Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
42s -
max time network
221s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Extracted
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
hakbit
Signatures
-
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 3772 sc.exe 1700 sc.exe 1520 sc.exe 3584 sc.exe -
Kills process with taskkill 47 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2204 taskkill.exe 1136 taskkill.exe 4760 taskkill.exe 3284 taskkill.exe 3664 taskkill.exe 3976 taskkill.exe 4216 taskkill.exe 1592 taskkill.exe 260 taskkill.exe 2568 taskkill.exe 4632 taskkill.exe 3632 taskkill.exe 3308 taskkill.exe 2228 taskkill.exe 560 taskkill.exe 644 taskkill.exe 3876 taskkill.exe 4164 taskkill.exe 2544 taskkill.exe 3360 taskkill.exe 656 taskkill.exe 3448 taskkill.exe 3056 taskkill.exe 1376 taskkill.exe 3552 taskkill.exe 4916 taskkill.exe 2264 taskkill.exe 3636 taskkill.exe 1328 taskkill.exe 1084 taskkill.exe 4784 taskkill.exe 3348 taskkill.exe 3104 taskkill.exe 2712 taskkill.exe 2648 taskkill.exe 1692 taskkill.exe 3868 taskkill.exe 1976 taskkill.exe 1156 taskkill.exe 4992 taskkill.exe 748 taskkill.exe 1172 taskkill.exe 3472 taskkill.exe 1684 taskkill.exe 1160 taskkill.exe 1944 taskkill.exe 3964 taskkill.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 6564 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 4164 taskkill.exe Token: SeDebugPrivilege 260 taskkill.exe Token: SeDebugPrivilege 3308 taskkill.exe Token: SeDebugPrivilege 3472 taskkill.exe Token: SeDebugPrivilege 3976 taskkill.exe Token: SeDebugPrivilege 3104 taskkill.exe Token: SeDebugPrivilege 3360 taskkill.exe Token: SeDebugPrivilege 3056 taskkill.exe Token: SeDebugPrivilege 3348 taskkill.exe Token: SeDebugPrivilege 656 taskkill.exe Token: SeDebugPrivilege 3664 taskkill.exe Token: SeDebugPrivilege 3552 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeDebugPrivilege 3284 taskkill.exe Token: SeDebugPrivilege 4216 taskkill.exe Token: SeDebugPrivilege 4784 taskkill.exe Token: SeDebugPrivilege 4632 taskkill.exe Token: SeDebugPrivilege 1084 taskkill.exe Token: SeDebugPrivilege 3632 taskkill.exe Token: SeDebugPrivilege 3636 taskkill.exe Token: SeDebugPrivilege 748 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 4992 taskkill.exe Token: SeDebugPrivilege 4916 taskkill.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 1944 taskkill.exe Token: SeDebugPrivilege 3868 taskkill.exe Token: SeDebugPrivilege 3876 taskkill.exe Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 2228 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 560 taskkill.exe Token: SeDebugPrivilege 1976 taskkill.exe Token: SeDebugPrivilege 644 taskkill.exe Token: SeDebugPrivilege 1592 taskkill.exe Token: SeDebugPrivilege 4760 taskkill.exe Token: SeDebugPrivilege 1684 taskkill.exe Token: SeDebugPrivilege 2264 taskkill.exe Token: SeDebugPrivilege 2544 taskkill.exe Token: SeDebugPrivilege 3448 taskkill.exe Token: SeDebugPrivilege 1160 taskkill.exe Token: SeDebugPrivilege 3964 taskkill.exe Token: SeDebugPrivilege 2204 taskkill.exe Token: SeDebugPrivilege 1156 taskkill.exe Token: SeDebugPrivilege 1376 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription pid process target process PID 2128 wrote to memory of 4860 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 2128 wrote to memory of 4860 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 2128 wrote to memory of 3772 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 3772 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 3584 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 3584 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 1520 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 1520 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 1700 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 1700 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 2128 wrote to memory of 644 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 644 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3104 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3104 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3308 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3308 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3348 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3348 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4164 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4164 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3472 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3472 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 260 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 260 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3448 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3448 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3056 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3056 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3976 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3976 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3632 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3632 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3664 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3664 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3876 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3876 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1084 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1084 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4632 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4632 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1328 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1328 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3284 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3284 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2568 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2568 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3636 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 3636 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4760 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4760 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1172 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1172 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1976 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1976 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1136 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1136 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2264 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2264 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2204 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 2204 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4784 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 4784 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1156 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 2128 wrote to memory of 1156 2128 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵PID:4860
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
PID:3772 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
PID:3584 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
PID:1520 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
PID:1700 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:644 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3104 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3308 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4164 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:260 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3448 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3976 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3664 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3876 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1084 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4632 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3284 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3636 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1172 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4916 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:656 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3868 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3552 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1376 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4216 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4992 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:560 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3360 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1160 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵PID:3580
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt2⤵
- Opens file in notepad (likely ransom note)
PID:6564 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵PID:6540
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:5608 -
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵PID:5988
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe2⤵PID:3500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.logFilesize
1.3MB
MD55124da711bd9e1da0e52e2163a82cd42
SHA1956a4d508a884c6acac3a0c93d43d63abbc6fdfc
SHA25604172f2e6bc5b91895137551829979f1b127955827e518fda28897fc5ea49a08
SHA5126a6a20af169db9eeed1981102e832514ddb878e9d36e8c3fbf9e506b0730f2f308b2d3049e1d37fc23a7f94144b9efcf7f8d0ded972c9fd33bdf56cff01bf429
-
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.energy[[email protected]]Filesize
180KB
MD5b97db2caf088453e0fb34ef22db75246
SHA1b5d8493bd93dab339360f0769732c6e16c52ab6f
SHA2565d533526321ce8a3a5d135ae195832b219c153ca7302344dd0b3c47f2bbc182a
SHA512dca229d4956e7ade4e649e1fec1c171ba08182cebbdef08c5a0d20291bda185cf74f0de4b26bc7e242e561b7c5802deb850d25248a1404df29ecc8baf4b6667d
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ughkokj.tao.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txtFilesize
828B
MD54b29e8a46f40ba3d61766ededdbf85ff
SHA1c33600fad907752780a42105889c75ed86bc2172
SHA256ee4cfa612b46e5055a12e4a4f69e275655ca6f20e4888c4052ff329569396c6a
SHA512a9ec747232a87be365b13edd0cc05d31b16f516b46d61dc33804b46697fdad679bcdf7f74862d6df09e3566d02d5e41f4fcdb191d31e8ad9c943ba060a8fd3a5
-
memory/2128-12-0x00007FFA36590000-0x00007FFA37051000-memory.dmpFilesize
10.8MB
-
memory/2128-104-0x00007FFA36593000-0x00007FFA36595000-memory.dmpFilesize
8KB
-
memory/2128-0-0x00007FFA36593000-0x00007FFA36595000-memory.dmpFilesize
8KB
-
memory/2128-159-0x00007FFA36590000-0x00007FFA37051000-memory.dmpFilesize
10.8MB
-
memory/2128-1-0x0000000000480000-0x000000000049A000-memory.dmpFilesize
104KB
-
memory/2128-600-0x00007FFA36590000-0x00007FFA37051000-memory.dmpFilesize
10.8MB
-
memory/3580-11-0x000002283DB10000-0x000002283DB32000-memory.dmpFilesize
136KB