Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 01:27
Behavioral task
behavioral1
Sample
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Resource
win10v2004-20240709-en
General
-
Target
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
-
Size
21.3MB
-
MD5
416de11d210ae0ff50214021ff57b32b
-
SHA1
3142453c18080b83d8dbdeba89524beea1c94ff3
-
SHA256
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
-
SHA512
e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
-
SSDEEP
393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF
Malware Config
Extracted
redline
cheat
154.81.220.233:28105
Extracted
quasar
1.4.1
themdas
auroraforge.art:55326
thesirenmika.com:55713
0cbdfe7f-0215-41e8-a7b5-d4fbbc555089
-
encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
-
install_name
up2.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/792-60-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_redline behavioral2/memory/636-43-0x0000000000320000-0x000000000033E000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_sectoprat behavioral2/memory/636-43-0x0000000000320000-0x000000000033E000-memory.dmp family_sectoprat -
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Aurora.exe shurk_stealer behavioral2/memory/540-101-0x00007FF69A3A0000-0x00007FF69BC6F000-memory.dmp shurk_stealer -
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
Processes:
vlc.exesvchost.exedescription pid process target process PID 2776 created 3404 2776 vlc.exe Explorer.EXE PID 2776 created 3404 2776 vlc.exe Explorer.EXE PID 2776 created 3404 2776 vlc.exe Explorer.EXE PID 4668 created 3404 4668 svchost.exe Explorer.EXE PID 4668 created 3404 4668 svchost.exe Explorer.EXE PID 4668 created 3404 4668 svchost.exe Explorer.EXE PID 4668 created 3404 4668 svchost.exe Explorer.EXE -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4668-162-0x00007FF6D46A0000-0x00007FF6D4C3A000-memory.dmp xmrig behavioral2/memory/916-165-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-167-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-169-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-171-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-173-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-175-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-177-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-179-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-181-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig behavioral2/memory/916-183-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmp xmrig -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Executes dropped EXE 7 IoCs
Processes:
AdobeUpdate.exebuild.exeOneDrive.exevlc.exeAurora.exeMsedge.exesvchost.exepid process 892 AdobeUpdate.exe 636 build.exe 2456 OneDrive.exe 2776 vlc.exe 540 Aurora.exe 3212 Msedge.exe 4668 svchost.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/1444-90-0x00000000007E0000-0x00000000022AA000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AdobeUpdate.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe" AdobeUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe" powershell.exe -
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Processes:
powershell.exepowershell.exepowershell.exepid process 1968 powershell.exe 2304 powershell.exe 5064 powershell.exe -
Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exepid process 3508 powercfg.exe 1532 powercfg.exe 2856 powercfg.exe 3168 cmd.exe 4560 powercfg.exe 1444 powercfg.exe 2476 powercfg.exe 3868 powercfg.exe 3792 cmd.exe 760 powercfg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exepid process 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
OneDrive.exesvchost.exedescription pid process target process PID 2456 set thread context of 792 2456 OneDrive.exe RegAsm.exe PID 4668 set thread context of 1604 4668 svchost.exe conhost.exe PID 4668 set thread context of 916 4668 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
OneDrive.exepowershell.execmd.exeRegAsm.exeschtasks.exe72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exebuild.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.execmd.exePING.EXEpid process 2136 cmd.exe 860 cmd.exe 1848 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exepowershell.exevlc.exepowershell.exesvchost.exepowershell.exesvchost.exepid process 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe 5064 powershell.exe 5064 powershell.exe 5064 powershell.exe 2776 vlc.exe 2776 vlc.exe 2776 vlc.exe 2776 vlc.exe 1968 powershell.exe 1968 powershell.exe 1968 powershell.exe 2776 vlc.exe 2776 vlc.exe 4668 svchost.exe 4668 svchost.exe 4668 svchost.exe 4668 svchost.exe 2304 powershell.exe 2304 powershell.exe 2304 powershell.exe 4668 svchost.exe 4668 svchost.exe 4668 svchost.exe 4668 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
RegAsm.exepowershell.exebuild.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 792 RegAsm.exe Token: SeDebugPrivilege 5064 powershell.exe Token: SeDebugPrivilege 636 build.exe Token: SeShutdownPrivilege 760 powercfg.exe Token: SeCreatePagefilePrivilege 760 powercfg.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeShutdownPrivilege 2856 powercfg.exe Token: SeCreatePagefilePrivilege 2856 powercfg.exe Token: SeShutdownPrivilege 4560 powercfg.exe Token: SeCreatePagefilePrivilege 4560 powercfg.exe Token: SeShutdownPrivilege 1444 powercfg.exe Token: SeCreatePagefilePrivilege 1444 powercfg.exe Token: SeIncreaseQuotaPrivilege 1968 powershell.exe Token: SeSecurityPrivilege 1968 powershell.exe Token: SeTakeOwnershipPrivilege 1968 powershell.exe Token: SeLoadDriverPrivilege 1968 powershell.exe Token: SeSystemProfilePrivilege 1968 powershell.exe Token: SeSystemtimePrivilege 1968 powershell.exe Token: SeProfSingleProcessPrivilege 1968 powershell.exe Token: SeIncBasePriorityPrivilege 1968 powershell.exe Token: SeCreatePagefilePrivilege 1968 powershell.exe Token: SeBackupPrivilege 1968 powershell.exe Token: SeRestorePrivilege 1968 powershell.exe Token: SeShutdownPrivilege 1968 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeSystemEnvironmentPrivilege 1968 powershell.exe Token: SeRemoteShutdownPrivilege 1968 powershell.exe Token: SeUndockPrivilege 1968 powershell.exe Token: SeManageVolumePrivilege 1968 powershell.exe Token: 33 1968 powershell.exe Token: 34 1968 powershell.exe Token: 35 1968 powershell.exe Token: 36 1968 powershell.exe Token: SeIncreaseQuotaPrivilege 1968 powershell.exe Token: SeSecurityPrivilege 1968 powershell.exe Token: SeTakeOwnershipPrivilege 1968 powershell.exe Token: SeLoadDriverPrivilege 1968 powershell.exe Token: SeSystemProfilePrivilege 1968 powershell.exe Token: SeSystemtimePrivilege 1968 powershell.exe Token: SeProfSingleProcessPrivilege 1968 powershell.exe Token: SeIncBasePriorityPrivilege 1968 powershell.exe Token: SeCreatePagefilePrivilege 1968 powershell.exe Token: SeBackupPrivilege 1968 powershell.exe Token: SeRestorePrivilege 1968 powershell.exe Token: SeShutdownPrivilege 1968 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeSystemEnvironmentPrivilege 1968 powershell.exe Token: SeRemoteShutdownPrivilege 1968 powershell.exe Token: SeUndockPrivilege 1968 powershell.exe Token: SeManageVolumePrivilege 1968 powershell.exe Token: 33 1968 powershell.exe Token: 34 1968 powershell.exe Token: 35 1968 powershell.exe Token: 36 1968 powershell.exe Token: SeIncreaseQuotaPrivilege 1968 powershell.exe Token: SeSecurityPrivilege 1968 powershell.exe Token: SeTakeOwnershipPrivilege 1968 powershell.exe Token: SeLoadDriverPrivilege 1968 powershell.exe Token: SeSystemProfilePrivilege 1968 powershell.exe Token: SeSystemtimePrivilege 1968 powershell.exe Token: SeProfSingleProcessPrivilege 1968 powershell.exe Token: SeIncBasePriorityPrivilege 1968 powershell.exe Token: SeCreatePagefilePrivilege 1968 powershell.exe Token: SeBackupPrivilege 1968 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
svchost.exepid process 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
svchost.exepid process 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe 916 svchost.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exeAdobeUpdate.execmd.execmd.exeOneDrive.execmd.execmd.execmd.execmd.exesvchost.exedescription pid process target process PID 1444 wrote to memory of 892 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe AdobeUpdate.exe PID 1444 wrote to memory of 892 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe AdobeUpdate.exe PID 892 wrote to memory of 2136 892 AdobeUpdate.exe cmd.exe PID 892 wrote to memory of 2136 892 AdobeUpdate.exe cmd.exe PID 1444 wrote to memory of 636 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 1444 wrote to memory of 636 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 1444 wrote to memory of 636 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 2136 wrote to memory of 860 2136 cmd.exe cmd.exe PID 2136 wrote to memory of 860 2136 cmd.exe cmd.exe PID 1444 wrote to memory of 2456 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 1444 wrote to memory of 2456 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 1444 wrote to memory of 2456 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 860 wrote to memory of 1848 860 cmd.exe PING.EXE PID 860 wrote to memory of 1848 860 cmd.exe PING.EXE PID 1444 wrote to memory of 2776 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe vlc.exe PID 1444 wrote to memory of 2776 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe vlc.exe PID 2456 wrote to memory of 5064 2456 OneDrive.exe powershell.exe PID 2456 wrote to memory of 5064 2456 OneDrive.exe powershell.exe PID 2456 wrote to memory of 5064 2456 OneDrive.exe powershell.exe PID 2456 wrote to memory of 640 2456 OneDrive.exe cmd.exe PID 2456 wrote to memory of 640 2456 OneDrive.exe cmd.exe PID 2456 wrote to memory of 640 2456 OneDrive.exe cmd.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 2456 wrote to memory of 792 2456 OneDrive.exe RegAsm.exe PID 640 wrote to memory of 4920 640 cmd.exe schtasks.exe PID 640 wrote to memory of 4920 640 cmd.exe schtasks.exe PID 640 wrote to memory of 4920 640 cmd.exe schtasks.exe PID 1444 wrote to memory of 540 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Aurora.exe PID 1444 wrote to memory of 540 1444 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Aurora.exe PID 860 wrote to memory of 384 860 cmd.exe attrib.exe PID 860 wrote to memory of 384 860 cmd.exe attrib.exe PID 860 wrote to memory of 4092 860 cmd.exe icacls.exe PID 860 wrote to memory of 4092 860 cmd.exe icacls.exe PID 860 wrote to memory of 4348 860 cmd.exe cmd.exe PID 860 wrote to memory of 4348 860 cmd.exe cmd.exe PID 4348 wrote to memory of 3212 4348 cmd.exe Msedge.exe PID 4348 wrote to memory of 3212 4348 cmd.exe Msedge.exe PID 3792 wrote to memory of 760 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 760 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 2856 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 2856 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 4560 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 4560 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 1444 3792 cmd.exe powercfg.exe PID 3792 wrote to memory of 1444 3792 cmd.exe powercfg.exe PID 3168 wrote to memory of 2476 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 2476 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 3508 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 3508 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 1532 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 1532 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 3868 3168 cmd.exe powercfg.exe PID 3168 wrote to memory of 3868 3168 cmd.exe powercfg.exe PID 4668 wrote to memory of 1604 4668 svchost.exe conhost.exe PID 4668 wrote to memory of 916 4668 svchost.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe"C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\attrib.exeattrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"6⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)6⤵
- Modifies file permissions
-
C:\Windows\system32\cmd.execmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Msedge.exeC:\Users\Admin\AppData\Local\Msedge.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Aurora.exe"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5f7883e393e734ce43c91754960eeae66
SHA1b759d1634837b57e3f2a856a858f0fdde56b8ce2
SHA256c760078df238f8f05ca4dfe0f6300774cd946ee2d3bc656b90f6da04eff00b13
SHA51250d3419a63ff3e1d5760cb5679689ba2481bff9e0e6995c8b5659ab9d140c56accbc81364b8bcee61f5ef81cd88724b06345e99a44dabc41c67620357deacaf7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d95b08252ed624f6d91b46523f110f29
SHA117577997bc1fb5d3fbe59be84013165534415dc3
SHA256342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02
SHA5120c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257
-
C:\Users\Admin\AppData\Local\Temp\Aurora.exeFilesize
25.2MB
MD51504c863a05885816d2c8874137ae7a7
SHA15b16d440a7e9b5887886549f016f252900b5c0ac
SHA25633fc61e81efa609df51277aef261623bb291e2dd5359362d50070f7a441df0ad
SHA512055d2650ac996443130c05a742bcaabc576dbde29cc21ea956f66132f7e6da8a5771beb9cd51ff2384b2230ebe68990b35d8b14611613db2b8d2764846a487f9
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uqwptk1v.ywe.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exeFilesize
80KB
MD565f0a85c4b056d6bcee60c49e2372e35
SHA16af820a2030950617bf150777af4a43a06a17184
SHA256d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e
SHA5127a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exeFilesize
95KB
MD5c9a9d471428a5f92068c0823e6454254
SHA18b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2
SHA256b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5
SHA512ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exeFilesize
3.2MB
MD53b4f58cd4bca7274be25e885be00798b
SHA1eb57c281d8324a1079db97c9da43483a65debbed
SHA256a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80
SHA512dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exeFilesize
5.6MB
MD5b9fc8581b52abfc6b563da731438e27d
SHA143111fe9b307c850a379fe2d64d279e994680de3
SHA256e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058
SHA512c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5
-
memory/540-101-0x00007FF69A3A0000-0x00007FF69BC6F000-memory.dmpFilesize
24.8MB
-
memory/636-58-0x0000000004C00000-0x0000000004C3C000-memory.dmpFilesize
240KB
-
memory/636-59-0x0000000004C40000-0x0000000004C8C000-memory.dmpFilesize
304KB
-
memory/636-64-0x0000000004EB0000-0x0000000004FBA000-memory.dmpFilesize
1.0MB
-
memory/636-43-0x0000000000320000-0x000000000033E000-memory.dmpFilesize
120KB
-
memory/636-56-0x0000000004BA0000-0x0000000004BB2000-memory.dmpFilesize
72KB
-
memory/636-55-0x00000000052D0000-0x00000000058E8000-memory.dmpFilesize
6.1MB
-
memory/792-97-0x00000000061E0000-0x0000000006292000-memory.dmpFilesize
712KB
-
memory/792-60-0x0000000000400000-0x0000000000724000-memory.dmpFilesize
3.1MB
-
memory/792-96-0x0000000005FB0000-0x0000000006000000-memory.dmpFilesize
320KB
-
memory/792-68-0x00000000054F0000-0x00000000054FA000-memory.dmpFilesize
40KB
-
memory/792-65-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/916-173-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-175-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-181-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-163-0x0000024255690000-0x00000242556B0000-memory.dmpFilesize
128KB
-
memory/916-165-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-167-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-169-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-179-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-183-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-177-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/916-171-0x00007FF7ACBD0000-0x00007FF7AD3BF000-memory.dmpFilesize
7.9MB
-
memory/1444-6-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-7-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-90-0x00000000007E0000-0x00000000022AA000-memory.dmpFilesize
26.8MB
-
memory/1444-3-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-4-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-0-0x00000000007E0000-0x00000000022AA000-memory.dmpFilesize
26.8MB
-
memory/1444-1-0x00000000764F0000-0x00000000764F1000-memory.dmpFilesize
4KB
-
memory/1444-2-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-5-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-8-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-11-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1444-89-0x00000000764D0000-0x00000000765C0000-memory.dmpFilesize
960KB
-
memory/1604-164-0x00007FF675FA0000-0x00007FF675FC9000-memory.dmpFilesize
164KB
-
memory/1604-168-0x00007FF675FA0000-0x00007FF675FC9000-memory.dmpFilesize
164KB
-
memory/1968-127-0x00000272E4CA0000-0x00000272E4CC2000-memory.dmpFilesize
136KB
-
memory/2456-54-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/2456-42-0x00000000009C0000-0x0000000000CEE000-memory.dmpFilesize
3.2MB
-
memory/2776-143-0x00007FF63E0A0000-0x00007FF63E63A000-memory.dmpFilesize
5.6MB
-
memory/2776-138-0x00007FF63E0A0000-0x00007FF63E63A000-memory.dmpFilesize
5.6MB
-
memory/4668-162-0x00007FF6D46A0000-0x00007FF6D4C3A000-memory.dmpFilesize
5.6MB
-
memory/4668-145-0x00007FF6D46A0000-0x00007FF6D4C3A000-memory.dmpFilesize
5.6MB
-
memory/5064-72-0x0000000005C90000-0x0000000005CB2000-memory.dmpFilesize
136KB
-
memory/5064-124-0x0000000007AC0000-0x0000000007AE2000-memory.dmpFilesize
136KB
-
memory/5064-123-0x0000000007A80000-0x0000000007A88000-memory.dmpFilesize
32KB
-
memory/5064-122-0x0000000007AA0000-0x0000000007ABA000-memory.dmpFilesize
104KB
-
memory/5064-121-0x00000000079A0000-0x00000000079B4000-memory.dmpFilesize
80KB
-
memory/5064-120-0x0000000007990000-0x000000000799E000-memory.dmpFilesize
56KB
-
memory/5064-119-0x0000000007960000-0x0000000007971000-memory.dmpFilesize
68KB
-
memory/5064-118-0x00000000079E0000-0x0000000007A76000-memory.dmpFilesize
600KB
-
memory/5064-117-0x00000000077D0000-0x00000000077DA000-memory.dmpFilesize
40KB
-
memory/5064-115-0x0000000007DA0000-0x000000000841A000-memory.dmpFilesize
6.5MB
-
memory/5064-116-0x0000000007760000-0x000000000777A000-memory.dmpFilesize
104KB
-
memory/5064-114-0x0000000007630000-0x00000000076D3000-memory.dmpFilesize
652KB
-
memory/5064-113-0x0000000006970000-0x000000000698E000-memory.dmpFilesize
120KB
-
memory/5064-103-0x000000006E540000-0x000000006E58C000-memory.dmpFilesize
304KB
-
memory/5064-102-0x0000000006990000-0x00000000069C2000-memory.dmpFilesize
200KB
-
memory/5064-94-0x0000000006420000-0x000000000643E000-memory.dmpFilesize
120KB
-
memory/5064-80-0x0000000005E10000-0x0000000006164000-memory.dmpFilesize
3.3MB
-
memory/5064-73-0x0000000005D30000-0x0000000005D96000-memory.dmpFilesize
408KB
-
memory/5064-74-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/5064-63-0x00000000054E0000-0x0000000005B08000-memory.dmpFilesize
6.2MB
-
memory/5064-62-0x0000000004E70000-0x0000000004EA6000-memory.dmpFilesize
216KB