Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 20:40
Static task
static1
Behavioral task
behavioral1
Sample
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe
Resource
win10v2004-20221111-en
General
-
Target
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe
-
Size
150KB
-
MD5
0325ec4dc777b79587a835850fb9ee72
-
SHA1
d764e57392b7b547887afd713a1962853f2c9620
-
SHA256
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14
-
SHA512
7edcdd871752c14babd0ebf6fced4e59bf92c953710c4f1bd6f8dc22ed2768c6e4b4f2e382d7f89ad87c93b00273f86c786d4b2fe9f16a0205764e3387a1a685
-
SSDEEP
3072:1FsoVrqI7B2FDEeSs/quhQRiNoxaFzFzXGGxg:Uarv7B1eS5XRfxQyGx
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/404-133-0x0000000002290000-0x0000000002299000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
resource yara_rule behavioral1/memory/1464-271-0x0000000000400000-0x000000000052A000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
6B1F.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6B1F.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6B1F.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6B1F.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6B1F.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
A339.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation A339.exe -
Executes dropped EXE 9 IoCs
Processes:
4FB6.exe6B1F.exe77F1.exe9CC0.exeA339.exeA9B2.exeA339.exeA339.exeA339.exepid process 2216 4FB6.exe 3912 6B1F.exe 2888 77F1.exe 4640 9CC0.exe 4872 A339.exe 1440 A9B2.exe 208 A339.exe 1392 A339.exe 1464 A339.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/3912-197-0x0000000000440000-0x0000000000C74000-memory.dmp agile_net -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\6B1F.exe themida C:\Users\Admin\AppData\Local\Temp\6B1F.exe themida behavioral1/memory/3912-197-0x0000000000440000-0x0000000000C74000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Processes:
6B1F.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6B1F.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
77F1.exeA339.exedescription pid process target process PID 2888 set thread context of 3148 2888 77F1.exe AppLaunch.exe PID 4872 set thread context of 1464 4872 A339.exe A339.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9df8b675-fe37-494c-ba5c-fd6940fdd58a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230217214210.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
9CC0.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityModeType = "843418957" 9CC0.exe -
Modifies registry class 4 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exepid process 404 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe 404 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1952 -
Suspicious behavior: MapViewOfSection 39 IoCs
Processes:
705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exeexplorer.exepid process 404 705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe 1952 1952 1952 1952 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 1952 1952 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 1952 1952 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 1952 1952 4752 explorer.exe 4752 explorer.exe 1952 1952 4752 explorer.exe 4752 explorer.exe 1952 1952 4752 explorer.exe 4752 explorer.exe 1952 1952 1952 1952 4752 explorer.exe 4752 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AppLaunch.exepowershell.exedescription pid process Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeDebugPrivilege 3148 AppLaunch.exe Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeDebugPrivilege 3048 powershell.exe Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
msedge.exepid process 2680 msedge.exe 1952 1952 2680 msedge.exe 1952 2680 msedge.exe 1952 1952 1952 1952 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9CC0.exepid process 4640 9CC0.exe 4640 9CC0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
77F1.exe6B1F.exemsedge.exedescription pid process target process PID 1952 wrote to memory of 2216 1952 4FB6.exe PID 1952 wrote to memory of 2216 1952 4FB6.exe PID 1952 wrote to memory of 3912 1952 6B1F.exe PID 1952 wrote to memory of 3912 1952 6B1F.exe PID 1952 wrote to memory of 3912 1952 6B1F.exe PID 1952 wrote to memory of 2888 1952 77F1.exe PID 1952 wrote to memory of 2888 1952 77F1.exe PID 1952 wrote to memory of 2888 1952 77F1.exe PID 2888 wrote to memory of 3148 2888 77F1.exe AppLaunch.exe PID 2888 wrote to memory of 3148 2888 77F1.exe AppLaunch.exe PID 2888 wrote to memory of 3148 2888 77F1.exe AppLaunch.exe PID 2888 wrote to memory of 3148 2888 77F1.exe AppLaunch.exe PID 2888 wrote to memory of 3148 2888 77F1.exe AppLaunch.exe PID 3912 wrote to memory of 2680 3912 6B1F.exe msedge.exe PID 3912 wrote to memory of 2680 3912 6B1F.exe msedge.exe PID 2680 wrote to memory of 4972 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4972 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 4056 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 5084 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 5084 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 3428 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 3428 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 3428 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 3428 2680 msedge.exe msedge.exe PID 2680 wrote to memory of 3428 2680 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe"C:\Users\Admin\AppData\Local\Temp\705e9d3021467e35dd43057a8e412e0eddb04603eb344ac4a31c3650f751aa14.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4FB6.exeC:\Users\Admin\AppData\Local\Temp\4FB6.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeC:\Users\Admin\AppData\Local\Temp\6B1F.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6B1F.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1e9f46f8,0x7fff1e9f4708,0x7fff1e9f47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5092 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5196 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e15d5460,0x7ff7e15d5470,0x7ff7e15d54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,6520893125675091162,10037961780170411957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6B1F.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1e9f46f8,0x7fff1e9f4708,0x7fff1e9f47183⤵
-
C:\Users\Admin\AppData\Local\Temp\77F1.exeC:\Users\Admin\AppData\Local\Temp\77F1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\9CC0.exeC:\Users\Admin\AppData\Local\Temp\9CC0.exe1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\A339.exeC:\Users\Admin\AppData\Local\Temp\A339.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\A339.exeC:\Users\Admin\AppData\Local\Temp\A339.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A339.exeC:\Users\Admin\AppData\Local\Temp\A339.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A339.exeC:\Users\Admin\AppData\Local\Temp\A339.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A9B2.exeC:\Users\Admin\AppData\Local\Temp\A9B2.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A339.exe.logFilesize
1KB
MD59e39b702ddcbdc603ad47b9d318dce62
SHA131709fbc20df043f4699fc3b288ce9bccd666b94
SHA256b91057818a6617ee8e0c725d144403d30226b04d8181fed08cf0e5d634ee6388
SHA512bab6b606b18f68e775d5a4fc2033adb1f228f66fe7103fe49a58dc7349227769df14d53b665615c7a9fb0cf2bbf679d5aa1ff2e97b0200d0a3603f8aebb9f533
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD577c5176b80498efa00b6017129739c95
SHA1b687aceede3bb326320a8ac6f652d3cbc5482635
SHA256f0a2332f3aead2f03825b552d03d66574b3877ef4a0b9f0d61c99e71b721a413
SHA512db6984d885a42f1fcc9a6598540d8c94744a74f09822eccddb8d9e81cd7cf2a54689720af729dd99bf97a482963e5939e71ae62e24251c1bd2f6ce8c30fd5301
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Temp\4FB6.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\4FB6.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\77F1.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\77F1.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\9CC0.exeFilesize
6.4MB
MD53e9adb4d8dbec6eddee3065caf5911f6
SHA131c7111c8044afdf5c6ddb1e55244acfd06229d3
SHA256215426d36754e9d391ae8ccabb74de1489fb8c18a127fec02a5be4e45462a7a5
SHA512b62f413092028a3bdbc4ee7f6a085e881f51ed68c28d2950d1665cb4ecb1170f173a6003660b3c0d6629cc85f6f4b0e28dedd42c839ebbb29343b46a4f474ff9
-
C:\Users\Admin\AppData\Local\Temp\9CC0.exeFilesize
6.4MB
MD53e9adb4d8dbec6eddee3065caf5911f6
SHA131c7111c8044afdf5c6ddb1e55244acfd06229d3
SHA256215426d36754e9d391ae8ccabb74de1489fb8c18a127fec02a5be4e45462a7a5
SHA512b62f413092028a3bdbc4ee7f6a085e881f51ed68c28d2950d1665cb4ecb1170f173a6003660b3c0d6629cc85f6f4b0e28dedd42c839ebbb29343b46a4f474ff9
-
C:\Users\Admin\AppData\Local\Temp\A339.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\A339.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\A339.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\A339.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\A339.exeFilesize
1.5MB
MD5c8c05c344c028625e22fbf3f9b00a9a7
SHA1ab3b124bb475a411307a7b699e0f6cd1ad549051
SHA2565be19294bec8749e2473edb88ced8d8d6844d79dc2d7181002f37d3b740fb747
SHA512c771810a128d77e978a034d69a1bd27309812e9f17c30d5bd407c43293500a60d09c386c98be16f20b582c5457c6b03ee6e1758cf661ecc81e03726a7192aeaf
-
C:\Users\Admin\AppData\Local\Temp\A9B2.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\A9B2.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD557fac65886e310c738de6a70f6656619
SHA15d22807afb64abe93dc2cc10497d064c805a3a9f
SHA25609f37b1465242ac86de173f503214ef52c9f3a7a6df96d8fd632cf2d4ee4270a
SHA512b32e8f153d057d5cdf747fbcfe2cf5eb9c6e3bbb236f6426c62b1c499bf46e5f867e9111677a00b0d39c4dbf9b81293da50460b044857db76e1bdf7688398ed2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5b8c92b3bd1077227e8cbb58f57ef85d3
SHA1bbcaa9f11c006f170c3259f6e21c0af0e7a1344d
SHA2564775382c668ccafb1e7d6c39baa5c518a5329e86ace9a1e88464fdf880d83660
SHA512af91c4000aae2493ba50ad338ce139d4e5c28946fc62403b0f486fe0ee293fb8bed7ba513fdac2f99df0afd46316b5dd9dd899c9ea56fde24979991652482d19
-
\??\pipe\LOCAL\crashpad_2680_VZGXDEYSNJODBIHNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-266-0x0000000000000000-mapping.dmp
-
memory/404-132-0x0000000000601000-0x0000000000614000-memory.dmpFilesize
76KB
-
memory/404-133-0x0000000002290000-0x0000000002299000-memory.dmpFilesize
36KB
-
memory/404-135-0x0000000000400000-0x0000000000556000-memory.dmpFilesize
1.3MB
-
memory/404-134-0x0000000000400000-0x0000000000556000-memory.dmpFilesize
1.3MB
-
memory/592-214-0x0000000000540000-0x000000000054B000-memory.dmpFilesize
44KB
-
memory/592-212-0x0000000000000000-mapping.dmp
-
memory/592-213-0x0000000000990000-0x0000000000997000-memory.dmpFilesize
28KB
-
memory/592-256-0x0000000000990000-0x0000000000997000-memory.dmpFilesize
28KB
-
memory/1080-179-0x0000000000000000-mapping.dmp
-
memory/1360-231-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB
-
memory/1360-258-0x0000000000CA0000-0x0000000000CA5000-memory.dmpFilesize
20KB
-
memory/1360-227-0x0000000000000000-mapping.dmp
-
memory/1360-229-0x0000000000CA0000-0x0000000000CA5000-memory.dmpFilesize
20KB
-
memory/1392-268-0x0000000000000000-mapping.dmp
-
memory/1440-209-0x00007FFF1A6B0000-0x00007FFF1B171000-memory.dmpFilesize
10.8MB
-
memory/1440-205-0x0000000000000000-mapping.dmp
-
memory/1464-270-0x0000000000000000-mapping.dmp
-
memory/1464-271-0x0000000000400000-0x000000000052A000-memory.dmpFilesize
1.2MB
-
memory/1468-243-0x0000000000000000-mapping.dmp
-
memory/1492-275-0x0000000000000000-mapping.dmp
-
memory/1684-195-0x0000000000000000-mapping.dmp
-
memory/1796-238-0x0000000000000000-mapping.dmp
-
memory/1948-176-0x0000000000000000-mapping.dmp
-
memory/2216-136-0x0000000000000000-mapping.dmp
-
memory/2216-139-0x0000000000660000-0x0000000000668000-memory.dmpFilesize
32KB
-
memory/2216-140-0x00007FFF1D070000-0x00007FFF1DB31000-memory.dmpFilesize
10.8MB
-
memory/2284-237-0x0000000000000000-mapping.dmp
-
memory/2668-226-0x0000000000000000-mapping.dmp
-
memory/2680-160-0x0000000000000000-mapping.dmp
-
memory/2680-221-0x000001C2C9C30000-0x000001C2C9C3F000-memory.dmpFilesize
60KB
-
memory/2752-200-0x0000000000000000-mapping.dmp
-
memory/2888-147-0x0000000000000000-mapping.dmp
-
memory/2892-196-0x0000000000000000-mapping.dmp
-
memory/3048-201-0x0000000000000000-mapping.dmp
-
memory/3048-210-0x00000000050D0000-0x0000000005136000-memory.dmpFilesize
408KB
-
memory/3048-216-0x00000000064B0000-0x00000000064CA000-memory.dmpFilesize
104KB
-
memory/3048-204-0x0000000004A20000-0x0000000004A56000-memory.dmpFilesize
216KB
-
memory/3048-215-0x0000000007670000-0x0000000007CEA000-memory.dmpFilesize
6.5MB
-
memory/3048-211-0x0000000006000000-0x000000000601E000-memory.dmpFilesize
120KB
-
memory/3048-208-0x00000000051B0000-0x00000000057D8000-memory.dmpFilesize
6.2MB
-
memory/3148-163-0x00000000066B0000-0x0000000006742000-memory.dmpFilesize
584KB
-
memory/3148-172-0x0000000008250000-0x000000000877C000-memory.dmpFilesize
5.2MB
-
memory/3148-165-0x0000000007AD0000-0x0000000007B46000-memory.dmpFilesize
472KB
-
memory/3148-169-0x0000000007B50000-0x0000000007D12000-memory.dmpFilesize
1.8MB
-
memory/3148-178-0x00000000069C0000-0x0000000006A10000-memory.dmpFilesize
320KB
-
memory/3148-162-0x0000000005B30000-0x0000000005B96000-memory.dmpFilesize
408KB
-
memory/3148-159-0x00000000057F0000-0x000000000582C000-memory.dmpFilesize
240KB
-
memory/3148-164-0x0000000006D00000-0x00000000072A4000-memory.dmpFilesize
5.6MB
-
memory/3148-174-0x0000000007740000-0x000000000775E000-memory.dmpFilesize
120KB
-
memory/3148-158-0x00000000058C0000-0x00000000059CA000-memory.dmpFilesize
1.0MB
-
memory/3148-157-0x0000000005790000-0x00000000057A2000-memory.dmpFilesize
72KB
-
memory/3148-156-0x0000000005CF0000-0x0000000006308000-memory.dmpFilesize
6.1MB
-
memory/3148-151-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3148-150-0x0000000000000000-mapping.dmp
-
memory/3428-173-0x0000000000000000-mapping.dmp
-
memory/3428-236-0x0000014517140000-0x000001451714F000-memory.dmpFilesize
60KB
-
memory/3512-233-0x0000000000000000-mapping.dmp
-
memory/3512-260-0x0000000000F80000-0x0000000000F86000-memory.dmpFilesize
24KB
-
memory/3512-235-0x0000000000F70000-0x0000000000F7C000-memory.dmpFilesize
48KB
-
memory/3512-234-0x0000000000F80000-0x0000000000F86000-memory.dmpFilesize
24KB
-
memory/3828-203-0x0000000000000000-mapping.dmp
-
memory/3900-222-0x0000000000000000-mapping.dmp
-
memory/3912-144-0x0000000000440000-0x0000000000C74000-memory.dmpFilesize
8.2MB
-
memory/3912-141-0x0000000000000000-mapping.dmp
-
memory/3912-186-0x0000000000440000-0x0000000000C74000-memory.dmpFilesize
8.2MB
-
memory/3912-197-0x0000000000440000-0x0000000000C74000-memory.dmpFilesize
8.2MB
-
memory/3976-185-0x0000000000000000-mapping.dmp
-
memory/4056-230-0x000002249EDC0000-0x000002249EDCF000-memory.dmpFilesize
60KB
-
memory/4056-167-0x0000000000000000-mapping.dmp
-
memory/4132-224-0x0000000000000000-mapping.dmp
-
memory/4404-247-0x0000000000000000-mapping.dmp
-
memory/4404-263-0x0000000001210000-0x0000000001216000-memory.dmpFilesize
24KB
-
memory/4404-249-0x0000000001200000-0x000000000120B000-memory.dmpFilesize
44KB
-
memory/4404-248-0x0000000001210000-0x0000000001216000-memory.dmpFilesize
24KB
-
memory/4428-250-0x0000000000000000-mapping.dmp
-
memory/4428-251-0x0000000000710000-0x0000000000717000-memory.dmpFilesize
28KB
-
memory/4428-252-0x0000000000700000-0x000000000070D000-memory.dmpFilesize
52KB
-
memory/4428-264-0x0000000000710000-0x0000000000717000-memory.dmpFilesize
28KB
-
memory/4444-262-0x0000000000350000-0x0000000000355000-memory.dmpFilesize
20KB
-
memory/4444-245-0x0000000000350000-0x0000000000355000-memory.dmpFilesize
20KB
-
memory/4444-244-0x0000000000000000-mapping.dmp
-
memory/4444-246-0x0000000000340000-0x0000000000349000-memory.dmpFilesize
36KB
-
memory/4448-253-0x0000000000000000-mapping.dmp
-
memory/4448-254-0x0000000000490000-0x0000000000498000-memory.dmpFilesize
32KB
-
memory/4448-255-0x0000000000480000-0x000000000048B000-memory.dmpFilesize
44KB
-
memory/4448-265-0x0000000000490000-0x0000000000498000-memory.dmpFilesize
32KB
-
memory/4640-187-0x0000000000000000-mapping.dmp
-
memory/4752-217-0x0000000000000000-mapping.dmp
-
memory/4752-257-0x0000000000770000-0x0000000000779000-memory.dmpFilesize
36KB
-
memory/4752-219-0x0000000000760000-0x000000000076F000-memory.dmpFilesize
60KB
-
memory/4752-218-0x0000000000770000-0x0000000000779000-memory.dmpFilesize
36KB
-
memory/4816-239-0x0000000000000000-mapping.dmp
-
memory/4816-242-0x0000000000C90000-0x0000000000CB7000-memory.dmpFilesize
156KB
-
memory/4816-261-0x0000000000CC0000-0x0000000000CE2000-memory.dmpFilesize
136KB
-
memory/4816-241-0x0000000000CC0000-0x0000000000CE2000-memory.dmpFilesize
136KB
-
memory/4872-190-0x0000000000000000-mapping.dmp
-
memory/4872-193-0x0000000000690000-0x0000000000820000-memory.dmpFilesize
1.6MB
-
memory/4872-194-0x0000000005B70000-0x0000000005B92000-memory.dmpFilesize
136KB
-
memory/4972-161-0x0000000000000000-mapping.dmp
-
memory/4972-228-0x00000207F7DA0000-0x00000207F7DAF000-memory.dmpFilesize
60KB
-
memory/5084-259-0x0000019DA1B40000-0x0000019DA1B4F000-memory.dmpFilesize
60KB
-
memory/5084-232-0x0000019DA1B40000-0x0000019DA1B4F000-memory.dmpFilesize
60KB
-
memory/5084-168-0x0000000000000000-mapping.dmp
-
memory/5116-183-0x0000000000000000-mapping.dmp