Analysis
-
max time kernel
71s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 21:04
Static task
static1
Behavioral task
behavioral1
Sample
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
Resource
win10v2004-20240412-en
General
-
Target
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe
-
Size
242KB
-
MD5
ed931c81cd2ee363652b63ff6aebb6f0
-
SHA1
dc7756f0987d4b6f09dbd4b52fab4de03b7b880f
-
SHA256
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95
-
SHA512
3f400615c122ddb7826571bb5864f72841a07f86cf7274f55b115585b1ea35fb442cbaca2f676ff7d05a66d9d20fee9649b0eebf0e5db7f017779e8a37be765c
-
SSDEEP
6144:bZqwyNZcdrNHFCAZwd4TyQOI5JgpcvqNplcdaY5vK:bZqwykxFCAVT0Iw5pZyK
Malware Config
Signatures
-
Detect XtremeRAT payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-6-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2156-11-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2156-7-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2156-13-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2156-25-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2836-29-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2312-45-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2312-51-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2812-64-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2812-68-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2236-69-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2236-80-0x0000000000510000-0x0000000000590000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 14 IoCs
Processes:
java.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C} java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OXMNJQW6-G1EB-C08W-H26G-227E0PU8220C}\StubPath = "C:\\Windows\\java\\java.exe restart" java.exe -
Drops startup file 2 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe -
Executes dropped EXE 12 IoCs
Processes:
java.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exepid process 2836 java.exe 2312 java.exe 2764 java.exe 2812 java.exe 2236 java.exe 2300 java.exe 2304 java.exe 436 java.exe 600 java.exe 3056 java.exe 1920 java.exe 3000 java.exe -
Loads dropped DLL 13 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exejava.exepid process 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 2836 java.exe 2312 java.exe 2764 java.exe 2812 java.exe 2236 java.exe 2300 java.exe 2304 java.exe 436 java.exe 600 java.exe 3056 java.exe 1920 java.exe -
Adds Run key to start application 2 TTPs 14 IoCs
Processes:
java.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\java\\java.exe" java.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
java.exejava.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exedescription ioc process File opened for modification \??\PhysicalDrive0 java.exe File opened for modification \??\PhysicalDrive0 java.exe File opened for modification \??\PhysicalDrive0 java.exe File opened for modification \??\PhysicalDrive0 java.exe File opened for modification \??\PhysicalDrive0 java.exe File opened for modification \??\PhysicalDrive0 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe File opened for modification \??\PhysicalDrive0 java.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exedescription pid process target process PID 3000 set thread context of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 2836 set thread context of 2312 2836 java.exe java.exe PID 2764 set thread context of 2812 2764 java.exe java.exe PID 2236 set thread context of 2300 2236 java.exe java.exe PID 2304 set thread context of 436 2304 java.exe java.exe PID 600 set thread context of 3056 600 java.exe java.exe PID 1920 set thread context of 3000 1920 java.exe java.exe -
Drops file in Windows directory 2 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exedescription ioc process File opened for modification C:\Windows\java\java.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe File created C:\Windows\java\java.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 21 IoCs
Processes:
java.exejava.exejava.exejava.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ java.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key java.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exejava.exejava.exejava.exejava.exejava.exepid process 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 2836 java.exe 2764 java.exe 2236 java.exe 2304 java.exe 600 java.exe 1920 java.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exejava.exedescription pid process target process PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 3000 wrote to memory of 2156 3000 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe PID 2156 wrote to memory of 1980 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 1980 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 1980 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 1980 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2532 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 2156 wrote to memory of 2532 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 2156 wrote to memory of 2532 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 2156 wrote to memory of 2532 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe explorer.exe PID 2156 wrote to memory of 1980 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2636 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2636 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2636 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2636 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2636 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2648 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2648 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2648 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2648 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2648 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2720 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2720 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2720 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2720 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2720 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2852 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2852 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2852 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2852 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2852 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2576 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2576 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2576 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2576 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2576 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2840 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2840 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2840 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2840 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2840 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2556 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2556 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2556 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2556 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe iexplore.exe PID 2156 wrote to memory of 2836 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 2156 wrote to memory of 2836 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 2156 wrote to memory of 2836 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 2156 wrote to memory of 2836 2156 3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe java.exe PID 2836 wrote to memory of 2312 2836 java.exe java.exe PID 2836 wrote to memory of 2312 2836 java.exe java.exe PID 2836 wrote to memory of 2312 2836 java.exe java.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe"C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe"1⤵
- Drops startup file
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exeC:\Users\Admin\AppData\Local\Temp\3b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95.exe2⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\java\java.exeC:\Windows\java\java.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\java\java.exeC:\Windows\java\java.exe14⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"15⤵
-
C:\Windows\java\java.exeC:\Windows\java\java.exe16⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵
-
C:\Windows\java\java.exe"C:\Windows\java\java.exe"17⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfgFilesize
1KB
MD52eb7f132efb9924b7174eb5458df74f5
SHA1bde3f2f5eedc30401138575a67a74c0c7fd0163c
SHA256d867c821917aabe27e2f116e7460b65b5404e7a671bce56f75f2f54dd9561a82
SHA5120fb542eadc164b1c6f11d826d065d86bccb69171db3322084c5bd4803e24697edba0f477d027054284e0110d5ee684d51f1b0e4c95dcfd5b35cefcb5bdedbca9
-
C:\Windows\java\java.exeFilesize
242KB
MD5ed931c81cd2ee363652b63ff6aebb6f0
SHA1dc7756f0987d4b6f09dbd4b52fab4de03b7b880f
SHA2563b9c0116a50690bda605988ad95d72221fa7e2b8ecfe0e44fa929c347f1bcd95
SHA5123f400615c122ddb7826571bb5864f72841a07f86cf7274f55b115585b1ea35fb442cbaca2f676ff7d05a66d9d20fee9649b0eebf0e5db7f017779e8a37be765c
-
memory/600-180-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1920-204-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2156-25-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2156-6-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2156-8-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2156-11-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2156-24-0x0000000002B70000-0x0000000002C1A000-memory.dmpFilesize
680KB
-
memory/2156-7-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2156-13-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2236-92-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-96-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-118-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2236-107-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2236-106-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-105-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-104-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-103-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-102-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-101-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-100-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-99-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-98-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-97-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-95-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-94-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-93-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-91-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-90-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-89-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-88-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-87-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-69-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2236-70-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2236-71-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2236-72-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-73-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-74-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-75-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-76-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-77-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-78-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-79-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-80-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-81-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-82-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-83-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-84-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-85-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2236-86-0x0000000000510000-0x0000000000590000-memory.dmpFilesize
512KB
-
memory/2304-150-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2312-45-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2312-51-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2728-223-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2764-52-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2764-62-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2764-59-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2764-54-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2764-56-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2812-64-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2812-68-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-42-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-27-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2836-40-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-41-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-43-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2836-44-0x0000000002010000-0x00000000020BA000-memory.dmpFilesize
680KB
-
memory/2836-31-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-38-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-37-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/2836-29-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/3000-5-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3000-12-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3000-3-0x00000000003F0000-0x00000000003F3000-memory.dmpFilesize
12KB
-
memory/3000-2-0x0000000001E30000-0x0000000001E31000-memory.dmpFilesize
4KB
-
memory/3000-0-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB