Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 10Analysis
-
max time kernel
1693s -
max time network
1704s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
03-07-2024 16:13
General
-
Target
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
-
Size
669KB
-
MD5
ead18f3a909685922d7213714ea9a183
-
SHA1
1270bd7fd62acc00447b30f066bb23f4745869bf
-
SHA256
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
-
SHA512
6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
-
SSDEEP
6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Documents\_readme.txt
Ransom Note
ATTENTION!
Don't worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-T9WE5uiVT6
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
[email protected]
Reserve e-mail address to contact us:
[email protected]
Your personal ID:
046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
URLs
https://we.tl/t-T9WE5uiVT6
Signatures
-
Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 24 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 35 IoCs
-
Looks up external IP address via web service 35 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2824 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt14⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 10645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 17604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2220 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 10804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 10323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 21242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4728 -ip 47281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4624 -ip 46241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2824 -ip 28241⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3204 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 10643⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3508 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 10923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 16682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3704 -ip 37041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2220 -ip 22201⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4656 -ip 46561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3508 -ip 35081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3204 -ip 32041⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3736 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 17243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4680 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 15963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 15202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2344 -ip 23441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3736 -ip 37361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3848 -ip 38481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4680 -ip 46801⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1484 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 16283⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1716 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 10603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 16402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 976 -ip 9761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1716 -ip 17161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4444 -ip 44441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1484 -ip 14841⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4948 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 16243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 5040 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 16163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 16602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1972 -ip 19721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5040 -ip 50401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 728 -ip 7281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4948 -ip 49481⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1656 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 10604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 16403⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 688 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 16043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 17042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1468 -ip 14681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 688 -ip 6881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1656 -ip 16561⤵
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeC:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2424 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 10644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 16403⤵
- Program crash
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4928 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 16802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 796 -ip 7961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4748 -ip 47481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2424 -ip 24241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.logFilesize
1.3MB
MD5f782b09fd215d3d9bb898d61ea2e7a37
SHA1a382348e9592bdf93dd10c49773b815a992fa7c7
SHA2567bd4646090dff9875e08ea00e5727b11be19fcb850344856e66360c152835694
SHA5129342bd7a0cbabd7e699ea545897a6403371a0034e4bea067a9662dad9e492c5fa9b27efa4c850e1c001c79d6a76ffe0dacb6831010e41c8d5e2a92bd5b898606
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.kropunFilesize
622KB
MD54e6518161cc338011531e6ec335401e2
SHA16d221aae3781af873141e6bbc6790c7ffb20259e
SHA256a47f41aa7bcec0354731bea88367b16ea9010ff199298e613b6e3aee6744beca
SHA512549c082c5d737f1b1ffcabea6b7f5c44d87efbc9864081afb02a10fa33ffb7c4a081956814e0ccbf9f0ed8a590c4ee9bad782ca49bd63ec9818a25e5b3af1382
-
C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msiFilesize
736KB
MD5c3c0fe1bf5f38a6c89cead208307b99c
SHA1df5d4f184c3124d4749c778084f35a2c00066b0b
SHA256f4f6d008e54b5a6bac3998fc3fe8e632c347d6b598813e3524d5489b84bd2eaf
SHA5120f3e96d16c512e37025b04ff7989d60126c3d65fe868dbcfbeae4dac910ce04fc52d1089f0e41ce85c2def0182a927fdcc349094e74cdd21b45a42fde7f01806
-
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msiFilesize
180KB
MD5b2e47100abd58190e40c8b6f9f672a36
SHA1a754a78021b16e63d9e606cacc6de4fcf6872628
SHA256889217bcb971387bc3cb6d76554646d2b0822eceb102320d40adf2422c829128
SHA512d30da8c901e063df5901d011b22a01f884234ddddd44b9e81b3c43d93a51e10342074523339d155d69ff03a03a1df66c7d19e0137a16f47735b5b600616ca2a9
-
C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msiFilesize
26.0MB
MD5078fdfc06d675c9476796f61e8d8b396
SHA1183e0f30aad003e5443fc282813f349ebd7bb1c8
SHA25671474bbf9ec8997bb0ec65853cb095b000f1cdd52aa3f53b486a994588a4b7f7
SHA512ec1b7bb3993e7022b600557fb63f405cca68fa269ebf9cebb4c699c7e35ac3bdafac44c12b60b67c01987d499023a2b5cfea0bdb66684eff4d67546ec5952a68
-
C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msiFilesize
28.5MB
MD501bc6dc2e63ba4656e64f83debbc1f4e
SHA1823cb85a326995b562bd02e26996a4a841795322
SHA256b96e7138eee33474e5ec02c855673b56f78f0773d10fb962b7c9d015597db689
SHA51290f0a9df306c83c3c10cdc7cb03110bb75796b3462a3562743a5a4cf9366d85e157cdf7b60bf6458051a0deec9275ae30fc49d19f83aebaae01ec908b3335175
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12Filesize
1KB
MD52365869258df7a66a2121b802ca4afd9
SHA173acc30a2edeb9d6830de559bb8a74f35168135d
SHA256d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
SHA512795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8Filesize
436B
MD51bfe0a81db078ea084ff82fe545176fe
SHA150b116f578bd272922fa8eae94f7b02fd3b88384
SHA2565ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA51237c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12Filesize
174B
MD55413ecc23c0ba6536c815c0a0921c4bf
SHA12976e43f95c67598c18567ce7818c48d04092fcf
SHA256580fd653a810cc232f5eb88785c4f31295a79d64ba02d5936be8529aa03c63be
SHA512466bcc9669fa6e3c1384fbd9e6bcc139c6ea051e673b196682f9407ed22ba31ae4b0208ad2de0ed1ce0a7510c47511493392c429ed02d791d1becdde02fffefd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8Filesize
170B
MD5b55754d8033c850e4feff2b1f9f277a1
SHA1e907302ee80f7cbb7c36cf01206a55ddf51279d0
SHA2567364a4cd202823b44a607f7922273e04d3cbb41eb2c9aea9cb44c62f6dc5f198
SHA5122e71a85e9213407824e9a0bb88c985652bd461ce50ef50394065e3f3e685dfa79a20ab2ffbb804df9dda3c2b2515740621c927678343837154df5432a3e7348e
-
C:\Users\Admin\AppData\Local\ef2513b2-e2df-4a44-808c-7e2436c6c4cc\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exeFilesize
669KB
MD5ead18f3a909685922d7213714ea9a183
SHA11270bd7fd62acc00447b30f066bb23f4745869bf
SHA2565da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA5126e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
-
C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.dbFilesize
16KB
MD5e6f74e2e02b6bc6051dc9d3c23b21061
SHA185e6d7bddee419dafe3908b3b7958e1bf7a4c433
SHA2564ee4950c5677a3ddd56bbfc3eb4c4893931916a8dd681f6b09def926c93b0334
SHA512b61fd1318c118b47f251720ae8ebabb4a2d4ea03f6f975e7040f007c61133edadf07a6e53d54583698ef2afd6e608eb31ca23c511211b694bc1adb71937f202a
-
C:\Users\Public\Documents\_readme.txtFilesize
1KB
MD5d75064cfaac9c92f52aadf373dc7e463
SHA136ea05181d9b037694929ec81f276f13c7d2655c
SHA256163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508
SHA51243387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/688-1320-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/688-1314-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/688-1331-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/728-1310-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/728-1301-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/796-1348-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/796-1354-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/976-1273-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/976-1279-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1468-1329-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1468-1322-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1484-1272-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1484-1287-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1656-1338-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1656-1321-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1716-1268-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1716-1269-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1716-1266-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1716-1280-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1972-1303-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1972-1297-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-22-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-1208-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-1106-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-32-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-24-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-23-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-17-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2220-12-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2344-1258-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2344-1251-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2344-1259-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2424-1346-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2424-1363-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2824-28-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2824-38-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2824-25-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/2824-33-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3204-1223-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3204-1226-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3204-1213-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3508-1221-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3508-1211-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3508-1210-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3508-1124-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3704-1207-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3704-34-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3704-26-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3736-1260-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3736-1253-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3736-1247-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3736-1234-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3848-1235-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3848-1248-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3848-1263-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3848-1262-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4444-1278-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4444-1285-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4624-30-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4624-36-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4624-37-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4656-1220-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4680-1228-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4680-1246-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4680-1231-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4680-1264-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4680-1230-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4728-2-0x00000000007C0000-0x00000000008C0000-memory.dmpFilesize
1024KB
-
memory/4728-3-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4728-0-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4728-15-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4728-14-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4748-1352-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4748-1361-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4928-1345-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4928-1356-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4928-1340-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4948-1296-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4948-1312-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4952-1336-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/4952-1326-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5032-1225-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5032-1218-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5032-1224-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5040-1305-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5040-1295-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/5040-1289-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB