Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
105da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8[email protected]
windows7-x64
4[email protected]
windows10-2004-x64
4[email protected]
windows7-x64
1[email protected]
windows10-2004-x64
1Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 10Analysis
-
max time kernel
1693s -
max time network
1701s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 16:13
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
31.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20240611-en
General
-
Target
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
-
Size
669KB
-
MD5
ead18f3a909685922d7213714ea9a183
-
SHA1
1270bd7fd62acc00447b30f066bb23f4745869bf
-
SHA256
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
-
SHA512
6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
-
SSDEEP
6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL
Malware Config
Extracted
C:\Users\Public\Documents\_readme.txt
https://we.tl/t-T9WE5uiVT6
Signatures
-
Executes dropped EXE 24 IoCs
Processes:
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exepid process 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2664 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1116 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1160 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1748 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1604 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2140 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1972 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 3024 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2424 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2644 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2108 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1064 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2820 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2592 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 764 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 608 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2672 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2224 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1648 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral17/memory/1932-0-0x0000000000400000-0x00000000004A9000-memory.dmp upx C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe upx behavioral17/memory/2968-27-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/956-47-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1852-48-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/956-67-0x0000000003D10000-0x0000000003DB9000-memory.dmp upx behavioral17/memory/2248-124-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1756-140-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1116-163-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/996-175-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2336-189-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1748-209-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2008-221-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2140-235-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1972-247-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/3024-271-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2424-285-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/1064-320-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2820-335-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/764-348-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/608-371-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2224-387-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral17/memory/2672-386-0x0000000000400000-0x00000000004A9000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c20c43d1-4643-4aa2-832d-2f13d7393103\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart" 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe -
Looks up external IP address via web service 37 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 41 api.2ip.ua 71 api.2ip.ua 26 api.2ip.ua 28 api.2ip.ua 58 api.2ip.ua 60 api.2ip.ua 63 api.2ip.ua 96 api.2ip.ua 95 api.2ip.ua 98 api.2ip.ua 20 api.2ip.ua 47 api.2ip.ua 51 api.2ip.ua 55 api.2ip.ua 75 api.2ip.ua 90 api.2ip.ua 94 api.2ip.ua 4 api.2ip.ua 31 api.2ip.ua 35 api.2ip.ua 73 api.2ip.ua 83 api.2ip.ua 88 api.2ip.ua 18 api.2ip.ua 37 api.2ip.ua 52 api.2ip.ua 80 api.2ip.ua 84 api.2ip.ua 49 api.2ip.ua 65 api.2ip.ua 86 api.2ip.ua 9 api.2ip.ua 42 api.2ip.ua 45 api.2ip.ua 56 api.2ip.ua 76 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exepid process 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2236 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2236 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1852 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1852 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2664 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2664 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1116 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1116 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1160 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1160 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1748 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1748 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1604 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1604 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2140 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2140 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1972 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 3024 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2424 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2644 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2644 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2108 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2108 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1064 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2820 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2820 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 764 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 764 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2592 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2592 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 608 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2224 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2224 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 2672 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1648 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 1648 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exetaskeng.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exedescription pid process target process PID 1932 wrote to memory of 2612 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe icacls.exe PID 1932 wrote to memory of 2612 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe icacls.exe PID 1932 wrote to memory of 2612 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe icacls.exe PID 1932 wrote to memory of 2612 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe icacls.exe PID 1932 wrote to memory of 2968 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1932 wrote to memory of 2968 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1932 wrote to memory of 2968 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1932 wrote to memory of 2968 1932 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 956 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 956 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 956 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 956 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 1852 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 1852 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 1852 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2968 wrote to memory of 1852 2968 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 956 wrote to memory of 2236 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 956 wrote to memory of 2236 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 956 wrote to memory of 2236 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 956 wrote to memory of 2236 956 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2248 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2248 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2248 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2248 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 1756 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 1756 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 1756 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 1756 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 2664 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 2664 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 2664 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2248 wrote to memory of 2664 2248 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1756 wrote to memory of 1116 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1756 wrote to memory of 1116 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1756 wrote to memory of 1116 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 1756 wrote to memory of 1116 1756 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 996 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 996 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 996 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 996 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 2336 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 2336 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 2336 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 2336 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 1160 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 1160 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 1160 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 996 wrote to memory of 1160 996 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2336 wrote to memory of 1748 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2336 wrote to memory of 1748 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2336 wrote to memory of 1748 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2336 wrote to memory of 1748 2336 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2008 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2008 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2008 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2612 wrote to memory of 2008 2612 taskeng.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 1604 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 1604 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 1604 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 1604 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 2140 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 2140 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 2140 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe PID 2008 wrote to memory of 2140 2008 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 956 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2968 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
C:\Windows\system32\taskeng.exetaskeng.exe {C269A889-3E24-47D1-A49E-8787365DC536} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1756 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1116 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2248 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2664 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2336 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 996 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1604 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1604 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2008 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2140 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3024 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2424 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3024 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2644 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1064 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2820 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:764 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1064 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:608 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2672 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1648 -
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 608 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12Filesize
1KB
MD52365869258df7a66a2121b802ca4afd9
SHA173acc30a2edeb9d6830de559bb8a74f35168135d
SHA256d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
SHA512795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8Filesize
436B
MD51bfe0a81db078ea084ff82fe545176fe
SHA150b116f578bd272922fa8eae94f7b02fd3b88384
SHA2565ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA51237c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12Filesize
174B
MD5f8734765e1111e584e9aa63029416209
SHA15a0a81dd01d0d243ad9cff24200fdc38ba4bbf31
SHA256599e3c347d18d7c19aef96b01604af9619e113390e4d327ca128dd072bf4d08c
SHA512fcf2aec92b47b38e926211c3d1ad27eb9576d3850bfd4c2d2700455490e18c3fff084459315c17735f1dce58f2a68842983b7792a709c1d760d79150c282f847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c245feca155eedc7dc26a3ce977470f7
SHA1b87528c3d70ad8cfd2f9c3a020175e7588ffe2de
SHA256d76289164694bf24b59d4ebeebefed353afeb59e241b816af6f683b6c403aa37
SHA5126b186742563c06793285316c56832ae8d0bf414ed55c7c358b4e1eaf74e0179ee88006e2ed6580976088ec523979de927f96db76b76f8954cde6d88092c4d029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8Filesize
170B
MD5c94e544682abc97254220457b562be29
SHA16c1994af51eb0ae3f5e539a6df2bf15e0bbd49f2
SHA256e4647f4319543e201845fb24abb344efed589a800812ef69a86bf0d561221db5
SHA5123b9e0c8da13ad08366061df24ba48f90ceb3accee59416c427b11035bec471f5d94e7bd3b1aa31f4dc55b7b4a875e78960e516990a556763ecc24ed477eaf104
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD583c08114baa3f3c52bbde7af32e1abdb
SHA1fa0e4e10d85b4c106faef46909213dff8a2c0355
SHA2567e74ccae0e1e59fd12bc3e33e875a33293692ee520afac85a14dbd16270b9b69
SHA512b85021725850766c5df3e861b9b1e79a16413200e05009adcee667ab2a142e9cbd5786fd7336994a1d7c163fa3eeb606fbf21247e1e278f0a3b5bf011f1ded86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5202bd7cef2b44781d6447f48cf54288b
SHA1276b400a58edab230d24626a19d0edd9ab7a00cd
SHA256d2fa18ea5b7b1da05d616bfb724a6fb80b976b8cb9f41d5b66cc51595d26d23d
SHA512220cf83d83944a8f86cd52d5f756e07efc3ab1dd3fd5e47812bf9712c735f5d82a073e3041e1dd12985eea36e1c1d482ed66a5a4dc718feb1466d745080a58d7
-
C:\Users\Admin\AppData\Local\Temp\Cab453A.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarBF1C.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\c20c43d1-4643-4aa2-832d-2f13d7393103\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeFilesize
669KB
MD5ead18f3a909685922d7213714ea9a183
SHA11270bd7fd62acc00447b30f066bb23f4745869bf
SHA2565da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA5126e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
-
C:\Users\Public\Documents\_readme.txtFilesize
1KB
MD5d75064cfaac9c92f52aadf373dc7e463
SHA136ea05181d9b037694929ec81f276f13c7d2655c
SHA256163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508
SHA51243387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1
-
memory/608-371-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/608-382-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/608-391-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/764-348-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/764-367-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/956-79-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/956-47-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/956-67-0x0000000003D10000-0x0000000003DB9000-memory.dmpFilesize
676KB
-
memory/996-184-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/996-185-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/996-175-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/996-186-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/996-190-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1064-337-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1064-320-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1064-331-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1116-172-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1116-163-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1160-200-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1604-269-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1604-257-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1648-418-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1748-209-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1748-218-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1756-153-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1756-173-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1756-140-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1852-81-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1852-48-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1852-83-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1932-25-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1932-3-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/1932-21-0x0000000003CE0000-0x0000000003D89000-memory.dmpFilesize
676KB
-
memory/1932-2-0x0000000000910000-0x0000000000A10000-memory.dmpFilesize
1024KB
-
memory/1932-0-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1932-26-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1932-24-0x0000000000910000-0x0000000000A10000-memory.dmpFilesize
1024KB
-
memory/1932-22-0x0000000003CF0000-0x0000000003D99000-memory.dmpFilesize
676KB
-
memory/1972-258-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1972-247-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1972-268-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2008-221-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2008-230-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2008-231-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2008-232-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2008-236-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2108-316-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2140-235-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2140-256-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2224-407-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2224-387-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2236-78-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2248-137-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2248-142-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2248-124-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2248-135-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2248-136-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2336-189-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2336-219-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2424-318-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2424-285-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2592-365-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2644-306-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2664-152-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2672-386-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2672-420-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2820-369-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2820-335-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-43-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-46-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-29-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-30-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-27-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-44-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2968-45-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3024-287-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3024-282-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3024-281-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3024-280-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3024-271-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB