Analysis
-
max time kernel
145s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-01-2024 01:22
General
-
Target
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe
-
Size
918KB
-
MD5
beff93c13a3839484a3248f3a1702516
-
SHA1
77d2620d977c1b7730a599da82efd7360898f309
-
SHA256
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca
-
SHA512
fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28
-
SSDEEP
24576:k1I4MROxnFi3ArIrZlI0AilFEvxHi18D:k1rMioAMrZlI0AilFEvxHi
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Hack
C2
127.0.0.1:10134
Mutex
d7904e4fe3184c208642abe8f5cf9293
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
C:\Windows\System32\tаskmgr.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
GoogleUpdateTaskMachine
-
watchdog_path
AppData\smss.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 2 IoCs
-
Checks computer location settings 2 TTPs 57 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe"C:\Users\Admin\AppData\Local\Temp\1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tm4_ldi3.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC48FB.tmp"3⤵
-
C:\Windows\System32\tаskmgr.exe"C:\Windows\System32\tаskmgr.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 8165⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 8005⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 8125⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7965⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 7965⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 7965⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 4812 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 4812 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 7965⤵
-
C:\Windows\System32\tаskmgr.exeC:\Windows\System32\tаskmgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4612 -ip 46121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2396 -ip 23961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4908 -ip 49081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3944 -ip 39441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3608 -ip 36081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4432 -ip 44321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1956 -ip 19561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4936 -ip 49361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2712 -ip 27121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1352 -ip 13521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1688 -ip 16881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2280 -ip 22801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3944 -ip 39441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4376 -ip 43761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2416 -ip 24161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1256 -ip 12561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1864 -ip 18641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1744 -ip 17441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4796 -ip 47961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 556 -ip 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 460 -ip 4601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2900 -ip 29001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2584 -ip 25841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2892 -ip 28921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1740 -ip 17401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1496 -ip 14961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4752 -ip 47521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3364 -ip 33641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 736 -ip 7361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2752 -ip 27521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2524 -ip 25241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2040 -ip 20401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1516 -ip 15161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3592 -ip 35921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1196 -ip 11961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4716 -ip 47161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2056 -ip 20561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1532 -ip 15321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1612 -ip 16121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 780 -ip 7801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4876 -ip 48761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2472 -ip 24721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3928 -ip 39281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2128 -ip 21281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1940 -ip 19401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2428 -ip 24281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 928 -ip 9281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3460 -ip 34601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2464 -ip 24641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3984 -ip 39841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1292 -ip 12921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1012 -ip 10121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4796 -ip 47961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4448 -ip 44481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4756 -ip 47561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2964 -ip 29641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4940 -ip 49401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3448 -ip 34481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\smss.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\RES48FC.tmpFilesize
1KB
MD5810efa51d315bb49e86547a6d19a7b8a
SHA1bcd99806175647d844de7500b489ab041d0b5aa8
SHA25602af6eca6ae638637c3f21b7113646a0f5e900d02f562ddc0e62cd34d4e19397
SHA51221921a06419c3c0e3750a9dc41005fd1e798adb99803a43fc19827484ace7aeab426fd1c288a5c2dfb07c7d1a1360ef4d500f2f66ecc362b0f27668c11a8a22c
-
C:\Users\Admin\AppData\Local\Temp\err_d7904e4fe3184c208642abe8f5cf9293.datFilesize
1KB
MD5e2b3100941b4e6b21041859ab1aa1e7f
SHA13464e423b577f4f941fa97e50bfa6eed96cfc620
SHA256cac8dfbc728db7406239c355fddc44e6ea7ad22cdef5f8b03acaa78b079ac76c
SHA51201d74ea3a99188f4a3d260cee001d7c72a32c867588f8f086a7e4e6e4a553341d96c3d864b582b9469c980ab1c389296303ad8710d16298a7cef53ec0d18e606
-
C:\Users\Admin\AppData\Local\Temp\tm4_ldi3.dllFilesize
76KB
MD55ae6a598fe5d5c312bf33e5e35cfad15
SHA14d326d44ffa1acbba1d02a9ac501cd9a41c53de6
SHA256fdfbfb2724624ac42778a9dd3e8b6f70f62735be34c0d7de07b4493418172520
SHA51209450925fcfcc4203d77253fbc5aa4934f6141bc285d856add0dc4635f5f3fca3ef883b8f00160c6cc61941ee25946f0257386031c1d9d530c9d236499cc89b5
-
C:\Users\Admin\AppData\Roaming\smss.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Windows\System32\tаskmgr.exeFilesize
918KB
MD5beff93c13a3839484a3248f3a1702516
SHA177d2620d977c1b7730a599da82efd7360898f309
SHA2561407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca
SHA512fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28
-
C:\Windows\System32\tаskmgr.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC48FB.tmpFilesize
676B
MD5f00d37798455111631374ec1b4920865
SHA133bb4b93720895a55215bfbb59ce16af6aa746eb
SHA256be8198fbf9eae269b1818b30a4d256243503240652370e2605595af2bd7ca11c
SHA512c293caba6464755d26e0848cc9c9225b6102278b09dc211ced3d6162a87f980ecf62202d1369f112da079de602e6c7f8d20c2d8f278314650bd312f346651171
-
\??\c:\Users\Admin\AppData\Local\Temp\tm4_ldi3.0.csFilesize
208KB
MD561f035a9d772b537d435a2a8a945448e
SHA1b38bd6c155cf0a61fbf29f73612a9a91e2707fc6
SHA2565f149ad390ab5f7f9f11223e28e00e7a791638bea223a7182239a41f0bd61e15
SHA5124b81a7db1f22de504ef4337707da68726b14d21e0e0eaa8aa70ce28f3965a100573ea022903b38d62e1b3fab0f7666c036a19b280ee51b77cb4f4c4ad7ff23ae
-
\??\c:\Users\Admin\AppData\Local\Temp\tm4_ldi3.cmdlineFilesize
349B
MD52873409a70440aa38d3c21dfb04b25cc
SHA19a6aa95ea5b6fe4077dd654de800023f44326999
SHA25638514330d8fb9e0e99fd8c8c2ddb820b34591ff4c27c5420514e8b064c41cab7
SHA5120e11c384eb8c096009244d152ed405cf14820561ceedcacc7a2d5dc6d3339e70400688e6250f36bc6d9001e274214c4bcbbca48545c65157fdafcef68b3c2650
-
memory/212-87-0x00007FFE223A0000-0x00007FFE22E61000-memory.dmpFilesize
10.8MB
-
memory/212-66-0x00007FFE223A0000-0x00007FFE22E61000-memory.dmpFilesize
10.8MB
-
memory/212-67-0x000000001AD30000-0x000000001AD40000-memory.dmpFilesize
64KB
-
memory/1328-102-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/1328-105-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/1620-30-0x000000001DC50000-0x000000001E20A000-memory.dmpFilesize
5.7MB
-
memory/1620-22-0x000000001BD30000-0x000000001BD46000-memory.dmpFilesize
88KB
-
memory/1620-27-0x0000000001600000-0x0000000001608000-memory.dmpFilesize
32KB
-
memory/1620-28-0x000000001BBE0000-0x000000001BBE8000-memory.dmpFilesize
32KB
-
memory/1620-29-0x000000001D2F0000-0x000000001D352000-memory.dmpFilesize
392KB
-
memory/1620-25-0x00007FFE25B80000-0x00007FFE26521000-memory.dmpFilesize
9.6MB
-
memory/1620-31-0x000000001E210000-0x000000001E300000-memory.dmpFilesize
960KB
-
memory/1620-32-0x000000001D450000-0x000000001D46E000-memory.dmpFilesize
120KB
-
memory/1620-33-0x000000001E310000-0x000000001E359000-memory.dmpFilesize
292KB
-
memory/1620-34-0x0000000001650000-0x0000000001660000-memory.dmpFilesize
64KB
-
memory/1620-35-0x000000001E3F0000-0x000000001E460000-memory.dmpFilesize
448KB
-
memory/1620-36-0x0000000001650000-0x0000000001660000-memory.dmpFilesize
64KB
-
memory/1620-24-0x00007FFE25B80000-0x00007FFE26521000-memory.dmpFilesize
9.6MB
-
memory/1620-26-0x0000000001620000-0x0000000001632000-memory.dmpFilesize
72KB
-
memory/1620-123-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/1620-54-0x00007FFE25B80000-0x00007FFE26521000-memory.dmpFilesize
9.6MB
-
memory/1620-121-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/1620-1-0x00007FFE25B80000-0x00007FFE26521000-memory.dmpFilesize
9.6MB
-
memory/1620-2-0x0000000001650000-0x0000000001660000-memory.dmpFilesize
64KB
-
memory/1620-3-0x000000001BBF0000-0x000000001BC4C000-memory.dmpFilesize
368KB
-
memory/1620-8-0x000000001C8B0000-0x000000001C94C000-memory.dmpFilesize
624KB
-
memory/1620-0-0x00007FFE25B80000-0x00007FFE26521000-memory.dmpFilesize
9.6MB
-
memory/1620-7-0x000000001C340000-0x000000001C80E000-memory.dmpFilesize
4.8MB
-
memory/1620-6-0x000000001BCF0000-0x000000001BCFE000-memory.dmpFilesize
56KB
-
memory/2396-104-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2396-107-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2724-124-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2856-96-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2856-98-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2924-14-0x0000000002230000-0x0000000002240000-memory.dmpFilesize
64KB
-
memory/3944-120-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/3944-118-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4004-84-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4004-85-0x00000000009F0000-0x00000000009F8000-memory.dmpFilesize
32KB
-
memory/4004-92-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4392-112-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4392-109-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4540-90-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4540-93-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4612-100-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4612-99-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4812-63-0x000000001C110000-0x000000001C15E000-memory.dmpFilesize
312KB
-
memory/4812-59-0x000000001BDB0000-0x000000001BDEC000-memory.dmpFilesize
240KB
-
memory/4812-88-0x000000001B880000-0x000000001B890000-memory.dmpFilesize
64KB
-
memory/4812-111-0x000000001B880000-0x000000001B890000-memory.dmpFilesize
64KB
-
memory/4812-57-0x000000001B8A0000-0x000000001B8B2000-memory.dmpFilesize
72KB
-
memory/4812-56-0x000000001B880000-0x000000001B890000-memory.dmpFilesize
64KB
-
memory/4812-108-0x000000001B880000-0x000000001B890000-memory.dmpFilesize
64KB
-
memory/4812-60-0x000000001BF00000-0x000000001C00A000-memory.dmpFilesize
1.0MB
-
memory/4812-72-0x00007FFE223A0000-0x00007FFE22E61000-memory.dmpFilesize
10.8MB
-
memory/4812-69-0x000000001C5F0000-0x000000001C600000-memory.dmpFilesize
64KB
-
memory/4812-58-0x000000001BD50000-0x000000001BD62000-memory.dmpFilesize
72KB
-
memory/4812-53-0x0000000000CB0000-0x0000000000D9C000-memory.dmpFilesize
944KB
-
memory/4812-55-0x00007FFE223A0000-0x00007FFE22E61000-memory.dmpFilesize
10.8MB
-
memory/4812-65-0x000000001C4D0000-0x000000001C4E8000-memory.dmpFilesize
96KB
-
memory/4812-68-0x000000001B880000-0x000000001B890000-memory.dmpFilesize
64KB
-
memory/4888-117-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4888-115-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/4908-113-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB