Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 10:12
Static task
static1
Behavioral task
behavioral1
Sample
99281465e23f346ffec5c0dd3964a053.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99281465e23f346ffec5c0dd3964a053.exe
Resource
win10v2004-20231222-en
General
-
Target
setup_installer.exe
-
Size
2.4MB
-
MD5
a8149197e0b87186f49ea0654f2e001d
-
SHA1
b3ae3f94bf3ce63dcd97aba465694d6233bcff35
-
SHA256
820285daf1ef245e93262a0a5e87c515c9233b0d9d95b2fe56b53f93031ae765
-
SHA512
e314edd8a5331a558164bdde272fc67251c5db7f9dd22eb648a6036c4737e4701ae9a86f00f9944f8089b6a5c93f37f6f719a26f09cc334366bd7a44fe89b81e
-
SSDEEP
49152:xcBGEwJ84vLRaBtIl9mV4jJm4KlaREI4/toRhV+acKwF+fPA5:xwCvLUBsgqJmWR+/uxGKMSo5
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
smokeloader
pub5
Extracted
cryptbot
lysuht78.top
morisc07.top
-
payload_url
http://damysa10.top/download.php?file=lv.exe
Extracted
redline
pab3
185.215.113.15:61506
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
CryptBot payload 3 IoCs
Processes:
resource yara_rule behavioral4/memory/4868-88-0x0000000004890000-0x0000000004930000-memory.dmp family_cryptbot behavioral4/memory/4868-119-0x0000000000400000-0x0000000002D19000-memory.dmp family_cryptbot behavioral4/memory/4868-353-0x0000000000400000-0x0000000002D19000-memory.dmp family_cryptbot -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/468-83-0x0000000004B70000-0x0000000004B92000-memory.dmp family_redline behavioral4/memory/468-92-0x0000000004CC0000-0x0000000004CE0000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/468-83-0x0000000004B70000-0x0000000004B92000-memory.dmp family_sectoprat behavioral4/memory/468-92-0x0000000004CC0000-0x0000000004CE0000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral4/memory/1028-91-0x0000000004990000-0x0000000004A2D000-memory.dmp family_vidar behavioral4/memory/1028-97-0x0000000000400000-0x0000000002D15000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libstdc++-6.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup_installer.exeMon03727877c5134.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation Mon03727877c5134.exe -
Executes dropped EXE 10 IoCs
Processes:
setup_install.exeMon03a0dae10d.exeMon034208bb682c9a.exeMon036765ec49c3.exeMon03727877c5134.exeMon0335c84809e4.exeMon038dbdaf9a6ac148.exeMon03bcfa6aac.exeMon039408d622242f.exeMon03727877c5134.exepid process 1304 setup_install.exe 552 Mon03a0dae10d.exe 1804 Mon034208bb682c9a.exe 2616 Mon036765ec49c3.exe 3868 Mon03727877c5134.exe 4868 Mon0335c84809e4.exe 1028 Mon038dbdaf9a6ac148.exe 468 Mon03bcfa6aac.exe 1336 Mon039408d622242f.exe 3276 Mon03727877c5134.exe -
Loads dropped DLL 6 IoCs
Processes:
setup_install.exepid process 1304 setup_install.exe 1304 setup_install.exe 1304 setup_install.exe 1304 setup_install.exe 1304 setup_install.exe 1304 setup_install.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5012 1304 WerFault.exe setup_install.exe 2816 4868 WerFault.exe Mon0335c84809e4.exe 4324 1028 WerFault.exe Mon038dbdaf9a6ac148.exe 1888 4868 WerFault.exe Mon0335c84809e4.exe 2416 1028 WerFault.exe Mon038dbdaf9a6ac148.exe 3144 4868 WerFault.exe Mon0335c84809e4.exe 4960 1028 WerFault.exe Mon038dbdaf9a6ac148.exe 4372 1028 WerFault.exe Mon038dbdaf9a6ac148.exe 1424 1028 WerFault.exe Mon038dbdaf9a6ac148.exe 4212 4868 WerFault.exe Mon0335c84809e4.exe 644 4868 WerFault.exe Mon0335c84809e4.exe 3260 4868 WerFault.exe Mon0335c84809e4.exe 2924 4868 WerFault.exe Mon0335c84809e4.exe 4320 4868 WerFault.exe Mon0335c84809e4.exe 4948 4868 WerFault.exe Mon0335c84809e4.exe 4088 4868 WerFault.exe Mon0335c84809e4.exe 4968 4868 WerFault.exe Mon0335c84809e4.exe 4080 4868 WerFault.exe Mon0335c84809e4.exe 4372 4868 WerFault.exe Mon0335c84809e4.exe 4116 4868 WerFault.exe Mon0335c84809e4.exe 3496 4868 WerFault.exe Mon0335c84809e4.exe 4424 4868 WerFault.exe Mon0335c84809e4.exe 4948 4868 WerFault.exe Mon0335c84809e4.exe 4992 4868 WerFault.exe Mon0335c84809e4.exe 2128 4868 WerFault.exe Mon0335c84809e4.exe 1888 4868 WerFault.exe Mon0335c84809e4.exe 2756 4868 WerFault.exe Mon0335c84809e4.exe 4788 4868 WerFault.exe Mon0335c84809e4.exe 1288 4868 WerFault.exe Mon0335c84809e4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Mon034208bb682c9a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon034208bb682c9a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon034208bb682c9a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon034208bb682c9a.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Mon0335c84809e4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Mon0335c84809e4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Mon0335c84809e4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Mon034208bb682c9a.exepowershell.exepid process 1804 Mon034208bb682c9a.exe 1804 Mon034208bb682c9a.exe 2928 powershell.exe 2928 powershell.exe 2928 powershell.exe 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 3364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Mon034208bb682c9a.exepid process 1804 Mon034208bb682c9a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Mon03a0dae10d.exepowershell.exeMon03bcfa6aac.exedescription pid process Token: SeDebugPrivilege 552 Mon03a0dae10d.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 468 Mon03bcfa6aac.exe Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 Token: SeCreatePagefilePrivilege 3364 Token: SeShutdownPrivilege 3364 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Mon0335c84809e4.exepid process 4868 Mon0335c84809e4.exe 4868 Mon0335c84809e4.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
setup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeMon03727877c5134.exedescription pid process target process PID 1740 wrote to memory of 1304 1740 setup_installer.exe setup_install.exe PID 1740 wrote to memory of 1304 1740 setup_installer.exe setup_install.exe PID 1740 wrote to memory of 1304 1740 setup_installer.exe setup_install.exe PID 1304 wrote to memory of 3624 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 3624 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 3624 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 3612 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 3612 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 3612 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2128 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2128 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2128 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2380 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2380 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2380 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1600 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1600 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1600 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2820 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2820 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 2820 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1568 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1568 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1568 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 4832 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 4832 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 4832 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1340 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1340 1304 setup_install.exe cmd.exe PID 1304 wrote to memory of 1340 1304 setup_install.exe cmd.exe PID 4832 wrote to memory of 552 4832 cmd.exe Mon03a0dae10d.exe PID 4832 wrote to memory of 552 4832 cmd.exe Mon03a0dae10d.exe PID 2128 wrote to memory of 1804 2128 cmd.exe Mon034208bb682c9a.exe PID 2128 wrote to memory of 1804 2128 cmd.exe Mon034208bb682c9a.exe PID 2128 wrote to memory of 1804 2128 cmd.exe Mon034208bb682c9a.exe PID 3612 wrote to memory of 3868 3612 cmd.exe Mon03727877c5134.exe PID 3612 wrote to memory of 3868 3612 cmd.exe Mon03727877c5134.exe PID 3612 wrote to memory of 3868 3612 cmd.exe Mon03727877c5134.exe PID 1568 wrote to memory of 2616 1568 cmd.exe Mon036765ec49c3.exe PID 1568 wrote to memory of 2616 1568 cmd.exe Mon036765ec49c3.exe PID 1568 wrote to memory of 2616 1568 cmd.exe Mon036765ec49c3.exe PID 2380 wrote to memory of 1336 2380 cmd.exe Mon039408d622242f.exe PID 2380 wrote to memory of 1336 2380 cmd.exe Mon039408d622242f.exe PID 1340 wrote to memory of 4868 1340 cmd.exe Mon0335c84809e4.exe PID 1340 wrote to memory of 4868 1340 cmd.exe Mon0335c84809e4.exe PID 1340 wrote to memory of 4868 1340 cmd.exe Mon0335c84809e4.exe PID 2820 wrote to memory of 468 2820 cmd.exe Mon03bcfa6aac.exe PID 2820 wrote to memory of 468 2820 cmd.exe Mon03bcfa6aac.exe PID 2820 wrote to memory of 468 2820 cmd.exe Mon03bcfa6aac.exe PID 3624 wrote to memory of 2928 3624 cmd.exe powershell.exe PID 3624 wrote to memory of 2928 3624 cmd.exe powershell.exe PID 3624 wrote to memory of 2928 3624 cmd.exe powershell.exe PID 1600 wrote to memory of 1028 1600 cmd.exe Mon038dbdaf9a6ac148.exe PID 1600 wrote to memory of 1028 1600 cmd.exe Mon038dbdaf9a6ac148.exe PID 1600 wrote to memory of 1028 1600 cmd.exe Mon038dbdaf9a6ac148.exe PID 3868 wrote to memory of 3276 3868 Mon03727877c5134.exe Mon03727877c5134.exe PID 3868 wrote to memory of 3276 3868 Mon03727877c5134.exe Mon03727877c5134.exe PID 3868 wrote to memory of 3276 3868 Mon03727877c5134.exe Mon03727877c5134.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon03bcfa6aac.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03bcfa6aac.exeMon03bcfa6aac.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon0335c84809e4.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon03a0dae10d.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon036765ec49c3.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon038dbdaf9a6ac148.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon039408d622242f.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon034208bb682c9a.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon03727877c5134.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 5683⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03a0dae10d.exeMon03a0dae10d.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon034208bb682c9a.exeMon034208bb682c9a.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon039408d622242f.exeMon039408d622242f.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon038dbdaf9a6ac148.exeMon038dbdaf9a6ac148.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 8242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 8322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 9482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 11242⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon0335c84809e4.exeMon0335c84809e4.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 6002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 6802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 11562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 12482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 12442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 16122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 16402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 16522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 7842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 16802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 17882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 11882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 15202⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03727877c5134.exeMon03727877c5134.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03727877c5134.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03727877c5134.exe" -a2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon036765ec49c3.exeMon036765ec49c3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4868 -ip 48681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4868 -ip 48681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon0335c84809e4.exeFilesize
558KB
MD5110b3f8d1cebc76a3c0170cbe218fc38
SHA1f05973114d0f3d7918f70c003ce48b476d9aa1a9
SHA2562cb645cb092bfd2dc3847c07e85a6d3129f3fb680f656a850e53bc3ddb571540
SHA512fbffe2ccbedece36856fb7a7323d987fb79f257f92ec734a322af9da6909a3b7aeaf2714fedcdafb2bea53fd4cc0593c9733b73ca2470c5f88d7a0b96e026e70
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon034208bb682c9a.exeFilesize
178KB
MD5aba11960d853e755f03445ef57f5aa75
SHA1a3abfd93f7098be145c44316c9964eedb8b856e1
SHA25631ef5a8dcb3acc8d5ec74b1aecf9508f650a71710d7cfb79b6fff3a9324382b9
SHA512f83e5ed2fc8237dc50c0dada6f449025f5ea593a4edd101a33115cc8a3817c5db554fc2ad2f29a1228fbfb192e812a31a7425102bc60ffa411f72a06d38b1812
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon036765ec49c3.exeFilesize
631KB
MD594f06bfbb349287c89ccc92ac575123f
SHA134e36e640492423d55b80bd5ac3ddb77b6b9e87c
SHA256d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc
SHA512c8a5362f9a35737ac04b6e0c48371aa60e64adf1157e16191691ac4dccb8dbaac261b516ebb89fc84ba741616ea1ca888a4a180ef2cf89ca04ebdc7768ea0fbb
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03727877c5134.exeFilesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon038dbdaf9a6ac148.exeFilesize
545KB
MD5709c2ff21185c8fe650056769d080e41
SHA1b9181473e226994f153a64681f2083f52292ca2b
SHA256648b336e38d56000fc9765323103ad4b770d0609d04491213f3642da8621917b
SHA51238235ecbba174a1789e658f1ba684d371bda2a3c7b5c2ae0972720251393fd28220d6555858c87701402d0a40adf4c2df583d6c14bbbdf0dfd10bd22f9799b74
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon039408d622242f.exeFilesize
241KB
MD55866ab1fae31526ed81bfbdf95220190
SHA175a5e08b3b9ad2dff35dfbbb3ffe8d983c2be25f
SHA2569e1a149370efe9814bf2cbd87acfcfa410d1769efd86a9722da4373d6716d22e
SHA5128d99ab09e84e4ef309da34be94946cbfcffeb1c0ca49e2452deb738d801e551062ebb134f1b99a9baf03003a8e720d525521ce09aeac341d3cba3fcfbc618fb5
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03a0dae10d.exeFilesize
132KB
MD5655e97d4e1039c23a8e266832a0c6bbf
SHA1954769686dbc15c3a218a55cff16d366fe63aecb
SHA256ca9e19b7ca203d5f4f075e9464822cff1f4924ac64f7f7296d4df48b2112c9df
SHA51253d36dd54b2d084178e0e92a3675643c9a3c5cfcb0bdb31d75b5f7f0c8e8ebc065bff4617278e491f126c985d26244da81f3aba5550f6a9f865411d32e8d1b7d
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\Mon03bcfa6aac.exeFilesize
279KB
MD5af23965c3e2673940b70f436bb45f766
SHA1ccc8b03ea8c568f1b333458cff3f156898fc29f7
SHA256e6271d738fc78602abc8916fb4742638b2b4c4205882f6db24eb361694c67503
SHA512f0202e3ed32b9e69785bb50551b5143fe69298dead3c9a3d539cc6c6768f70f8263f074f912d1de5decb122bc365b7645428c0d10040f6f15a41f3a5ac0a4611
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\setup_install.exeFilesize
2.1MB
MD5b1af590a68401b7c43748dd26416cd2e
SHA1387e48ff46a375b6f25c2f1b01ababdb3ad4f4a6
SHA2568743c81d9008c5c62cc420ff1d8e212a061ca96a1d722beee45cfd2800c45139
SHA5125e6570c11f9b168166b95d7811df8d186cf4dff859473556e46715768dcf08ce41ada6b72f8ed655f57c5c842aef72fd42479a42a895ae414f8b7411dbe72783
-
C:\Users\Admin\AppData\Local\Temp\7zSCC6C8057\setup_install.exeFilesize
1.8MB
MD58072b5ac9d4be8b9b5d0fe331d7921ca
SHA17b61e92ceaa3d1654a0923385c015db463a5a31b
SHA256db376a47a59f3b4ebc823c60fa7718e93a6954a6d6b98225a3bb2204c889f275
SHA512c34c96096b1e4ec73cc0a387f70bb3c012aa0418b655e4421b9f7da284d36d7596a03af52b6a5c63d0f967f63803fa9c7cf8a38d2937c2d8535fd3362106ff15
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\QZB6Fh6j22JO.zipFilesize
751KB
MD538281e61dde7c5c2c585a2f1f4b5f1b4
SHA1b30f679807adf473b7c16e77807b5b1d4bd94d4f
SHA256b445915b9a1e05cfd59538eb09e78a8b8b56b3298d906ec292e4e9e4401ebc30
SHA5123ef9d53015e1c9c39f3348c831fdb20aa64baedeb177a035f9a73b845a8c06e52cf6580e7c614973fe7e542677f3fb3696acbdfe082a8106124f8fa7cd7fe82a
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Files\HideWrite.txtFilesize
710KB
MD5fc78076ce528cae64b947b6a2a5f509c
SHA1ae2b1cd47a3f634973c1a2343e5d31869b160633
SHA2568b5336f4e193e966fd6837e4c4824ffc6ea8350ada626228154d9f52ed02da1a
SHA5126c9642db32e1982095d175a8d52492b87cca16769aae191d83bed8231c8b881ae3a6c8fe549476c120a3dc01f464fcebf3f6c74ea0e55f80a26cce32b67e05d1
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Information.txtFilesize
686B
MD50bc944f980d5fc458a67a22e4845346d
SHA1c53bf733b794bb3ed0938c9f3d6ed58445d0437b
SHA256257c69f3cb64fe6c4f647c44d30bf44fd2a9870fc6f7808ac9c34ae7773d39d6
SHA51280a71fb4002d6901948ddbf0db2ca3ee345ec3345dda5d49ffa8b2931d14b00126aad67cf27381e7edca07739faa54d7024ef49becd09db7f8b58e558527d1a9
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Information.txtFilesize
1KB
MD5dd8ba1b04d0168d6390730941f47d7e0
SHA1c47ceb5684e72f6ea64b46c79f49668fb0a1bfbe
SHA2569cc06afe47d6c40b05ed464ceb660e06766582457cccc61acb85427560b300a7
SHA5129bc48fb745141694883fd94235817fdc9b9a3750d44fbf06e33afd37aca7943d75e209c930e0ea91107d4b26cc102d4e274c60a0c9fd2f693bdd985079b8c341
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Information.txtFilesize
3KB
MD52f8cffd5edbbc39198b711db626f9484
SHA1f43a7d34d35977a9ec30189c74bc68eba3321d80
SHA256bfb235c357ed37c18eebb3ca002df2d48b510c57ce3572a0e89700d6aff01c42
SHA51273086551a4499be8e3ad2d8dbc6d6184ae5598f96831ed16f0555bc1d67e6491478ce1b916d26fbc99da78930e05db1b37e68a12b6eaf08128e707ea32cfa3d2
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Information.txtFilesize
4KB
MD57c6146834a4aadb52b70a9497e6f103d
SHA13f8532d54faeb4aad7ec1f0246e48c55e6c2f354
SHA2561f5d55dcd21480429c59ccff4bd3b2fcac2533b751c64a279e3b53d3987c9e54
SHA512f6800d02d25ac3859d9c7ac3bdf14a7a15eecc1dd28f46edffa3469839d5c1b97be3ea3ed34b88c0ff936bcd718e58ceefb3859068ffc3296d4a6fc1a9638f6a
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\_Files\_Screen_Desktop.jpegFilesize
45KB
MD58300259c75ced2da4c7857ad61ce51e7
SHA19c0943e35e34e250572db23452361443d57a244e
SHA2567f5d21c2972db0619813a1d1fee64fb925e8dd0b2506eb28a3a5251716a338b2
SHA51230069382410f23286721cdb8c94d5bda3493881c25ce1a8dfba9f16fe589aba279cbd1052f90f33e70a62b5ca584b96b55c2db9b0d0bef8e32f21af1c7c8c68a
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\files_\system_info.txtFilesize
1KB
MD5d9add7b21a4014fa5c4c7d5bd109dd39
SHA19abde154fa25a06ded02e262600665efd06ae6be
SHA25650a1567adcb448ae76cc0b0f1167cf96c0e2eeb7669945ceed5522ce1b667c3e
SHA51296f2c8bd6b73a39a5916edc11d06759a836ac29ccdb5d70da445a811c0e8aa5212a8e9a68f7fb1eb89293f2a4eb88a19251e0d8e4cde81e8506e1fcd3a926e8f
-
C:\Users\Admin\AppData\Local\Temp\VArs8DJvhAX\files_\system_info.txtFilesize
7KB
MD584b98fb72722aaa38b5aa6e87d172b17
SHA1dc68cb6d373dfbec4e4c7c00a0e4c587e1d8b57a
SHA2567ac360f9a06cea988e254dbca5fc298300cf8635b426be79bb3de4587eeb5031
SHA512b9de0926f3b3f1ced6d1f335b05503472ff57b1ad8ee11c39f7ae900122f3f9609ccdaa2db182d4ba84f3d0e57780802c7dcdca9bbe5c719cd032e031b099fc7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nztoiqic.0f0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/468-89-0x00000000074E0000-0x0000000007A84000-memory.dmpFilesize
5.6MB
-
memory/468-129-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/468-111-0x0000000002F20000-0x0000000002F4F000-memory.dmpFilesize
188KB
-
memory/468-361-0x0000000002F50000-0x0000000003050000-memory.dmpFilesize
1024KB
-
memory/468-358-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/468-96-0x0000000007380000-0x00000000073BC000-memory.dmpFilesize
240KB
-
memory/468-359-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/468-83-0x0000000004B70000-0x0000000004B92000-memory.dmpFilesize
136KB
-
memory/468-135-0x0000000002F50000-0x0000000003050000-memory.dmpFilesize
1024KB
-
memory/468-130-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/468-133-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/468-357-0x00000000074D0000-0x00000000074E0000-memory.dmpFilesize
64KB
-
memory/468-127-0x0000000000400000-0x0000000002CD3000-memory.dmpFilesize
40.8MB
-
memory/468-92-0x0000000004CC0000-0x0000000004CE0000-memory.dmpFilesize
128KB
-
memory/468-105-0x00000000073C0000-0x000000000740C000-memory.dmpFilesize
304KB
-
memory/468-356-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/468-93-0x0000000007A90000-0x00000000080A8000-memory.dmpFilesize
6.1MB
-
memory/468-94-0x0000000004EF0000-0x0000000004F02000-memory.dmpFilesize
72KB
-
memory/468-121-0x0000000008120000-0x000000000822A000-memory.dmpFilesize
1.0MB
-
memory/552-81-0x00000000015C0000-0x00000000015DE000-memory.dmpFilesize
120KB
-
memory/552-79-0x00007FFC6E680000-0x00007FFC6F141000-memory.dmpFilesize
10.8MB
-
memory/552-112-0x00007FFC6E680000-0x00007FFC6F141000-memory.dmpFilesize
10.8MB
-
memory/552-77-0x0000000000EF0000-0x0000000000F16000-memory.dmpFilesize
152KB
-
memory/1028-97-0x0000000000400000-0x0000000002D15000-memory.dmpFilesize
41.1MB
-
memory/1028-91-0x0000000004990000-0x0000000004A2D000-memory.dmpFilesize
628KB
-
memory/1028-90-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB
-
memory/1304-54-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-49-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-115-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1304-117-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1304-118-0x000000006EB40000-0x000000006EB63000-memory.dmpFilesize
140KB
-
memory/1304-120-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-46-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1304-50-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1304-57-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1304-51-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1304-116-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1304-48-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1304-52-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-53-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-55-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1304-114-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/1304-47-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1304-56-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1804-131-0x0000000002F6E000-0x0000000002F77000-memory.dmpFilesize
36KB
-
memory/1804-80-0x0000000002D40000-0x0000000002D49000-memory.dmpFilesize
36KB
-
memory/1804-86-0x0000000000400000-0x0000000002CBA000-memory.dmpFilesize
40.7MB
-
memory/1804-124-0x0000000000400000-0x0000000002CBA000-memory.dmpFilesize
40.7MB
-
memory/2928-122-0x0000000006600000-0x000000000661E000-memory.dmpFilesize
120KB
-
memory/2928-128-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/2928-95-0x0000000005720000-0x0000000005742000-memory.dmpFilesize
136KB
-
memory/2928-84-0x00000000058C0000-0x0000000005EE8000-memory.dmpFilesize
6.2MB
-
memory/2928-132-0x0000000002D40000-0x0000000002D50000-memory.dmpFilesize
64KB
-
memory/2928-134-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/2928-106-0x0000000005FD0000-0x0000000006036000-memory.dmpFilesize
408KB
-
memory/2928-82-0x0000000002CC0000-0x0000000002CF6000-memory.dmpFilesize
216KB
-
memory/2928-99-0x0000000005F60000-0x0000000005FC6000-memory.dmpFilesize
408KB
-
memory/2928-113-0x0000000006140000-0x0000000006494000-memory.dmpFilesize
3.3MB
-
memory/3364-123-0x00000000029C0000-0x00000000029D6000-memory.dmpFilesize
88KB
-
memory/4868-353-0x0000000000400000-0x0000000002D19000-memory.dmpFilesize
41.1MB
-
memory/4868-360-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB
-
memory/4868-119-0x0000000000400000-0x0000000002D19000-memory.dmpFilesize
41.1MB
-
memory/4868-88-0x0000000004890000-0x0000000004930000-memory.dmpFilesize
640KB
-
memory/4868-87-0x0000000002EF0000-0x0000000002FF0000-memory.dmpFilesize
1024KB