Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 15:54
Static task
static1
Behavioral task
behavioral1
Sample
eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe
-
Size
4.7MB
-
MD5
eb6db30e23d77e2740d98a5c23fe0920
-
SHA1
e61ecab00d442eced5be53a52f4ee04df54747f8
-
SHA256
9453ddc4bebb87a937e3d53d38c56814907b2862496142ccdb568f48caf2d467
-
SHA512
62861609f90b6407ac1ed6ce53fbb7434f79edc45caaaf84ef4541f882be910f41443e8b0c27c73383422b88539dd5f3daf1ef72229c0e51c456cabfe12eda6a
-
SSDEEP
98304:x5CvLUBsgMTSv4Rk02/43SBeiKQLDUep6lOtIO0lErExB:xyLUCg5v8TQLoe4lJlAa
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
smokeloader
pub5
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
nullmixer
http://hsiens.xyz/
Extracted
redline
pub1
viacetequn.site:80
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3472-137-0x0000000004A70000-0x0000000004A92000-memory.dmp family_redline behavioral2/memory/3472-142-0x0000000004DF0000-0x0000000004E10000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3472-137-0x0000000004A70000-0x0000000004A92000-memory.dmp family_sectoprat behavioral2/memory/3472-142-0x0000000004DF0000-0x0000000004E10000-memory.dmp family_sectoprat behavioral2/memory/3472-146-0x0000000007450000-0x0000000007460000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1832-113-0x0000000004020000-0x00000000040BD000-memory.dmp family_vidar behavioral2/memory/1832-119-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar behavioral2/memory/1832-194-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libcurl.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exeMon17a35023a4a8d2ff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation Mon17a35023a4a8d2ff.exe -
Executes dropped EXE 13 IoCs
Processes:
setup_install.exeMon17cbfd883d5a8a.exeMon1744d285d4eb2.exeMon17e148a02852c6.exeMon17781a4e1e94.exeMon17a35023a4a8d2ff.exeMon17fb229dc81.exeMon1730dd0b9f5ce9.exeMon1767c691152687e.exeMon179f5456be4f94.exeMon17a35023a4a8d2ff.exePrendero.exe.comPrendero.exe.compid process 520 setup_install.exe 1640 Mon17cbfd883d5a8a.exe 3472 Mon1744d285d4eb2.exe 1832 Mon17e148a02852c6.exe 4640 Mon17781a4e1e94.exe 4948 Mon17a35023a4a8d2ff.exe 4084 Mon17fb229dc81.exe 488 Mon1730dd0b9f5ce9.exe 384 Mon1767c691152687e.exe 4296 Mon179f5456be4f94.exe 4108 Mon17a35023a4a8d2ff.exe 920 Prendero.exe.com 432 Prendero.exe.com -
Loads dropped DLL 6 IoCs
Processes:
setup_install.exepid process 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe 520 setup_install.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Mon179f5456be4f94.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Mon179f5456be4f94.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3520 520 WerFault.exe setup_install.exe 3444 1640 WerFault.exe Mon17cbfd883d5a8a.exe 404 1832 WerFault.exe Mon17e148a02852c6.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Mon17cbfd883d5a8a.exedwm.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17cbfd883d5a8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17cbfd883d5a8a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon17cbfd883d5a8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dwm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
dwm.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeMon17cbfd883d5a8a.exepid process 2224 powershell.exe 2224 powershell.exe 1640 Mon17cbfd883d5a8a.exe 1640 Mon17cbfd883d5a8a.exe 2224 powershell.exe 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Mon17cbfd883d5a8a.exepid process 1640 Mon17cbfd883d5a8a.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
Mon1767c691152687e.exepowershell.exeMon1730dd0b9f5ce9.exeMon1744d285d4eb2.exedwm.exedescription pid process Token: SeDebugPrivilege 384 Mon1767c691152687e.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 488 Mon1730dd0b9f5ce9.exe Token: SeDebugPrivilege 3472 Mon1744d285d4eb2.exe Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeCreateGlobalPrivilege 3464 dwm.exe Token: SeChangeNotifyPrivilege 3464 dwm.exe Token: 33 3464 dwm.exe Token: SeIncBasePriorityPrivilege 3464 dwm.exe Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3464 dwm.exe Token: SeCreatePagefilePrivilege 3464 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Prendero.exe.comPrendero.exe.compid process 920 Prendero.exe.com 3540 3540 920 Prendero.exe.com 920 Prendero.exe.com 3540 3540 432 Prendero.exe.com 3540 3540 432 Prendero.exe.com 432 Prendero.exe.com 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 -
Suspicious use of SendNotifyMessage 23 IoCs
Processes:
Prendero.exe.comPrendero.exe.compid process 920 Prendero.exe.com 920 Prendero.exe.com 920 Prendero.exe.com 432 Prendero.exe.com 432 Prendero.exe.com 432 Prendero.exe.com 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeMon179f5456be4f94.exedescription pid process target process PID 2248 wrote to memory of 520 2248 eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe setup_install.exe PID 2248 wrote to memory of 520 2248 eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe setup_install.exe PID 2248 wrote to memory of 520 2248 eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe setup_install.exe PID 520 wrote to memory of 4076 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4076 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4076 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1812 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1812 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1812 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2828 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2828 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2828 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4772 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4772 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4772 520 setup_install.exe cmd.exe PID 520 wrote to memory of 3976 520 setup_install.exe cmd.exe PID 520 wrote to memory of 3976 520 setup_install.exe cmd.exe PID 520 wrote to memory of 3976 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2244 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2244 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2244 520 setup_install.exe cmd.exe PID 520 wrote to memory of 468 520 setup_install.exe cmd.exe PID 520 wrote to memory of 468 520 setup_install.exe cmd.exe PID 520 wrote to memory of 468 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1408 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1408 520 setup_install.exe cmd.exe PID 520 wrote to memory of 1408 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4628 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4628 520 setup_install.exe cmd.exe PID 520 wrote to memory of 4628 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2196 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2196 520 setup_install.exe cmd.exe PID 520 wrote to memory of 2196 520 setup_install.exe cmd.exe PID 2828 wrote to memory of 1640 2828 cmd.exe Mon17cbfd883d5a8a.exe PID 2828 wrote to memory of 1640 2828 cmd.exe Mon17cbfd883d5a8a.exe PID 2828 wrote to memory of 1640 2828 cmd.exe Mon17cbfd883d5a8a.exe PID 2244 wrote to memory of 3472 2244 cmd.exe Mon1744d285d4eb2.exe PID 2244 wrote to memory of 3472 2244 cmd.exe Mon1744d285d4eb2.exe PID 2244 wrote to memory of 3472 2244 cmd.exe Mon1744d285d4eb2.exe PID 4076 wrote to memory of 2224 4076 cmd.exe powershell.exe PID 4076 wrote to memory of 2224 4076 cmd.exe powershell.exe PID 4076 wrote to memory of 2224 4076 cmd.exe powershell.exe PID 3976 wrote to memory of 1832 3976 cmd.exe Mon17e148a02852c6.exe PID 3976 wrote to memory of 1832 3976 cmd.exe Mon17e148a02852c6.exe PID 3976 wrote to memory of 1832 3976 cmd.exe Mon17e148a02852c6.exe PID 4772 wrote to memory of 4640 4772 cmd.exe Mon17781a4e1e94.exe PID 4772 wrote to memory of 4640 4772 cmd.exe Mon17781a4e1e94.exe PID 1812 wrote to memory of 4948 1812 cmd.exe Mon17a35023a4a8d2ff.exe PID 1812 wrote to memory of 4948 1812 cmd.exe Mon17a35023a4a8d2ff.exe PID 1812 wrote to memory of 4948 1812 cmd.exe Mon17a35023a4a8d2ff.exe PID 468 wrote to memory of 4084 468 cmd.exe Mon17fb229dc81.exe PID 468 wrote to memory of 4084 468 cmd.exe Mon17fb229dc81.exe PID 468 wrote to memory of 4084 468 cmd.exe Mon17fb229dc81.exe PID 1408 wrote to memory of 488 1408 cmd.exe Mon1730dd0b9f5ce9.exe PID 1408 wrote to memory of 488 1408 cmd.exe Mon1730dd0b9f5ce9.exe PID 4628 wrote to memory of 4296 4628 cmd.exe Mon179f5456be4f94.exe PID 4628 wrote to memory of 4296 4628 cmd.exe Mon179f5456be4f94.exe PID 4628 wrote to memory of 4296 4628 cmd.exe Mon179f5456be4f94.exe PID 2196 wrote to memory of 384 2196 cmd.exe Mon1767c691152687e.exe PID 2196 wrote to memory of 384 2196 cmd.exe Mon1767c691152687e.exe PID 4296 wrote to memory of 2732 4296 Mon179f5456be4f94.exe dllhost.exe PID 4296 wrote to memory of 2732 4296 Mon179f5456be4f94.exe dllhost.exe PID 4296 wrote to memory of 2732 4296 Mon179f5456be4f94.exe dllhost.exe PID 4296 wrote to memory of 2528 4296 Mon179f5456be4f94.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17a35023a4a8d2ff.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17a35023a4a8d2ff.exeMon17a35023a4a8d2ff.exe4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17a35023a4a8d2ff.exe"C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17a35023a4a8d2ff.exe" -a5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17cbfd883d5a8a.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17cbfd883d5a8a.exeMon17cbfd883d5a8a.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 3765⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17781a4e1e94.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17781a4e1e94.exeMon17781a4e1e94.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17e148a02852c6.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17e148a02852c6.exeMon17e148a02852c6.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 10605⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1744d285d4eb2.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1744d285d4eb2.exeMon1744d285d4eb2.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon17fb229dc81.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17fb229dc81.exeMon17fb229dc81.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1730dd0b9f5ce9.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1730dd0b9f5ce9.exeMon1730dd0b9f5ce9.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon179f5456be4f94.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon179f5456be4f94.exeMon179f5456be4f94.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Mummia.wmz5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comPrendero.exe.com z7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\PING.EXEping LQHDAPZK -n 307⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1767c691152687e.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1767c691152687e.exeMon1767c691152687e.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 5763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 520 -ip 5201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1640 -ip 16401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1832 -ip 18321⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1730dd0b9f5ce9.exeFilesize
156KB
MD5cda12ae37191467d0a7d151664ed74aa
SHA12625b2e142c848092aa4a51584143ab7ed7d33d2
SHA2561e07bb767e9979d4afa4f8d69b68e33dd7c1a43f6863096a2b091047a10cdc2e
SHA51277c4429e22754e50828d9ec344cd63780acd31c350ef16ef69e2a396114df10e7c43d791440faee90e7f80be73e845ab579fd7b38efbd12f5de11bbc906f1c1d
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1744d285d4eb2.exeFilesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon1767c691152687e.exeFilesize
8KB
MD54ffcfe89a6f218943793ff6ea9bb5e79
SHA18ff66c6fe276857ba0ce6f533d383813e5ce6943
SHA256710c8df4e791a0f4ac8a7351c0c718a6ddb685a3d57abfd2c064c398617bb9b1
SHA5128c62a4e43657a7477acc630708205db74ecad794569408b7b0a57ee1ff111f798917b48c929133e8c199312ad797929a61fc69505a636347307edcd2eef2a5cb
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17781a4e1e94.exeFilesize
900KB
MD50a0d22f1c9179a67d04166de0db02dbb
SHA1106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA256a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
SHA5128abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon179f5456be4f94.exeFilesize
1.3MB
MD512b8842dded9134ad0cae031c4f06530
SHA1c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e
SHA256abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17
SHA512967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17a35023a4a8d2ff.exeFilesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17cbfd883d5a8a.exeFilesize
273KB
MD560530a7ed63de9bc252df9546aeda39a
SHA1c68ff97648a93e459f15fadfdfaf093cc1ed294b
SHA25659ca361ccf2ee773aa2dd151963e49af88bd8ddf099fc232a7ec7fa6f6540856
SHA5125f5c208620f56cc881250fa53596248d0ab93ac83aba2897dacbfe1a79d27025b47812ccfd00dcb9375b0b1d6ec9d08af8073ef44cd3a192f7d5ded3f00a30f7
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17e148a02852c6.exeFilesize
608KB
MD542b6c78fd88e0ce139615ca4a975bfc7
SHA15ec215ade32285be9a6b3e73031a9e351a5e4fdb
SHA25673da47aba40b72752b6562114348f823e70e33ef2a2eb5cb16c914e6feffe0d0
SHA512a7368df6e22f42c1ab60599ab4ecf2eba1fac8def2a8c411491173c881bbfafd014eb11a97067da6fbd3ded2c0daa3ae0574d259d8e13f210ecf40f16e06e6f3
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\Mon17fb229dc81.exeFilesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS8C80B437\setup_install.exeFilesize
2.1MB
MD52945026d856556ca26f59bd75436ffe2
SHA1abb4d221c598052f61a95d58568384b26ca17e85
SHA2561cb7a3045fc3293310ac92e39992457c32d97cb6328f556aca9c87f7eb2be860
SHA512c597ed98cb823f6616460f8d7f36df5106d9467f17fbbd64e8f8688b190e8aaadd3ef5d055bf75be7b2ff793e2e096a7ceda516f8416dc54dd0c855843c2e314
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Copia.wmzFilesize
4.3MB
MD5a1ac3489d2401d26e3aea9bcb0a85b10
SHA16a4c4004ef746ed16d25c3fe425a6c78fcefe9b4
SHA2561cb9452373f7b755b1c64b41bd7ffcfe4fe0ab92fd08c61c283c5deccfd89146
SHA512293a84faadb89219945fde5836786cbcf4bdcaf36638603a5e95e80df4f5daf0b180d1f768deecee77b828ef736a337925479c37ae1e1f7126934f80be7b5e2e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mummia.wmzFilesize
576B
MD56f6fe96279c933c2170e75f49cf43718
SHA1bbe211eaebbeb120b9ca3cd204aacbbeef20cb7e
SHA256e6919da4e2658c82ebbcca670053d77e1231a5a600bf5aeaba71e5852e09022f
SHA51276160b79d3cbe2fca6d95b096043641a96b13007f287f8e55b94eab16cbb98691a8e8fa8d035da434e84f689bb8d36478f632976481b56c7170889553a629748
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pensavo.wmzFilesize
872KB
MD53928f9cc043cfb53823761dac703fd04
SHA1c825e75ae21b995996763487de07176230c2535e
SHA256c2d4ebb0b7be8eb8683cc1fdcd0b95c834888c56d555e6d23497ae211835f412
SHA5128739619195c9d1409819822ae3c53415ac57a1c485b6947022d81981c9a0c7811ea5a30af0ef32e0a34aacf589f74366866dc1e7e03cd4addf56b71b6b25d9c5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qlqdpxvk.b2b.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/384-199-0x000000001B4A0000-0x000000001B4B0000-memory.dmpFilesize
64KB
-
memory/384-120-0x000000001B4A0000-0x000000001B4B0000-memory.dmpFilesize
64KB
-
memory/384-99-0x00007FF8C1DA0000-0x00007FF8C2861000-memory.dmpFilesize
10.8MB
-
memory/384-90-0x00000000007A0000-0x00000000007A8000-memory.dmpFilesize
32KB
-
memory/488-101-0x0000000002080000-0x00000000020A2000-memory.dmpFilesize
136KB
-
memory/488-139-0x00007FF8C1DA0000-0x00007FF8C2861000-memory.dmpFilesize
10.8MB
-
memory/488-114-0x000000001AF80000-0x000000001AF90000-memory.dmpFilesize
64KB
-
memory/488-92-0x00007FF8C1DA0000-0x00007FF8C2861000-memory.dmpFilesize
10.8MB
-
memory/488-91-0x0000000000100000-0x000000000012C000-memory.dmpFilesize
176KB
-
memory/520-50-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-56-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-58-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-59-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-57-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-61-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-54-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-123-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/520-62-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/520-55-0x00000000007A0000-0x000000000082F000-memory.dmpFilesize
572KB
-
memory/520-128-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/520-60-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/520-63-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/520-127-0x000000006EB40000-0x000000006EB63000-memory.dmpFilesize
140KB
-
memory/520-52-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-126-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/520-121-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/520-125-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/520-51-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1640-122-0x0000000002640000-0x0000000002740000-memory.dmpFilesize
1024KB
-
memory/1640-108-0x0000000000400000-0x00000000023AE000-memory.dmpFilesize
31.7MB
-
memory/1640-190-0x0000000000400000-0x00000000023AE000-memory.dmpFilesize
31.7MB
-
memory/1640-100-0x00000000024C0000-0x00000000024C9000-memory.dmpFilesize
36KB
-
memory/1832-194-0x0000000000400000-0x0000000002402000-memory.dmpFilesize
32.0MB
-
memory/1832-124-0x00000000024E0000-0x00000000025E0000-memory.dmpFilesize
1024KB
-
memory/1832-119-0x0000000000400000-0x0000000002402000-memory.dmpFilesize
32.0MB
-
memory/1832-113-0x0000000004020000-0x00000000040BD000-memory.dmpFilesize
628KB
-
memory/2224-184-0x0000000007DC0000-0x0000000007E56000-memory.dmpFilesize
600KB
-
memory/2224-191-0x0000000007D80000-0x0000000007D8E000-memory.dmpFilesize
56KB
-
memory/2224-130-0x0000000006880000-0x00000000068CC000-memory.dmpFilesize
304KB
-
memory/2224-107-0x0000000005A70000-0x0000000005A92000-memory.dmpFilesize
136KB
-
memory/2224-89-0x00000000033D0000-0x00000000033E0000-memory.dmpFilesize
64KB
-
memory/2224-79-0x0000000002EA0000-0x0000000002ED6000-memory.dmpFilesize
216KB
-
memory/2224-198-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/2224-118-0x00000000063B0000-0x0000000006704000-memory.dmpFilesize
3.3MB
-
memory/2224-195-0x0000000007E70000-0x0000000007E78000-memory.dmpFilesize
32KB
-
memory/2224-193-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/2224-88-0x0000000005AE0000-0x0000000006108000-memory.dmpFilesize
6.2MB
-
memory/2224-192-0x0000000007D90000-0x0000000007DA4000-memory.dmpFilesize
80KB
-
memory/2224-129-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/2224-116-0x0000000006340000-0x00000000063A6000-memory.dmpFilesize
408KB
-
memory/2224-189-0x0000000007D50000-0x0000000007D61000-memory.dmpFilesize
68KB
-
memory/2224-115-0x00000000062C0000-0x0000000006326000-memory.dmpFilesize
408KB
-
memory/2224-183-0x0000000007BD0000-0x0000000007BDA000-memory.dmpFilesize
40KB
-
memory/2224-179-0x0000000007B50000-0x0000000007B6A000-memory.dmpFilesize
104KB
-
memory/2224-178-0x0000000008190000-0x000000000880A000-memory.dmpFilesize
6.5MB
-
memory/2224-153-0x0000000006DE0000-0x0000000006E12000-memory.dmpFilesize
200KB
-
memory/2224-154-0x0000000075420000-0x000000007546C000-memory.dmpFilesize
304KB
-
memory/2224-165-0x0000000006DC0000-0x0000000006DDE000-memory.dmpFilesize
120KB
-
memory/2224-83-0x00000000033D0000-0x00000000033E0000-memory.dmpFilesize
64KB
-
memory/2224-81-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/2224-169-0x00000000079E0000-0x0000000007A83000-memory.dmpFilesize
652KB
-
memory/3472-141-0x0000000000400000-0x0000000002CCD000-memory.dmpFilesize
40.8MB
-
memory/3472-206-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-146-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-149-0x0000000073D30000-0x00000000744E0000-memory.dmpFilesize
7.7MB
-
memory/3472-144-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-148-0x0000000007300000-0x000000000733C000-memory.dmpFilesize
240KB
-
memory/3472-145-0x0000000007A10000-0x0000000008028000-memory.dmpFilesize
6.1MB
-
memory/3472-170-0x00000000080D0000-0x00000000081DA000-memory.dmpFilesize
1.0MB
-
memory/3472-204-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-152-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-147-0x00000000072E0000-0x00000000072F2000-memory.dmpFilesize
72KB
-
memory/3472-140-0x0000000007460000-0x0000000007A04000-memory.dmpFilesize
5.6MB
-
memory/3472-142-0x0000000004DF0000-0x0000000004E10000-memory.dmpFilesize
128KB
-
memory/3472-137-0x0000000004A70000-0x0000000004A92000-memory.dmpFilesize
136KB
-
memory/3472-136-0x0000000002DF0000-0x0000000002E1F000-memory.dmpFilesize
188KB
-
memory/3472-135-0x0000000002E20000-0x0000000002F20000-memory.dmpFilesize
1024KB
-
memory/3472-203-0x0000000002E20000-0x0000000002F20000-memory.dmpFilesize
1024KB
-
memory/3472-143-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3472-205-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/3540-177-0x00000000032D0000-0x00000000032E6000-memory.dmpFilesize
88KB