512cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exeFilesize
3.5MB
MD581a0ecc23b44da5116d397c0a3104a05
SHA101efd55a04010ec4e7197bcac7ec351bb8e5bf07
SHA2563f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0
SHA512cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exeFilesize
3.5MB
MD581a0ecc23b44da5116d397c0a3104a05
SHA101efd55a04010ec4e7197bcac7ec351bb8e5bf07
SHA2563f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0
SHA512cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185
-
C:\Users\Admin\AppData\Local\Temp\llpb1133.exeFilesize
3.5MB
MD581a0ecc23b44da5116d397c0a3104a05
SHA101efd55a04010ec4e7197bcac7ec351bb8e5bf07
SHA2563f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0
SHA512cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeFilesize
88.2MB
MD50663f2de18e99aee1c02917d5036eba4
SHA1ef96d0608b1d9760fe0355a63f2a0abf3412591a
SHA2563cd6d48963ea795f5823ffc7fb4583b5ae89aaede6aafee92c4ae3d6a8c74e74
SHA5128c5432659ed3f1d8ccbf40fd5e7f5a8407e8a250d1d3c309502ecf759eebf11b29acaff4bc6d588d90a8413824702d693520d659eb3b702666701f4d5c52ae21
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeFilesize
88.6MB
MD5409a51cd3dcb08d836a941ae043a1c71
SHA1457b979b52de4b5907ecdfb43ac94c0f16d269bd
SHA2560c7f5ba5de419b22030be44a6b77fb077d7f624c0fc37bb41a69950c668b4334
SHA512482770dced5fd641d578a183399397e7beb36ee175f6baadb603a32f165388e3f1e696d84a7b1755907703208317a627feb653f755d3a3d2871fdd4e3e306d57
-
memory/556-238-0x0000000000000000-mapping.dmp
-
memory/748-188-0x0000000000C20000-0x0000000001384000-memory.dmpFilesize
7.4MB
-
memory/748-165-0x0000000000000000-mapping.dmp
-
memory/1108-172-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1108-171-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1108-179-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1108-198-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1108-168-0x0000000000000000-mapping.dmp
-
memory/1108-169-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1152-199-0x0000000000000000-mapping.dmp
-
memory/1212-139-0x0000000000000000-mapping.dmp
-
memory/1212-180-0x00000000014EB000-0x000000000165C000-memory.dmpFilesize
1.4MB
-
memory/1212-164-0x00000000014EB000-0x000000000165C000-memory.dmpFilesize
1.4MB
-
memory/1312-219-0x0000000000000000-mapping.dmp
-
memory/1356-215-0x0000000000000000-mapping.dmp
-
memory/1416-142-0x0000000000000000-mapping.dmp
-
memory/1416-154-0x0000000002370000-0x000000000248B000-memory.dmpFilesize
1.1MB
-
memory/1416-153-0x000000000225E000-0x00000000022EF000-memory.dmpFilesize
580KB
-
memory/1452-226-0x00000000021B9000-0x000000000224A000-memory.dmpFilesize
580KB
-
memory/1452-194-0x0000000000000000-mapping.dmp
-
memory/1512-202-0x0000000000000000-mapping.dmp
-
memory/2256-206-0x0000000000000000-mapping.dmp
-
memory/2292-239-0x0000000000000000-mapping.dmp
-
memory/2452-193-0x0000000000000000-mapping.dmp
-
memory/2452-203-0x0000000140000000-0x0000000140620000-memory.dmpFilesize
6.1MB
-
memory/2652-245-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2652-244-0x0000000000667000-0x0000000000691000-memory.dmpFilesize
168KB
-
memory/3120-204-0x0000000140000000-0x0000000140620000-memory.dmpFilesize
6.1MB
-
memory/3120-192-0x0000000000000000-mapping.dmp
-
memory/3496-231-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3496-227-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3496-223-0x0000000000000000-mapping.dmp
-
memory/3496-228-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3920-173-0x0000000000000000-mapping.dmp
-
memory/3996-220-0x0000000000000000-mapping.dmp
-
memory/4304-135-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4304-132-0x00000000004C8000-0x00000000004DD000-memory.dmpFilesize
84KB
-
memory/4304-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4304-133-0x0000000002060000-0x0000000002069000-memory.dmpFilesize
36KB
-
memory/4336-217-0x0000000000000000-mapping.dmp
-
memory/4384-184-0x00000000006DD000-0x00000000006F3000-memory.dmpFilesize
88KB
-
memory/4384-176-0x0000000000000000-mapping.dmp
-
memory/4384-186-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4384-185-0x0000000000690000-0x00000000006AC000-memory.dmpFilesize
112KB
-
memory/4384-183-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4384-182-0x0000000000690000-0x00000000006AC000-memory.dmpFilesize
112KB
-
memory/4384-181-0x00000000006DD000-0x00000000006F3000-memory.dmpFilesize
88KB
-
memory/4616-156-0x0000000000500000-0x0000000000509000-memory.dmpFilesize
36KB
-
memory/4616-155-0x000000000056D000-0x0000000000583000-memory.dmpFilesize
88KB
-
memory/4616-145-0x0000000000000000-mapping.dmp
-
memory/4616-161-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4616-157-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/4656-148-0x0000000000000000-mapping.dmp
-
memory/4656-158-0x000000000077D000-0x0000000000793000-memory.dmpFilesize
88KB
-
memory/4656-159-0x0000000000400000-0x0000000000597000-memory.dmpFilesize
1.6MB
-
memory/4888-160-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/4888-151-0x0000000000639000-0x0000000000663000-memory.dmpFilesize
168KB
-
memory/4888-240-0x0000000000639000-0x0000000000663000-memory.dmpFilesize
168KB
-
memory/4888-152-0x00000000020C0000-0x0000000002107000-memory.dmpFilesize
284KB
-
memory/4888-163-0x00000000020C0000-0x0000000002107000-memory.dmpFilesize
284KB
-
memory/4888-243-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/4888-162-0x0000000000639000-0x0000000000663000-memory.dmpFilesize
168KB
-
memory/4888-136-0x0000000000000000-mapping.dmp
-
memory/5004-187-0x0000000000000000-mapping.dmp