Automated Malware Analysis IOC Report for

Details

Name:	00000006.00000002.2204900441.00000000001F0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1F0000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	00000006.00000002.2204979251.0000000000400000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	400000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	00000005.00000002.2169563317.0000000000220000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	220000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	0000000A.00000002.2380114742.00000000000B0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B0000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	00000006.00000002.2204962869.00000000003C0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	3C0000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	0000000A.00000002.2380245950.0000000000210000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	210000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	00000006.00000001.2167976340.0000000000400000.00000040.00020000.sdmp
TargetID:	6
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page execute and read and write
Base address:	400000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	0000000A.00000002.2380085574.0000000000080000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	80000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary,
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary,

Details

Name:	00000005.00000002.2169537811.00000000001A0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1A0000
Size:	4096

Details

Name:	00000005.00000003.2167150790.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000006.00000003.2169627641.0000000000BA0000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	BA0000
Size:	20480

Details

Name:	00000005.00000002.2173078234.0000000003162000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3162000
Size:	73728

Details

Name:	00000008.00000000.2196540443.000000000CDA3000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CDA3000
Size:	237568

Details

Name:	00000008.00000000.2196394677.000000000C6E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C6E0000
Size:	262144

Details

Name:	00000008.00000000.2185447530.00000000046B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	46B0000
Size:	4096

Details

Name:	00000008.00000000.2171796540.0000000000060000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	60000
Size:	421888

Details

Name:	00000008.00000000.2183685094.0000000004253000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4253000
Size:	53248

Details

Name:	00000006.00000002.2205292683.0000000000E50000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	E50000
Size:	368640

Details

Name:	00000006.00000003.2169459854.0000000000A40000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	A40000
Size:	876544

Details

Name:	00000008.00000000.2177019580.0000000002CE0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2CE0000
Size:	4096

Details

Name:	00000005.00000002.2171218721.0000000002B50000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B50000
Size:	3670016

Details

Name:	00000005.00000002.2173450212.00000000033C2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	33C2000
Size:	249856

Details

Name:	00000008.00000000.2176510640.00000000026B0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	26B0000
Size:	8192

Details

Name:	00000008.00000000.2171908084.00000000000F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	F0000
Size:	8192

Details

Name:	00000008.00000000.2172476527.00000000006F0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6F0000
Size:	380928

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion,	Process Injection Process Discovery

Details

Name:	00000006.00000002.2205009128.0000000000A10000.00000004.00000040.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	A10000
Size:	8192

Details

Name:	00000005.00000002.2170186106.0000000000E90000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	E90000
Size:	16384

Details

Name:	00000008.00000000.2196216680.000000000BEA0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	BEA0000
Size:	8192

Details

Name:	00000008.00000000.2186198117.0000000005A1E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	5A1E000
Size:	8192

Details

Name:	00000004.00000000.2160848682.000000000042D000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	42D000
Size:	180224

Details

Name:	00000005.00000002.2173269319.0000000003255000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3255000
Size:	1486848

Details

Name:	00000008.00000000.2196228915.000000000BEC3000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	BEC3000
Size:	24576

Details

Name:	00000005.00000003.2165378184.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000005.00000003.2165254081.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000006.00000002.2204892951.0000000000170000.00000004.00000020.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	170000
Size:	65536

Details

Name:	00000005.00000003.2163154468.00000000001F0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1F0000
Size:	40960

Details

Name:	00000008.00000000.2175438217.0000000002533000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2533000
Size:	36864

Details

Name:	00000004.00000002.2182138412.0000000002826000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2826000
Size:	45056

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion,	Process Injection Process Discovery

Details

Name:	00000008.00000000.2177320454.0000000002EF5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF5000
Size:	8192

Details

Name:	0000000A.00000003.2205890547.00000000006A0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	6A0000
Size:	4096

Details

Name:	00000008.00000000.2185417587.0000000004510000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	4510000
Size:	4096

Details

Name:	00000008.00000000.2175591019.0000000002587000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2587000
Size:	4096

Details

Name:	00000007.00000002.2380186091.00000000003B7000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3B7000
Size:	4096

Details

Name:	00000008.00000002.2382719858.0000000002EE0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2EE0000
Size:	16384

Details

Name:	00000008.00000000.2176691646.0000000002A80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2A80000
Size:	49152

Details

Name:	00000008.00000000.2190942946.00000000082D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	82D0000
Size:	4096

Details

Name:	00000008.00000000.2196387704.000000000C6DA000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C6DA000
Size:	24576

Details

Name:	00000008.00000002.2380427712.00000000003D0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3D0000
Size:	24576

Details

Name:	00000008.00000000.2196467629.000000000C9E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C9E0000
Size:	262144

Details

Name:	00000005.00000003.2168699249.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000008.00000000.2196239319.000000000BF20000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	BF20000
Size:	4096

Details

Name:	00000008.00000000.2176996350.0000000002CA0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2CA0000
Size:	4096

Details

Name:	00000005.00000000.2162676432.0000000000C99000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	C99000
Size:	90112

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2191369780.000000000856E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	856E000
Size:	319488

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000002.2382093892.0000000002CE0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CE0000
Size:	4096

Details

Name:	00000008.00000000.2193016896.000000000968E000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	968E000
Size:	413696

Details

Name:	00000005.00000003.2166177808.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000002.2381997323.0000000002BC0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page write copy
Base address:	2BC0000
Size:	20480

Details

Name:	00000005.00000002.2170091551.0000000000C60000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	C60000
Size:	151552

Details

Name:	00000004.00000002.2178321105.0000000000287000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	287000
Size:	4096

Details

Name:	00000005.00000003.2165305337.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000005.00000002.2170136615.0000000000C90000.00000004.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	C90000
Size:	36864

Details

Name:	00000008.00000002.2382381999.0000000002E80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E80000
Size:	4096

Details

Name:	00000008.00000002.2380407466.000000000030B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	30B000
Size:	4096

Details

Name:	00000008.00000002.2381825894.0000000002950000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	2950000
Size:	4096

Details

Name:	00000005.00000002.2169608026.0000000000690000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	690000
Size:	4096

Details

Name:	00000008.00000000.2181733387.0000000003B90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3B90000
Size:	28672

Details

Name:	00000008.00000000.2177333814.0000000002EFE000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	2EFE000
Size:	192512

Details

Name:	00000005.00000003.2169152372.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000005.00000002.2169611428.0000000000740000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	740000
Size:	4096

Details

Name:	00000006.00000002.2204928153.0000000000280000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	280000
Size:	49152

Details

Name:	00000008.00000000.2176780827.0000000002AF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2AF0000
Size:	8192

Details

Name:	00000008.00000002.2380092892.0000000000020000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	20000
Size:	8192

Details

Name:	00000008.00000000.2191534550.0000000008662000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8662000
Size:	8192

Details

Name:	00000005.00000003.2165812365.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000005.00000003.2165596192.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000005.00000002.2169545796.00000000001C2000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1C2000
Size:	16384

Details

Name:	00000005.00000003.2169315981.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000008.00000002.2380241982.00000000001E9000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1E9000
Size:	12288

Details

Name:	00000006.00000002.2204947224.00000000002C4000.00000004.00000020.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2C4000
Size:	81920

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary,

Details

Name:	00000004.00000000.2160820747.0000000000401000.00000020.00020000.sdmp
TargetID:	4
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	28672

Details

Name:	00000006.00000002.2204942888.00000000002A7000.00000004.00000020.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2A7000
Size:	4096

Details

Name:	0000000A.00000002.2380775172.0000000000AA0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AA0000
Size:	4096

Details

Name:	00000006.00000003.2169566456.0000000000B31000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	B31000
Size:	4096

Details

Name:	00000008.00000002.2381771901.0000000002830000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2830000
Size:	12288

Details

Name:	00000008.00000000.2181255587.00000000035C6000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35C6000
Size:	45056

Details

Name:	00000008.00000000.2181236014.0000000003596000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3596000
Size:	45056

Details

Name:	00000008.00000000.2172059515.00000000001DD000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1DD000
Size:	12288

Details

Name:	00000005.00000003.2166241081.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000008.00000000.2181172027.0000000003512000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3512000
Size:	4096

Details

Name:	00000005.00000000.2162625857.0000000000C60000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	C60000
Size:	151552

Details

Name:	00000008.00000000.2177846581.0000000002F70000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2F70000
Size:	12288

Details

Name:	00000008.00000000.2195606295.0000000009BCF000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	9BCF000
Size:	90112

Details

Name:	00000006.00000003.2169570044.0000000000B34000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	B34000
Size:	4096

Details

Name:	00000008.00000000.2176985026.0000000002C80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2C80000
Size:	4096

Details

Name:	00000005.00000003.2166848700.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000005.00000002.2172926255.0000000003102000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3102000
Size:	73728

Details

Name:	00000008.00000000.2186698135.0000000005E4A000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	5E4A000
Size:	4694016

Details

Name:	00000008.00000002.2380540518.0000000001BDF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BDF000
Size:	4096

Details

Name:	00000007.00000002.2380205200.00000000003F8000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3F8000
Size:	4096

Details

Name:	00000008.00000002.2380374471.00000000002C2000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2C2000
Size:	57344

Details

Name:	00000008.00000002.2380529617.0000000001BCF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BCF000
Size:	4096

Details

Name:	00000004.00000002.2181033509.000000000040A000.00000004.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	40A000
Size:	57344

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000004.00000002.2182149454.0000000002834000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2834000
Size:	516096

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2175489079.0000000002550000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2550000
Size:	36864

Details

Name:	0000000A.00000002.2380622848.0000000000930000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	930000
Size:	12288

Details

Name:	00000008.00000000.2196431307.000000000C7E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C7E0000
Size:	4096

Details

Name:	00000008.00000000.2177156119.0000000002EA0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2EA0000
Size:	4096

Details

Name:	00000008.00000002.2382068329.0000000002CA0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CA0000
Size:	4096

Details

Name:	00000008.00000000.2181297720.0000000003612000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3612000
Size:	24576

Details

Name:	00000008.00000000.2176738607.0000000002AC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2AC0000
Size:	167936

Details

Name:	00000008.00000000.2196609852.000000000CE66000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CE66000
Size:	217088

Details

Name:	00000008.00000000.2190038535.0000000006F94000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	6F94000
Size:	4096

Details

Name:	00000008.00000000.2196209827.000000000BCF0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	BCF0000
Size:	4096

Details

Name:	00000005.00000002.2173056252.0000000003156000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3156000
Size:	45056

Details

Name:	00000008.00000000.2189988481.0000000006F77000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	6F77000
Size:	36864

Details

Name:	0000000A.00000002.2380363900.00000000005D6000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5D6000
Size:	28672

Details

Name:	00000006.00000000.2164189173.00000000004C0000.00000008.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	4C0000
Size:	8192

Details

Name:	00000008.00000002.2381847720.0000000002A20000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2A20000
Size:	196608

Details

Name:	00000008.00000000.2177008707.0000000002CC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2CC0000
Size:	4096

Details

Name:	00000008.00000000.2188719531.00000000068AE000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	68AE000
Size:	413696

Details

Name:	0000000A.00000002.2380308531.000000000047E000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	47E000
Size:	8192

Details

Name:	00000008.00000000.2181159672.00000000034F4000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	34F4000
Size:	118784

Details

Name:	00000005.00000003.2166933112.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000006.00000002.2205355265.0000000001150000.00000002.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1150000
Size:	12288

Details

Name:	0000000A.00000002.2380288886.000000000033E000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	33E000
Size:	8192

Details

Name:	00000005.00000002.2173238045.0000000003225000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3225000
Size:	49152

Details

Name:	00000008.00000000.2195988639.000000000B0B0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	B0B0000
Size:	4096

Details

Name:	00000004.00000002.2181022319.0000000000401000.00000020.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	28672

Details

Name:	00000008.00000000.2176730736.0000000002AB4000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2AB4000
Size:	16384

Details

Name:	00000008.00000002.2380198772.0000000000180000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page write copy
Base address:	180000
Size:	24576

Details

Name:	0000000A.00000002.2381014228.0000000000E3B000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	E3B000
Size:	86016

Details

Name:	0000000A.00000002.2380790488.0000000000AB7000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AB7000
Size:	4096

Details

Name:	00000005.00000003.2167052425.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000005.00000003.2166495316.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000005.00000003.2164987180.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000005.00000002.2169615220.0000000000780000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	780000
Size:	913408

Details

Name:	00000008.00000000.2196067554.000000000B2C3000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	B2C3000
Size:	12288

Details

Name:	00000005.00000002.2173117960.0000000003186000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3186000
Size:	45056

Details

Name:	00000005.00000002.2173178510.00000000031D2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31D2000
Size:	24576

Details

Name:	00000008.00000000.2185371588.0000000004440000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4440000
Size:	4096

Details

Name:	00000008.00000002.2381735894.00000000026C0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	26C0000
Size:	8192

Details

Name:	00000005.00000003.2164700313.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	00000008.00000000.2172797556.0000000001C13000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	1C13000
Size:	118784

Details

Name:	00000008.00000002.2382351793.0000000002E70000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E70000
Size:	4096

Details

Name:	00000008.00000002.2381577334.00000000024B0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page write copy
Base address:	24B0000
Size:	376832

Details

Name:	00000008.00000002.2382469914.0000000002EA0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2EA0000
Size:	4096

Details

Name:	00000005.00000003.2166863510.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000006.00000003.2169684680.0000000000020000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20000
Size:	40960

Details

Name:	00000005.00000003.2167975435.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000008.00000002.2380080313.0000000000010000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	10000
Size:	4096

Details

Name:	00000006.00000002.2205004722.00000000009DF000.00000004.00000010.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	9DF000
Size:	4096

Details

Name:	00000008.00000000.2195800031.000000000A3DA000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3DA000
Size:	16384

Details

Name:	00000008.00000000.2186133991.000000000579E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	579E000
Size:	8192

Details

Name:	0000000A.00000002.2380506945.000000000078D000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	78D000
Size:	4096

Details

Name:	00000004.00000002.2181107481.0000000001CD0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1CD0000
Size:	4112384

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2181210146.0000000003555000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3555000
Size:	4096

Details

Name:	00000008.00000002.2381723891.00000000026A0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	26A0000
Size:	8192

Details

Name:	00000008.00000002.2381991430.0000000002B80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2B80000
Size:	4096

Details

Name:	0000000A.00000002.2381647909.00000000046DF000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	46DF000
Size:	4096

Details

Name:	00000007.00000002.2380225572.0000000000770000.00000002.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	770000
Size:	2945024

Details

Name:	00000008.00000000.2177095244.0000000002E40000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E40000
Size:	4096

Details

Name:	00000008.00000000.2177029575.0000000002D20000.00000020.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page execute read
Base address:	2D20000
Size:	65536

Details

Name:	00000005.00000002.2169485268.0000000000100000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	100000
Size:	421888

Details

Name:	00000008.00000000.2181595290.00000000038B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	38B0000
Size:	4096

Details

Name:	00000005.00000002.2170219090.0000000000EB4000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	EB4000
Size:	712704

Details

Name:	00000008.00000000.2185437157.0000000004616000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4616000
Size:	40960

Details

Name:	00000008.00000000.2183329038.0000000004226000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4226000
Size:	40960

Details

Name:	00000005.00000002.2171171500.0000000002AF0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2AF0000
Size:	4096

Details

Name:	00000008.00000002.2382162655.0000000002E2E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E2E000
Size:	16384

Details

Name:	00000008.00000000.2195645892.000000000A330000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A330000
Size:	557056

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000002.2380556401.0000000001BF0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1BF0000
Size:	8192

Details

Name:	00000008.00000000.2176483578.0000000002690000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2690000
Size:	16384

Details

Name:	00000006.00000002.2205341846.0000000000FCF000.00000004.00000010.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	FCF000
Size:	4096

Details

Name:	00000008.00000000.2176583185.0000000002830000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2830000
Size:	12288

Details

Name:	00000008.00000000.2175155451.00000000024B0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	24B0000
Size:	376832

Details

Name:	00000008.00000000.2176708166.0000000002A90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2A90000
Size:	12288

Details

Name:	00000005.00000000.2162534450.0000000000BD0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	BD0000
Size:	4096

Details

Name:	00000005.00000002.2170116202.0000000000C86000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	C86000
Size:	40960

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion,	Process Injection Process Discovery

Details

Name:	00000008.00000002.2380186673.000000000016E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16E000
Size:	12288

Details

Name:	00000008.00000000.2191508182.0000000008644000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8644000
Size:	73728

Details

Name:	00000005.00000002.2169596095.000000000066C000.00000004.00000010.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	66C000
Size:	16384

Details

Name:	00000005.00000002.2169588359.000000000064F000.00000004.00000010.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	64F000
Size:	4096

Details

Name:	00000005.00000003.2165074899.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	0000000A.00000002.2380474341.0000000000763000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	763000
Size:	90112

Details

Name:	0000000A.00000002.2381005953.0000000000E2D000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	E2D000
Size:	45056

Details

Name:	00000005.00000003.2169120485.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000008.00000000.2186184274.000000000596F000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	596F000
Size:	8192

Details

Name:	0000000A.00000002.2381029149.0000000000EF2000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EF2000
Size:	4096

Details

Name:	0000000A.00000002.2380833128.0000000000B20000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B20000
Size:	20480

Details

Name:	00000005.00000003.2166842489.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000000.2181625613.00000000039F4000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	39F4000
Size:	770048

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	0000000A.00000002.2381233965.0000000002CE0000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2CE0000
Size:	12288

Details

Name:	00000008.00000000.2190719964.00000000078EE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	78EE000
Size:	8192

Details

Name:	00000007.00000002.2380179945.00000000003B0000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3B0000
Size:	16384

Details

Name:	00000008.00000000.2183457068.0000000004234000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4234000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Details

Name:	00000005.00000003.2167549207.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	0000000A.00000002.2380146738.000000000013C000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	13C000
Size:	16384

Details

Name:	00000008.00000000.2175624605.00000000025F2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	25F2000
Size:	172032

Details

Name:	00000006.00000000.2164137913.0000000000490000.00000002.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	490000
Size:	151552

Details

Name:	00000005.00000002.2173508115.0000000003420000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3420000
Size:	126976

Details

Name:	0000000A.00000002.2380373950.00000000006A0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6A0000
Size:	737280

Details

Name:	00000008.00000000.2171898466.00000000000E0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	E0000
Size:	28672

Details

Name:	00000008.00000000.2196352751.000000000C610000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C610000
Size:	4096

Details

Name:	00000008.00000002.2380220025.00000000001D0000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1D0000
Size:	20480

Details

Name:	00000005.00000002.2170207054.0000000000E97000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	E97000
Size:	4096

Details

Name:	00000008.00000002.2381339342.00000000021E0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	21E0000
Size:	2945024

Details

Name:	00000008.00000002.2382086428.0000000002CD0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page write copy
Base address:	2CD0000
Size:	20480

Details

Name:	00000005.00000003.2164332961.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000008.00000002.2381963855.0000000002B20000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B20000
Size:	8192

Details

Name:	00000005.00000003.2166167463.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000006.00000002.2205330273.0000000000EB0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	EB0000
Size:	20480

Details

Name:	00000008.00000000.2182703415.0000000004196000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4196000
Size:	4096

Details

Name:	00000005.00000003.2168515049.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000000.2195979326.000000000A53E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	A53E000
Size:	8192

Details

Name:	00000008.00000000.2181764296.0000000003BD7000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3BD7000
Size:	69632

Details

Name:	00000008.00000002.2381741997.00000000026D0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	26D0000
Size:	8192

Details

Name:	00000008.00000000.2181739063.0000000003B98000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3B98000
Size:	126976

Details

Name:	00000008.00000000.2182020707.0000000003E27000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3E27000
Size:	2043904

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2172037224.00000000001D7000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1D7000
Size:	20480

Details

Name:	00000008.00000000.2196009522.000000000B148000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	B148000
Size:	32768

Details

Name:	00000008.00000000.2190776519.0000000007B40000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	7B40000
Size:	53248

Details

Name:	00000008.00000000.2190134913.000000000710B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	710B000
Size:	20480

Details

Name:	00000008.00000000.2181348657.0000000003642000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3642000
Size:	24576

Details

Name:	00000008.00000002.2382080725.0000000002CC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CC0000
Size:	4096

Details

Name:	00000005.00000003.2163116801.00000000001F0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1F0000
Size:	40960

Details

Name:	00000008.00000000.2182306709.0000000004070000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4070000
Size:	8192

Details

Name:	00000008.00000002.2381253065.00000000020FF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20FF000
Size:	4096

Details

Name:	0000000A.00000003.2205080859.00000000004BD000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	4BD000
Size:	409600

Details

Name:	00000008.00000000.2181303224.0000000003619000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3619000
Size:	53248

Details

Name:	00000004.00000002.2178330255.00000000002A4000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2A4000
Size:	139264

Details

Name:	00000008.00000002.2382208868.0000000002E40000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E40000
Size:	4096

Details

Name:	00000008.00000000.2185401164.00000000044C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	44C0000
Size:	12288

Details

Name:	00000008.00000000.2186626398.0000000005DED000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	5DED000
Size:	376832

Details

Name:	00000008.00000002.2380577544.0000000001C70000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1C70000
Size:	4112384

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2186171566.00000000058B6000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	58B6000
Size:	40960

Details

Name:	00000008.00000000.2196057947.000000000B2A4000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	B2A4000
Size:	4096

Details

Name:	00000008.00000000.2185386410.0000000004470000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4470000
Size:	8192

Details

Name:	00000005.00000002.2169479648.00000000000FB000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	FB000
Size:	20480

Details

Name:	00000008.00000000.2185488845.000000000480A000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	480A000
Size:	4096

Details

Name:	00000008.00000000.2196224064.000000000BEA5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	BEA5000
Size:	4096

Details

Name:	00000007.00000002.2380611448.0000000000AEF000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	AEF000
Size:	4096

Details

Name:	00000008.00000000.2181401572.0000000003695000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3695000
Size:	1486848

Details

Name:	0000000A.00000002.2380357982.00000000005CC000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5CC000
Size:	8192

Details

Name:	00000008.00000000.2196020337.000000000B150000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	B150000
Size:	184320

Details

Name:	00000008.00000000.2190951821.00000000082DC000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	82DC000
Size:	32768

Details

Name:	0000000A.00000002.2380334949.000000000056F000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	56F000
Size:	4096

Details

Name:	00000005.00000001.2162761761.0000000000BD0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	BD0000
Size:	4096

Details

Name:	00000008.00000000.2176515897.00000000026C0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	26C0000
Size:	8192

Details

Name:	00000008.00000000.2185511562.0000000004B4E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4B4E000
Size:	8192

Details

Name:	00000008.00000000.2172004935.00000000001D0000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1D0000
Size:	20480

Details

Name:	00000005.00000002.2171179719.0000000002AF4000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2AF4000
Size:	4096

Details

Name:	00000008.00000000.2190659692.00000000076C0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	76C0000
Size:	8192

Details

Name:	00000006.00000002.2204855335.000000000008D000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	8D000
Size:	12288

Details

Name:	00000005.00000002.2170000406.0000000000BD0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	BD0000
Size:	4096

Details

Name:	00000008.00000000.2172238877.000000000025D000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	25D000
Size:	8192

Details

Name:	00000008.00000002.2380480936.0000000001AF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1AF0000
Size:	8192

Details

Name:	00000008.00000000.2177013081.0000000002CD0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	2CD0000
Size:	20480

Details

Name:	00000008.00000000.2185391429.00000000044B0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	44B0000
Size:	32768

Details

Name:	00000008.00000000.2190353732.0000000007490000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	7490000
Size:	786432

Details

Name:	0000000A.00000002.2380794997.0000000000AC0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AC0000
Size:	368640

Details

Name:	00000008.00000000.2173532194.00000000020FF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	20FF000
Size:	4096

Details

Name:	00000008.00000002.2382099385.0000000002CF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CF0000
Size:	4096

Details

Name:	00000006.00000002.2204959132.00000000003A0000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3A0000
Size:	4096

Details

Name:	00000008.00000000.2172573689.0000000001B40000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	1B40000
Size:	8192

Details

Name:	00000008.00000000.2192942592.0000000009668000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	9668000
Size:	4096

Details

Name:	00000008.00000000.2185502036.0000000004ABF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4ABF000
Size:	8192

Details

Name:	00000008.00000000.2181391857.0000000003679000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3679000
Size:	53248

Details

Name:	00000008.00000000.2172615067.0000000001B9A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1B9A000
Size:	40960

Details

Name:	00000008.00000000.2172245723.0000000000260000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	260000
Size:	368640

Details

Name:	00000005.00000002.2173902318.0000000003647000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3647000
Size:	2043904

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2182330678.0000000004130000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4130000
Size:	114688

Details

Name:	00000004.00000002.2181560551.00000000021C0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	21C0000
Size:	913408

Details

Name:	00000008.00000000.2190296306.00000000073EE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	73EE000
Size:	8192

Details

Name:	00000005.00000003.2166853011.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	0000000A.00000002.2380325982.000000000048D000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	48D000
Size:	4096

Details

Name:	00000004.00000002.2181675480.00000000022A0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	22A0000
Size:	2945024

Details

Name:	00000005.00000002.2173201961.00000000031F5000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31F5000
Size:	49152

Details

Name:	00000008.00000000.2186190215.000000000597A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	597A000
Size:	24576

Details

Name:	00000008.00000002.2380560344.0000000001BF5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1BF5000
Size:	4096

Details

Name:	00000008.00000000.2188820838.0000000006914000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6914000
Size:	471040

Details

Name:	00000005.00000003.2167750282.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000008.00000000.2190020563.0000000006F90000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	6F90000
Size:	4096

Details

Name:	00000008.00000000.2175560165.0000000002570000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2570000
Size:	8192

Details

Name:	00000004.00000002.2177698087.000000000008B000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	8B000
Size:	20480

Details

Name:	00000008.00000000.2181285735.00000000035FD000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35FD000
Size:	81920

Details

Name:	00000008.00000000.2176803849.0000000002B20000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2B20000
Size:	8192

Details

Name:	00000008.00000002.2382060587.0000000002C90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2C90000
Size:	4096

Details

Name:	00000008.00000000.2177123932.0000000002E70000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E70000
Size:	4096

Details

Name:	00000006.00000003.2168546498.00000000009BA000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	9BA000
Size:	4096

Details

Name:	00000008.00000000.2185472340.00000000047A6000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	47A6000
Size:	40960

Details

Name:	00000008.00000000.2171989028.00000000001A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1A0000
Size:	4096

Details

Name:	00000008.00000000.2186125518.0000000005680000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	5680000
Size:	4096

Details

Name:	00000008.00000000.2196375182.000000000C6D3000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C6D3000
Size:	8192

Details

Name:	00000008.00000002.2382806392.0000000002EF9000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF9000
Size:	16384

Details

Name:	00000006.00000002.2205201256.0000000000D30000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	D30000
Size:	20480

Details

Name:	00000008.00000000.2177079838.0000000002E38000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E38000
Size:	32768

Details

Name:	00000005.00000003.2165775508.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	00000007.00000002.2380152680.000000000021D000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	21D000
Size:	12288

Details

Name:	00000005.00000002.2173157025.00000000031B9000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31B9000
Size:	12288

Details

Name:	00000004.00000002.2182032577.000000000276F000.00000004.00000010.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	276F000
Size:	4096

Details

Name:	00000006.00000002.2204999489.00000000008DC000.00000004.00000010.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	8DC000
Size:	16384

Details

Name:	00000008.00000000.2185431640.0000000004610000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4610000
Size:	4096

Details

Name:	00000006.00000002.2205284435.0000000000E44000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	E44000
Size:	4096

Details

Name:	00000008.00000000.2188650267.000000000689E000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	689E000
Size:	57344

Details

Name:	00000008.00000002.2382629085.0000000002EC0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2EC0000
Size:	16384

Details

Name:	00000008.00000000.2195827526.000000000A3E9000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3E9000
Size:	847872

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking,
Urls found in memory or binary data	Networking,

Details

Name:	00000005.00000003.2166234819.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000008.00000000.2191442967.00000000085BE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	85BE000
Size:	380928

Details

Name:	00000008.00000000.2172778800.0000000001BF0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	1BF0000
Size:	8192

Details

Name:	00000008.00000000.2177069673.0000000002E2E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E2E000
Size:	16384

Details

Name:	0000000A.00000002.2380351648.00000000005C4000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5C4000
Size:	24576

Details

Name:	00000008.00000000.2190795592.0000000008040000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8040000
Size:	4096

Details

Name:	00000008.00000002.2380393391.00000000002EE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2EE000
Size:	110592

Details

Name:	00000008.00000000.2185482944.0000000004800000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	4800000
Size:	36864

Details

Name:	00000008.00000000.2185377198.0000000004450000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4450000
Size:	8192

Details

Name:	00000006.00000003.2168744048.00000000002A9000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2A9000
Size:	4096

Details

Name:	00000008.00000000.2195629260.0000000009CB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	9CB0000
Size:	4096

Details

Name:	00000004.00000002.2181050062.000000000042D000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	42D000
Size:	180224

Details

Name:	00000005.00000002.2169919748.0000000000870000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	870000
Size:	65536

Details

Name:	00000008.00000000.2190079969.0000000007040000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	7040000
Size:	4096

Details

Name:	00000008.00000000.2177024837.0000000002CF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2CF0000
Size:	4096

Details

Name:	00000008.00000000.2192784896.00000000094CF000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	94CF000
Size:	1642496

Details

Name:	00000008.00000000.2195617677.0000000009CAB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	9CAB000
Size:	4096

Details

Name:	00000005.00000003.2166454441.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000006.00000002.2205158248.0000000000CC0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	CC0000
Size:	12288

Details

Name:	00000006.00000003.2168581659.00000000009BD000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	9BD000
Size:	409600

Details

Name:	00000008.00000002.2381642644.0000000002570000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2570000
Size:	8192

Details

Name:	00000008.00000000.2181141173.00000000034D4000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	34D4000
Size:	118784

Details

Name:	00000008.00000002.2381620139.0000000002533000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2533000
Size:	36864

Details

Name:	00000008.00000000.2196302408.000000000C220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C220000
Size:	4096

Details

Name:	00000008.00000002.2382287787.0000000002E60000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2E60000
Size:	8192

Details

Name:	00000008.00000002.2380533467.0000000001BD0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BD0000
Size:	45056

Details

Name:	00000005.00000003.2165525420.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000000.2186159931.000000000582B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	582B000
Size:	20480

Details

Name:	00000004.00000002.2181076046.00000000004D4000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	4D4000
Size:	4096

Details

Name:	00000008.00000002.2381240472.0000000002070000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2070000
Size:	8192

Details

Name:	00000005.00000002.2172659106.0000000003094000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3094000
Size:	118784

Details

Name:	00000006.00000002.2205172425.0000000000CD0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	CD0000
Size:	368640

Details

Name:	0000000A.00000003.2205898975.00000000006B0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	6B0000
Size:	876544

Details

Name:	00000004.00000000.2160839403.000000000040A000.00000008.00020000.sdmp
TargetID:	4
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	40A000
Size:	4096

Details

Name:	00000008.00000000.2190932508.00000000082B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	82B0000
Size:	16384

Details

Name:	0000000A.00000003.2206009751.00000000007B0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	7B0000
Size:	368640

Details

Name:	00000005.00000003.2166710488.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000008.00000002.2380412548.000000000030D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	30D000
Size:	57344

Details

Name:	00000008.00000002.2381258128.0000000002100000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2100000
Size:	913408

Details

Name:	00000008.00000000.2195819091.000000000A3E4000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3E4000
Size:	16384

Details

Name:	0000000A.00000002.2380138193.00000000000F0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	F0000
Size:	8192

Details

Name:	00000005.00000003.2165144557.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000008.00000000.2176885425.0000000002B50000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2B50000
Size:	8192

Details

Name:	00000008.00000000.2181567441.0000000003860000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3860000
Size:	126976

Details

Name:	00000004.00000002.2180960359.00000000002DE000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2DE000
Size:	8192

Details

Name:	00000005.00000003.2166704618.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000008.00000000.2183832262.0000000004263000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4263000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Details

Name:	00000008.00000000.2181602478.0000000003940000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3940000
Size:	4096

Details

Name:	00000008.00000000.2175470512.0000000002540000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2540000
Size:	4096

Details

Name:	00000004.00000002.2181556655.00000000020C0000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20C0000
Size:	4096

Details

Name:	00000008.00000000.2177163856.0000000002EB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2EB0000
Size:	4096

Details

Name:	00000004.00000002.2181098784.00000000005B0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	5B0000
Size:	24576

Details

Name:	00000008.00000000.2176900647.0000000002B80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2B80000
Size:	4096

Details

Name:	00000008.00000002.2380421846.0000000000323000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	323000
Size:	8192

Details

Name:	0000000A.00000002.2380632555.0000000000937000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	937000
Size:	4096

Details

Name:	00000005.00000003.2164557845.0000000003D60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D60000
Size:	876544

Details

Name:	00000008.00000002.2382416344.0000000002E90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E90000
Size:	4096

Details

Name:	00000008.00000000.2172660129.0000000001BB0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	1BB0000
Size:	8192

Details

Name:	0000000A.00000002.2380853929.0000000000B60000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B60000
Size:	32768

Details

Name:	00000008.00000002.2381717341.0000000002690000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2690000
Size:	16384

Details

Name:	00000008.00000000.2191699702.0000000008951000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	8951000
Size:	1507328

Details

Name:	00000005.00000003.2169143529.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	0000000A.00000002.2380636597.0000000000940000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	940000
Size:	368640

Details

Name:	00000008.00000000.2192981823.000000000967E000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	967E000
Size:	57344

Details

Name:	00000008.00000002.2381748281.00000000026F0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	26F0000
Size:	8192

Details

Name:	0000000A.00000002.2381208185.0000000002B5D000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2B5D000
Size:	12288

Details

Name:	00000008.00000000.2172771320.0000000001BEF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BEF000
Size:	4096

Details

Name:	00000008.00000002.2381754421.0000000002700000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2700000
Size:	4096

Details

Name:	00000005.00000003.2164463493.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000000.2196327929.000000000C420000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C420000
Size:	184320

Details

Name:	00000005.00000002.2173162593.00000000031BD000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31BD000
Size:	81920

Details

Name:	00000006.00000002.2205046226.0000000000A60000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	A60000
Size:	4096

Details

Name:	00000006.00000003.2169453763.0000000000A30000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	A30000
Size:	4096

Details

Name:	00000008.00000000.2188611739.000000000688B000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	688B000
Size:	73728

Details

Name:	00000008.00000000.2196201817.000000000BC99000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	BC99000
Size:	28672

Details

Name:	00000007.00000002.2380140566.0000000000130000.00000004.00000040.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	130000
Size:	4096

Details

Name:	00000005.00000003.2165768762.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000000.2191479169.000000000861C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	861C000
Size:	98304

Details

Name:	00000008.00000002.2381760104.0000000002710000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2710000
Size:	8192

Details

Name:	00000005.00000003.2164688388.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000008.00000002.2380502128.0000000001B80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1B80000
Size:	4096

Details

Name:	00000008.00000000.2190318914.0000000007410000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	7410000
Size:	24576

Details

Name:	00000008.00000000.2190969028.00000000082FD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	82FD000
Size:	1228800

Details

Name:	00000006.00000002.2205153631.0000000000CB0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	CB0000
Size:	4096

Details

Name:	00000006.00000002.2204860352.00000000000C0000.00000002.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	C0000
Size:	421888

Details

Name:	00000008.00000000.2172755214.0000000001BE0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BE0000
Size:	45056

Details

Name:	00000004.00000002.2182036151.0000000002770000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2770000
Size:	741376

Details

Name:	00000008.00000002.2380364288.00000000002BB000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2BB000
Size:	24576

Details

Name:	00000005.00000003.2164747727.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000008.00000002.2383314120.0000000002F90000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2F90000
Size:	3526656

Details

Name:	00000008.00000002.2380174347.00000000000E0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	E0000
Size:	28672

Details

Name:	00000008.00000000.2172883814.0000000001C70000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	1C70000
Size:	4112384

Details

Name:	00000008.00000000.2180744686.0000000003318000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3318000
Size:	1019904

Details

Name:	00000008.00000002.2381782087.00000000028F1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	28F1000
Size:	28672

Details

Name:	00000008.00000002.2381692096.000000000265C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265C000
Size:	36864

Details

Name:	00000005.00000003.2165588039.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000008.00000002.2380205363.0000000000190000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	190000
Size:	4096

Details

Name:	00000005.00000003.2164683489.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000000.2181214687.0000000003566000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3566000
Size:	45056

Details

Name:	00000008.00000000.2196368674.000000000C6D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C6D0000
Size:	4096

Details

Name:	0000000A.00000002.2381294910.0000000004280000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	4280000
Size:	4112384

Details

Name:	00000008.00000002.2382896665.0000000002EFE000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2EFE000
Size:	192512

Details

Name:	00000008.00000002.2381790602.0000000002910000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	2910000
Size:	258048

Details

Name:	00000008.00000000.2177259238.0000000002EF0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF0000
Size:	12288

Details

Name:	00000008.00000000.2176538483.00000000026F0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	26F0000
Size:	8192

Details

Name:	00000005.00000002.2170705693.0000000002690000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2690000
Size:	806912

Details

Name:	0000000A.00000003.2205992884.00000000007A1000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	7A1000
Size:	4096

Details

Name:	00000008.00000000.2185421716.0000000004520000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4520000
Size:	8192

Details

Name:	00000008.00000000.2181580304.0000000003880000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3880000
Size:	110592

Details

Name:	00000008.00000000.2185407868.00000000044E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	44E0000
Size:	4096

Details

Name:	00000008.00000000.2190736326.0000000007A78000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	7A78000
Size:	32768

Details

Name:	00000005.00000003.2169136285.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000002.2380486429.0000000001B40000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1B40000
Size:	8192

Details

Name:	00000008.00000000.2196515966.000000000CD60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CD60000
Size:	208896

Details

Name:	0000000A.00000003.2205076099.00000000004BA000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	4BA000
Size:	4096

Details

Name:	00000008.00000000.2172100741.00000000001E9000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1E9000
Size:	12288

Details

Name:	00000008.00000000.2195639248.000000000A329000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	A329000
Size:	28672

Details

Name:	00000008.00000000.2173536398.0000000002100000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2100000
Size:	913408

Details

Name:	00000005.00000003.2166637054.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000005.00000002.2170165970.0000000000C99000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	C99000
Size:	90112

Details

Name:	00000008.00000000.2195748272.000000000A3B9000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3B9000
Size:	16384

Details

Name:	00000008.00000000.2176682236.0000000002A71000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2A71000
Size:	12288

Details

Name:	00000005.00000002.2173537006.0000000003440000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3440000
Size:	110592

Details

Name:	00000008.00000000.2181281741.00000000035F9000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35F9000
Size:	12288

Details

Name:	00000008.00000000.2196309179.000000000C23E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C23E000
Size:	28672

Details

Name:	00000008.00000000.2181760109.0000000003BC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3BC0000
Size:	4096

Details

Name:	00000008.00000000.2181242715.00000000035A2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35A2000
Size:	73728

Details

Name:	00000008.00000000.2177134828.0000000002E80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E80000
Size:	4096

Details

Name:	00000005.00000002.2171187729.0000000002AF8000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2AF8000
Size:	8192

Details

Name:	00000005.00000002.2175752944.0000000003897000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3897000
Size:	4096

Details

Name:	00000008.00000000.2191330161.000000000854C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	854C000
Size:	16384

Details

Name:	00000008.00000000.2181728476.0000000003B30000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3B30000
Size:	4096

Details

Name:	00000006.00000002.2204917480.0000000000260000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	260000
Size:	49152

Details

Name:	00000008.00000000.2184166014.000000000428C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	428C000
Size:	8192

Details

Name:	00000005.00000002.2175732272.0000000003894000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3894000
Size:	4096

Details

Name:	00000004.00000002.2181045047.000000000042A000.00000004.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	42A000
Size:	8192

Details

Name:	00000008.00000000.2190244887.00000000072EB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	72EB000
Size:	20480

Details

Name:	00000008.00000000.2172558522.0000000001AF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1AF0000
Size:	8192

Details

Name:	00000006.00000000.2164172039.00000000004B6000.00000002.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	4B6000
Size:	40960

Signature Hits	Behavior Group	Mitre Attack
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information,
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion,	Process Injection Process Discovery

Details

Name:	00000007.00000002.2380079539.0000000000060000.00000002.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	60000
Size:	421888

Details

Name:	00000008.00000000.2171928911.0000000000179000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	179000
Size:	28672

Details

Name:	00000005.00000003.2168483818.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000008.00000000.2189963900.0000000006F70000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	6F70000
Size:	4096

Details

Name:	00000005.00000003.2167570244.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000008.00000002.2381922544.0000000002AB4000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2AB4000
Size:	16384

Details

Name:	00000005.00000003.2166642375.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000000.2181605833.00000000039E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	39E0000
Size:	4096

Details

Name:	00000008.00000000.2173526797.0000000002070000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2070000
Size:	8192

Details

Name:	00000008.00000000.2181720864.0000000003AF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3AF0000
Size:	4096

Details

Name:	0000000A.00000002.2380521545.0000000000840000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	840000
Size:	876544

Details

Name:	00000005.00000003.2167638741.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000002.2380434959.0000000000550000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	550000
Size:	12288

Details

Name:	00000008.00000000.2186084200.0000000005230000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	5230000
Size:	4096

Details

Name:	00000005.00000002.2173187500.00000000031D9000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31D9000
Size:	53248

Details

Name:	00000005.00000003.2166341107.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000000.2181773215.0000000003C40000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3C40000
Size:	1986560

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary,
Found strings which match to known social media urls	Networking,
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2177145758.0000000002E90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E90000
Size:	4096

Details

Name:	00000008.00000000.2192959530.000000000966B000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	966B000
Size:	73728

Details

Name:	00000005.00000002.2169936753.00000000008F0000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	8F0000
Size:	24576

Details

Name:	00000008.00000002.2380228026.00000000001D7000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1D7000
Size:	20480

Details

Name:	00000005.00000002.2177127762.0000000003BE3000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3BE3000
Size:	90112

Details

Name:	00000008.00000000.2181262831.00000000035D2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35D2000
Size:	73728

Details

Name:	00000008.00000000.2181355625.0000000003649000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3649000
Size:	53248

Details

Name:	00000008.00000000.2181553014.0000000003840000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3840000
Size:	126976

Details

Name:	00000008.00000000.2172085937.00000000001E3000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1E3000
Size:	12288

Details

Name:	00000008.00000000.2190208339.000000000726D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	726D000
Size:	12288

Details

Name:	00000005.00000003.2163191764.00000000001F0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1F0000
Size:	40960

Details

Name:	00000008.00000000.2186203470.0000000005A20000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	5A20000
Size:	4096

Details

Name:	00000008.00000002.2380215653.00000000001C0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1C0000
Size:	8192

Details

Name:	00000008.00000000.2195623930.0000000009CAD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	9CAD000
Size:	12288

Details

Name:	00000005.00000003.2167113545.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	0000000A.00000002.2380282049.00000000002ED000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2ED000
Size:	12288

Details

Name:	00000008.00000000.2181591976.00000000038A0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	38A0000
Size:	4096

Details

Name:	00000008.00000002.2382005913.0000000002BE0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2BE0000
Size:	417792

Details

Name:	00000008.00000000.2176989359.0000000002C90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2C90000
Size:	4096

Details

Name:	00000008.00000000.2177325308.0000000002EF9000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF9000
Size:	16384

Details

Name:	00000008.00000002.2382776402.0000000002EF5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF5000
Size:	8192

Details

Name:	00000008.00000000.2191840794.0000000008AC2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	8AC2000
Size:	1089536

Details

Name:	00000008.00000002.2381630970.0000000002550000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2550000
Size:	36864

Details

Name:	00000004.00000002.2180969163.0000000000380000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	380000
Size:	421888

Details

Name:	00000005.00000002.2171196457.0000000002AFB000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2AFB000
Size:	61440

Details

Name:	00000008.00000000.2172354550.00000000002C2000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	2C2000
Size:	57344

Details

Name:	00000008.00000002.2382148632.0000000002DBF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DBF000
Size:	4096

Details

Name:	00000006.00000002.2204934636.000000000028D000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	28D000
Size:	4096

Details

Name:	00000005.00000002.2170794507.0000000002762000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2762000
Size:	163840

Details

Name:	00000008.00000000.2172386580.00000000002D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2D0000
Size:	4096

Details

Name:	00000004.00000002.2181080463.00000000004F2000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	4F2000
Size:	8192

Details

Name:	00000008.00000002.2381654917.00000000025A0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	25A0000
Size:	16384

Details

Name:	00000005.00000002.2173212690.0000000003202000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3202000
Size:	24576

Details

Name:	00000005.00000002.2170011324.0000000000BD1000.00000020.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	BD1000
Size:	585728

Details

Name:	00000008.00000000.2175407694.0000000002520000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2520000
Size:	8192

Details

Name:	00000008.00000002.2382703787.0000000002ED0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2ED0000
Size:	4096

Details

Name:	00000005.00000002.2172803977.00000000030D4000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	30D4000
Size:	184320

Details

Name:	00000005.00000002.2176773988.0000000003B03000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3B03000
Size:	98304

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2172595948.0000000001B5A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1B5A000
Size:	40960

Details

Name:	00000004.00000003.2161221609.0000000002670000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2670000
Size:	4096

Details

Name:	00000006.00000002.2205163507.0000000000CC4000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	CC4000
Size:	8192

Details

Name:	00000005.00000002.2169553914.0000000000210000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	210000
Size:	12288

Details

Name:	00000006.00000002.2205168227.0000000000CC7000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	CC7000
Size:	4096

Details

Name:	0000000A.00000003.2206047164.0000000000810000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	810000
Size:	20480

Details

Name:	00000008.00000002.2380237360.00000000001E3000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1E3000
Size:	12288

Details

Name:	00000008.00000000.2185357747.00000000043D0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	43D0000
Size:	49152

Details

Name:	00000005.00000002.2175697977.0000000003854000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3854000
Size:	4096

Details

Name:	00000008.00000002.2381765845.0000000002720000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2720000
Size:	4096

Details

Name:	00000008.00000000.2176913675.0000000002BE0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2BE0000
Size:	417792

Details

Name:	00000007.00000002.2380167514.0000000000256000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	256000
Size:	8192

Details

Name:	00000007.00000002.2380174389.000000000039F000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39F000
Size:	4096

Details

Name:	00000008.00000002.2380491037.0000000001B5A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1B5A000
Size:	40960

Details

Name:	00000008.00000000.2192425514.00000000090A5000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	90A5000
Size:	180224

Details

Name:	0000000A.00000002.2380339942.00000000005A0000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5A0000
Size:	16384

Details

Name:	00000008.00000000.2172443501.0000000000323000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	323000
Size:	8192

Details

Name:	00000008.00000000.2196682404.000000000CF22000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CF22000
Size:	245760

Details

Name:	00000006.00000000.2164218683.00000000004C9000.00000002.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	4C9000
Size:	90112

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2172607527.0000000001B80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1B80000
Size:	4096

Details

Name:	00000008.00000002.2380439772.00000000006F0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	6F0000
Size:	380928

Details

Name:	00000008.00000000.2190119249.00000000070FE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	70FE000
Size:	12288

Details

Name:	00000006.00000002.2205013970.0000000000A20000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	A20000
Size:	258048

Details

Name:	00000005.00000002.2169550263.00000000001E0000.00000040.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E0000
Size:	8192

Details

Name:	00000005.00000002.2173485551.0000000003400000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3400000
Size:	126976

Details

Name:	00000008.00000000.2184245718.000000000428F000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	428F000
Size:	4096

Details

Name:	00000005.00000003.2168680634.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000004.00000000.2160812115.0000000000400000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000008.00000000.2172465350.0000000000550000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	550000
Size:	12288

Details

Name:	00000008.00000000.2177182395.0000000002ED0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2ED0000
Size:	4096

Details

Name:	00000008.00000000.2181175938.0000000003514000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3514000
Size:	184320

Details

Name:	00000005.00000002.2173249374.0000000003232000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3232000
Size:	24576

Details

Name:	00000008.00000000.2185466159.00000000047A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	47A0000
Size:	4096

Details

Name:	00000008.00000000.2196316597.000000000C320000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C320000
Size:	4096

Details

Name:	00000006.00000002.2204888914.000000000016F000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16F000
Size:	4096

Details

Name:	00000008.00000000.2172452620.00000000003D0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3D0000
Size:	24576

Details

Name:	00000005.00000002.2170306811.0000000000F67000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	F67000
Size:	3313664

Details

Name:	00000008.00000000.2196077802.000000000B320000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	B320000
Size:	348160

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000008.00000000.2188239189.00000000066EF000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	66EF000
Size:	1642496

Details

Name:	00000008.00000000.2184305000.0000000004291000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4291000
Size:	8192

Details

Name:	00000008.00000000.2177106887.0000000002E50000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2E50000
Size:	4096

Details

Name:	00000008.00000000.2196050489.000000000B2A0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	B2A0000
Size:	4096

Details

Name:	00000008.00000000.2172430249.000000000030D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	30D000
Size:	57344

Details

Name:	00000004.00000002.2181095256.00000000005A6000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	5A6000
Size:	12288

Details

Name:	00000004.00000002.2181028739.0000000000408000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	408000
Size:	8192

Details

Name:	00000004.00000002.2181088120.000000000059E000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	59E000
Size:	8192

Details

Name:	00000004.00000003.2161212199.0000000002670000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2670000
Size:	4096

Details

Name:	00000004.00000002.2181084345.0000000000530000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	530000
Size:	8192

Details

Name:	00000008.00000000.2176590548.00000000028F1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	28F1000
Size:	28672

Details

Name:	00000008.00000000.2181609431.00000000039EB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	39EB000
Size:	20480

Details

Name:	00000008.00000000.2181753440.0000000003BB8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3BB8000
Size:	32768

Details

Name:	00000008.00000000.2177175623.0000000002EC0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2EC0000
Size:	16384

Details

Name:	00000005.00000002.2173014423.0000000003132000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3132000
Size:	73728

Details

Name:	00000008.00000000.2185461908.00000000046E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	46E0000
Size:	4096

Details

Name:	00000005.00000003.2165781928.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	0000000A.00000002.2380679125.00000000009B0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	9B0000
Size:	4096

Details

Name:	00000008.00000000.2184815545.00000000042CB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	42CB000
Size:	282624

Details

Name:	00000008.00000000.2190682951.00000000077F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	77F0000
Size:	4096

Details

Name:	0000000A.00000002.2380496854.0000000000780000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	780000
Size:	49152

Details

Name:	00000008.00000000.2191338368.0000000008555000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8555000
Size:	90112

Details

Name:	00000005.00000002.2172649173.0000000003092000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3092000
Size:	4096

Details

Name:	00000004.00000001.2160974039.0000000000400000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000008.00000000.2193753780.00000000096F4000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	96F4000
Size:	471040

Details

Name:	00000006.00000002.2205288662.0000000000E47000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	E47000
Size:	4096

Details

Name:	00000006.00000002.2205336303.0000000000EC0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	EC0000
Size:	12288

Details

Name:	00000005.00000002.2173257793.0000000003239000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3239000
Size:	53248

Details

Name:	0000000A.00000002.2380269741.000000000029F000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	29F000
Size:	4096

Details

Name:	00000005.00000002.2176755691.0000000003AF5000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3AF5000
Size:	45056

Details

Name:	00000008.00000000.2181251004.00000000035B5000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35B5000
Size:	4096

Details

Name:	00000008.00000002.2381886285.0000000002A60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A60000
Size:	16384

Details

Name:	00000006.00000003.2169577672.0000000000B40000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	B40000
Size:	368640

Details

Name:	00000005.00000003.2167034818.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000008.00000000.2177001528.0000000002CB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB0000
Size:	4096

Details

Name:	0000000A.00000002.2380152587.0000000000140000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	140000
Size:	4096

Details

Name:	0000000A.00000002.2380166963.00000000001A0000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1A0000
Size:	421888

Details

Name:	00000008.00000002.2381895646.0000000002A71000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A71000
Size:	12288

Details

Name:	00000008.00000000.2176675429.0000000002A60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2A60000
Size:	16384

Details

Name:	00000005.00000002.2175654575.0000000003840000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3840000
Size:	57344

Details

Name:	00000008.00000000.2181231441.0000000003585000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3585000
Size:	4096

Details

Name:	00000005.00000003.2167690229.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	00000008.00000002.2383294181.0000000002F70000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2F70000
Size:	12288

Details

Name:	00000008.00000000.2196443576.000000000C8E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C8E0000
Size:	184320

Details

Name:	00000008.00000002.2380565062.0000000001C13000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1C13000
Size:	118784

Details

Name:	00000004.00000002.2177690908.0000000000020000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20000
Size:	4096

Details

Name:	00000008.00000002.2381957168.0000000002AF0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2AF0000
Size:	8192

Details

Name:	00000005.00000003.2166374967.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	00000005.00000002.2173047689.0000000003145000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3145000
Size:	4096

Details

Name:	00000008.00000000.2181274298.00000000035E5000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35E5000
Size:	4096

Details

Name:	00000005.00000002.2173222008.0000000003209000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3209000
Size:	53248

Details

Name:	00000005.00000003.2165279272.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	00000008.00000000.2182296101.0000000004051000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4051000
Size:	8192

Details

Name:	00000008.00000000.2181057174.0000000003412000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3412000
Size:	782336

Details

Name:	00000008.00000000.2184339822.0000000004294000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4294000
Size:	8192

Details

Name:	00000008.00000000.2171790737.0000000000020000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	20000
Size:	8192

Details

Name:	00000005.00000003.2165749378.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000005.00000003.2163228783.00000000001F0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1F0000
Size:	40960

Details

Name:	00000005.00000002.2171208142.0000000002B30000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B30000
Size:	12288

Details

Name:	00000005.00000002.2172379271.0000000002FD2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2FD2000
Size:	782336

Details

Name:	00000008.00000000.2191235298.0000000008471000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8471000
Size:	888832

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	00000005.00000003.2165085761.0000000003CDD000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDD000
Size:	409600

Details

Name:	00000008.00000000.2184382682.0000000004297000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4297000
Size:	188416

Details

Name:	00000008.00000002.2380544868.0000000001BE0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BE0000
Size:	45056

Details

Name:	00000008.00000000.2196129834.000000000BB20000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	BB20000
Size:	262144

Details

Name:	00000008.00000000.2186209025.0000000005AB0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	5AB0000
Size:	733184

Details

Name:	00000005.00000003.2166082117.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000007.00000002.2380219379.000000000064E000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	64E000
Size:	8192

Details

Name:	00000008.00000000.2176978282.0000000002C60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2C60000
Size:	4096

Details

Name:	00000008.00000002.2380192069.0000000000179000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	179000
Size:	28672

Details

Name:	00000008.00000000.2176831176.0000000002B30000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2B30000
Size:	8192

Details

Name:	00000008.00000002.2380514949.0000000001BB0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1BB0000
Size:	8192

Details

Name:	00000008.00000000.2190762048.0000000007AC0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	7AC0000
Size:	4096

Details

Name:	00000008.00000002.2380506601.0000000001B9A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1B9A000
Size:	40960

Details

Name:	0000000A.00000002.2380159489.000000000019C000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19C000
Size:	16384

Details

Name:	00000008.00000000.2181155906.00000000034F2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	34F2000
Size:	4096

Details

Name:	00000008.00000000.2172708014.0000000001BCF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BCF000
Size:	4096

Details

Name:	00000005.00000002.2173131112.0000000003192000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3192000
Size:	73728

Details

Name:	00000008.00000000.2190172230.0000000007150000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	7150000
Size:	4096

Details

Name:	00000005.00000003.2169097242.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000002.2381668035.00000000025F2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	25F2000
Size:	172032

Details

Name:	00000008.00000002.2380552456.0000000001BEF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BEF000
Size:	4096

Details

Name:	00000008.00000000.2172787744.0000000001BF5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	1BF5000
Size:	4096

Details

Name:	00000005.00000003.2165132544.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000008.00000000.2177200371.0000000002EE0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2EE0000
Size:	16384

Details

Name:	00000007.00000002.2380192471.00000000003ED000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3ED000
Size:	32768

Details

Name:	00000008.00000002.2381929235.0000000002AC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2AC0000
Size:	167936

Details

Name:	00000004.00000002.2181068847.00000000004BE000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	4BE000
Size:	8192

Details

Name:	00000008.00000000.2175716341.000000000265C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	265C000
Size:	36864

Details

Name:	00000008.00000000.2181598798.000000000393E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	393E000
Size:	8192

Details

Name:	00000008.00000000.2176558602.0000000002710000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2710000
Size:	8192

Details

Name:	00000008.00000000.2191957102.0000000008C2A000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	8C2A000
Size:	4694016

Details

Name:	00000008.00000002.2380386007.00000000002D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2D0000
Size:	4096

Details

Name:	00000008.00000002.2380246315.00000000001F5000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1F5000
Size:	241664

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion,	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Details

Name:	00000008.00000000.2185451393.00000000046B8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	46B8000
Size:	32768

Details

Name:	00000008.00000000.2196586460.000000000CE24000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CE24000
Size:	245760

Details

Name:	00000008.00000002.2380520888.0000000001BC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1BC0000
Size:	45056

Details

Name:	00000008.00000002.2381729824.00000000026B0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	26B0000
Size:	8192

Details

Name:	00000005.00000002.2169558120.0000000000216000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	216000
Size:	12288

Details

Name:	00000004.00000001.2162706625.0000000002F80000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	2F80000
Size:	4096

Details

Name:	00000006.00000002.2204924196.000000000026D000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	26D000
Size:	4096

Details

Name:	00000006.00000002.2204913528.000000000025F000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	25F000
Size:	4096

Details

Name:	0000000A.00000002.2380671187.00000000009A0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	9A0000
Size:	20480

Details

Name:	00000008.00000002.2380308454.0000000000260000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	260000
Size:	368640

Details

Name:	0000000A.00000003.2205998156.00000000007A4000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	7A4000
Size:	4096

Details

Name:	00000008.00000002.2382759361.0000000002EF0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2EF0000
Size:	12288

Details

Name:	00000008.00000000.2188890279.0000000006988000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6988000
Size:	4509696

Details

Name:	00000008.00000000.2185506864.0000000004ACB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4ACB000
Size:	20480

Details

Name:	0000000A.00000002.2380295069.0000000000360000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	360000
Size:	57344

Details

Name:	00000004.00000002.2178308700.0000000000280000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	280000
Size:	16384

Details

Name:	00000006.00000002.2205061481.0000000000BC0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	BC0000
Size:	4096

Details

Name:	00000008.00000000.2171954018.0000000000180000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	180000
Size:	24576

Details

Name:	00000004.00000002.2177991965.00000000001D0000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0000
Size:	8192

Details

Name:	00000004.00000002.2182028465.000000000266F000.00000004.00000010.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	266F000
Size:	4096

Details

Name:	00000008.00000000.2172423673.000000000030B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	30B000
Size:	4096

Details

Name:	0000000A.00000003.2204986766.00000000003E0000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E0000
Size:	884736

Details

Name:	00000008.00000000.2190061048.0000000006FB3000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	6FB3000
Size:	4096

Details

Name:	0000000A.00000002.2380686122.00000000009C0000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	9C0000
Size:	876544

Details

Name:	00000008.00000002.2380274891.0000000000231000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	231000
Size:	151552

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Details

Name:	00000008.00000000.2190693694.00000000077F9000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	77F9000
Size:	28672

Details

Name:	00000008.00000000.2196562830.000000000CDE0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CDE0000
Size:	262144

Details

Name:	00000008.00000002.2381626548.0000000002540000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2540000
Size:	4096

Details

Name:	00000008.00000000.2190819402.0000000008140000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8140000
Size:	184320

Details

Name:	00000008.00000002.2381699515.0000000002666000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2666000
Size:	155648

Details

Name:	00000008.00000000.2181278225.00000000035F6000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	35F6000
Size:	4096

Details

Name:	00000008.00000000.2196661124.000000000CEE2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CEE2000
Size:	200704

Details

Name:	00000005.00000002.2169985330.0000000000A80000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	A80000
Size:	4096

Details

Name:	00000008.00000000.2182731714.000000000419A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	419A000
Size:	73728

Details

Name:	00000008.00000000.2181332023.0000000003635000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3635000
Size:	49152

Details

Name:	00000006.00000002.2205280320.0000000000E41000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	E41000
Size:	4096

Details

Name:	00000004.00000002.2177886301.000000000018C000.00000004.00000010.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	18C000
Size:	16384

Details

Name:	00000008.00000000.2188052452.0000000006695000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6695000
Size:	364544

Details

Name:	00000008.00000000.2173521478.0000000002060000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2060000
Size:	8192

Details

Name:	00000008.00000000.2177053196.0000000002D30000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2D30000
Size:	4096

Details

Name:	0000000A.00000002.2380627068.0000000000934000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	934000
Size:	8192

Details

Name:	00000007.00000002.2380147125.0000000000134000.00000004.00000040.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	134000
Size:	16384

Details

Name:	0000000A.00000003.2205142203.00000000005C9000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	5C9000
Size:	40960

Details

Name:	00000005.00000002.2172793355.00000000030D2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	30D2000
Size:	4096

Details

Name:	00000008.00000000.2191190874.000000000842E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	842E000
Size:	270336

Details

Name:	00000008.00000000.2182310972.0000000004090000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	4090000
Size:	8192

Details

Name:	00000005.00000002.2173143515.00000000031A5000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31A5000
Size:	4096

Details

Name:	00000008.00000000.2196249044.000000000C020000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C020000
Size:	184320

Details

Name:	00000008.00000002.2381609278.0000000002510000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page write copy
Base address:	2510000
Size:	12288

Details

Name:	0000000A.00000003.2206004857.00000000007A7000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	7A7000
Size:	4096

Details

Name:	00000008.00000000.2171882459.00000000000D4000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	D4000
Size:	49152

Details

Name:	00000008.00000000.2186153327.0000000005829000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	5829000
Size:	4096

Details

Name:	00000008.00000002.2382074853.0000000002CB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB0000
Size:	4096

Details

Name:	00000008.00000002.2380154864.00000000000D0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	D0000
Size:	4096

Details

Name:	00000005.00000003.2166368523.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000002.2380182707.00000000000F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	F0000
Size:	8192

Details

Name:	00000004.00000002.2181013071.00000000003F0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3F0000
Size:	8192

Details

Name:	00000008.00000000.2171974909.0000000000190000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	190000
Size:	4096

Details

Name:	00000005.00000003.2166353064.0000000003E51000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E51000
Size:	4096

Details

Name:	00000008.00000000.2172740589.0000000001BDF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BDF000
Size:	4096

Details

Name:	0000000A.00000003.2206098156.0000000000020000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20000
Size:	36864

Details

Name:	00000004.00000002.2181017810.0000000000400000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000008.00000000.2181201018.0000000003542000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3542000
Size:	73728

Details

Name:	00000008.00000000.2181724725.0000000003B00000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3B00000
Size:	4096

Details

Name:	00000008.00000000.2175367672.0000000002510000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	2510000
Size:	12288

Details

Name:	00000008.00000000.2175781626.0000000002666000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2666000
Size:	155648

Details

Name:	00000008.00000000.2185855898.0000000004F30000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4F30000
Size:	3133440

Signature Hits	Behavior Group	Mitre Attack
Urls found in memory or binary data	Networking,

Details

Name:	0000000A.00000003.2205134047.00000000005D3000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	5D3000
Size:	40960

Details

Name:	00000008.00000000.2173652581.00000000021E0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	21E0000
Size:	2945024

Details

Name:	00000006.00000000.2164052134.0000000000401000.00000020.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	585728

Details

Name:	00000004.00000002.2180964798.00000000002E1000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2E1000
Size:	4096

Details

Name:	00000007.00000002.2380210584.0000000000400000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	400000
Size:	28672

Details

Name:	00000004.00000002.2181041314.0000000000423000.00000004.00020000.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	423000
Size:	4096

Details

Name:	00000008.00000002.2382178550.0000000002E38000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E38000
Size:	32768

Details

Name:	00000008.00000000.2191544961.0000000008666000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	8666000
Size:	8192

Details

Name:	00000008.00000000.2185515589.0000000004B50000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4B50000
Size:	4001792

Details

Name:	00000008.00000000.2181137286.00000000034D2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	34D2000
Size:	4096

Details

Name:	00000005.00000002.2169541744.00000000001A4000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1A4000
Size:	4096

Details

Name:	0000000A.00000002.2380516990.0000000000830000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	830000
Size:	4096

Details

Name:	00000005.00000002.2169961525.0000000000A70000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	A70000
Size:	12288

Details

Name:	00000008.00000000.2196272038.000000000C120000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C120000
Size:	262144

Details

Name:	0000000A.00000002.2381664389.000000007EFDF000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7EFDF000
Size:	4096

Details

Name:	00000008.00000000.2185496902.00000000049FD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	49FD000
Size:	12288

Details

Name:	00000008.00000000.2172714964.0000000001BD0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BD0000
Size:	45056

Details

Name:	00000005.00000000.2162650154.0000000000C86000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	C86000
Size:	40960

Details

Name:	00000008.00000002.2381903732.0000000002A80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A80000
Size:	49152

Details

Name:	00000008.00000000.2185427196.0000000004530000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	4530000
Size:	8192

Details

Name:	00000005.00000003.2165513591.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000005.00000002.2169467742.0000000000020000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20000
Size:	4096

Details

Name:	00000008.00000000.2188534371.0000000006888000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6888000
Size:	4096

Details

Name:	00000008.00000000.2194326808.0000000009768000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	9768000
Size:	4509696

Details

Name:	00000008.00000000.2176491656.00000000026A0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	26A0000
Size:	8192

Details

Name:	0000000A.00000002.2380618624.0000000000920000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	920000
Size:	4096

Details

Name:	00000008.00000000.2182315599.0000000004110000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4110000
Size:	126976

Details

Name:	00000008.00000000.2176520627.00000000026D0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	26D0000
Size:	8192

Details

Name:	00000008.00000000.2182406623.000000000414D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	414D000
Size:	294912

Details

Name:	00000008.00000000.2177112079.0000000002E60000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2E60000
Size:	8192

Details

Name:	00000008.00000000.2181221903.0000000003572000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3572000
Size:	73728

Details

Name:	00000008.00000000.2182301744.0000000004060000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4060000
Size:	4096

Details

Name:	00000008.00000002.2381229097.0000000002060000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2060000
Size:	8192

Details

Name:	0000000A.00000002.2380274551.00000000002A0000.00000004.00000040.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2A0000
Size:	12288

Details

Name:	0000000A.00000002.2381654176.00000000047CE000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	47CE000
Size:	8192

Details

Name:	00000008.00000000.2177887113.0000000002F90000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2F90000
Size:	3670016

Details

Name:	00000005.00000003.2165424614.0000000003C00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3C00000
Size:	884736

Details

Name:	00000004.00000002.2181072748.00000000004D0000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	4D0000
Size:	4096

Details

Name:	00000008.00000000.2191615388.000000000888E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	888E000
Size:	8192

Details

Name:	00000008.00000000.2176570133.0000000002720000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2720000
Size:	4096

Details

Name:	00000004.00000002.2177999392.00000000001E0000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1E0000
Size:	20480

Details

Name:	00000006.00000003.2168124066.00000000008E0000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	8E0000
Size:	884736

Details

Name:	00000005.00000002.2172980212.0000000003126000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3126000
Size:	45056

Details

Name:	00000008.00000002.2381637612.0000000002560000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2560000
Size:	12288

Details

Name:	00000006.00000002.2205275144.0000000000E30000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	E30000
Size:	4096

Details

Name:	00000008.00000000.2195758787.000000000A3BE000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3BE000
Size:	110592

Details

Name:	00000008.00000000.2172402231.00000000002EE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2EE000
Size:	110592

Details

Name:	00000005.00000003.2165264933.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000000.2176552840.0000000002700000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2700000
Size:	4096

Details

Name:	00000008.00000000.2182788291.00000000041AD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	41AD000
Size:	491520

Details

Name:	00000008.00000002.2380159892.00000000000D4000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	D4000
Size:	49152

Details

Name:	00000008.00000000.2192451098.00000000090D2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	90D2000
Size:	3809280

Details

Name:	00000004.00000002.2177897984.00000000001C0000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	1C0000
Size:	28672

Details

Name:	00000004.00000002.2180947602.00000000002CD000.00000004.00000020.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2CD000
Size:	36864

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Details

Name:	0000000A.00000002.2380786142.0000000000AB4000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AB4000
Size:	4096

Details

Name:	00000004.00000000.2160831465.0000000000408000.00000002.00020000.sdmp
TargetID:	4
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	408000
Size:	8192

Details

Name:	00000005.00000002.2173559352.0000000003460000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3460000
Size:	1986560

Details

Name:	00000008.00000002.2381971117.0000000002B30000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B30000
Size:	8192

Details

Name:	00000006.00000000.2164206662.00000000004C4000.00000008.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	4C4000
Size:	8192

Details

Name:	00000005.00000000.2162668761.0000000000C94000.00000008.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	C94000
Size:	8192

Details

Name:	00000008.00000002.2381877328.0000000002A50000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2A50000
Size:	8192

Details

Name:	00000008.00000000.2195810622.000000000A3DF000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	A3DF000
Size:	16384

Details

Name:	00000006.00000003.2168751418.00000000002AF000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2AF000
Size:	45056

Details

Name:	0000000A.00000003.2205987730.0000000000790000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	790000
Size:	4096

Details

Name:	00000008.00000000.2196720340.000000000CF60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CF60000
Size:	262144

Details

Name:	00000008.00000000.2181375708.0000000003665000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3665000
Size:	49152

Details

Name:	0000000A.00000002.2381245862.0000000002E80000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2E80000
Size:	380928

Details

Name:	00000008.00000000.2191556473.00000000086B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	86B0000
Size:	262144

Details

Name:	00000008.00000000.2172167631.0000000000231000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	231000
Size:	151552

Details

Name:	00000008.00000002.2380210645.00000000001A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A0000
Size:	4096

Details

Name:	00000008.00000000.2172677873.0000000001BC0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	1BC0000
Size:	45056

Details

Name:	0000000A.00000002.2380868536.0000000000B7A000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B7A000
Size:	4096

Details

Name:	00000005.00000003.2164542157.0000000003D50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3D50000
Size:	4096

Details

Name:	00000004.00000002.2181103455.0000000000730000.00000002.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	730000
Size:	12288

Details

Name:	0000000A.00000002.2380346285.00000000005A7000.00000004.00000020.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5A7000
Size:	4096

Details

Name:	00000005.00000002.2169533545.0000000000170000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	170000
Size:	8192

Details

Name:	00000005.00000000.2162544744.0000000000BD1000.00000020.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	BD1000
Size:	585728

Details

Name:	00000005.00000002.2176853069.0000000003B20000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3B20000
Size:	737280

Details

Name:	00000006.00000002.2205361837.000000007EFDF000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7EFDF000
Size:	4096

Details

Name:	00000005.00000003.2166383696.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000008.00000000.2181716490.0000000003AEF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	3AEF000
Size:	4096

Details

Name:	0000000A.00000002.2380897404.0000000000D77000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	D77000
Size:	741376

Details

Name:	00000007.00000002.2380201718.00000000003F6000.00000004.00000020.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3F6000
Size:	4096

Details

Name:	0000000A.00000002.2380132860.00000000000E0000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	E0000
Size:	28672

Details

Name:	00000005.00000002.2177094342.0000000003BD5000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3BD5000
Size:	45056

Details

Name:	00000008.00000000.2196360965.000000000C61A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C61A000
Size:	24576

Details

Name:	00000008.00000000.2190281571.00000000072F0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	72F0000
Size:	4096

Details

Name:	00000006.00000002.2205054818.0000000000AA3000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AA3000
Size:	4096

Details

Name:	00000005.00000002.2172972778.0000000003115000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3115000
Size:	4096

Details

Name:	00000005.00000003.2165226837.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000002.2380098900.0000000000060000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	60000
Size:	421888

Details

Name:	00000005.00000003.2164696459.0000000003E54000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E54000
Size:	4096

Details

Name:	00000008.00000000.2171874457.00000000000D0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	D0000
Size:	4096

Details

Name:	00000005.00000003.2165715626.0000000003E40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E40000
Size:	4096

Details

Name:	00000008.00000002.2380302861.000000000025D000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	25D000
Size:	8192

Details

Name:	00000008.00000000.2172112087.00000000001F5000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	1F5000
Size:	241664

Details

Name:	00000008.00000002.2382223501.0000000002E50000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E50000
Size:	4096

Details

Name:	00000005.00000003.2166859246.0000000003E57000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E57000
Size:	4096

Details

Name:	0000000A.00000002.2380317183.0000000000480000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	480000
Size:	49152

Details

Name:	00000005.00000002.2169603296.000000000068D000.00000004.00000010.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	68D000
Size:	12288

Details

Name:	00000008.00000000.2176622921.0000000002A20000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2A20000
Size:	196608

Details

Name:	00000008.00000002.2381615227.0000000002520000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2520000
Size:	8192

Details

Name:	00000008.00000000.2171916473.000000000016E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	16E000
Size:	12288

Details

Name:	00000008.00000000.2172340926.00000000002BB000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap default
Protect:	page read and write
Base address:	2BB000
Size:	24576

Details

Name:	00000008.00000000.2176861353.0000000002B40000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2B40000
Size:	8192

Details

Name:	00000008.00000000.2192747185.0000000009475000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	9475000
Size:	364544

Details

Name:	00000005.00000002.2175782818.0000000003A40000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3A40000
Size:	737280

Details

Name:	00000008.00000002.2381985003.0000000002B50000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B50000
Size:	8192

Details

Name:	00000005.00000002.2177199455.00000000FFFDF000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	FFFDF000
Size:	4096

Details

Name:	00000008.00000000.2181530951.0000000003802000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3802000
Size:	249856

Details

Name:	00000008.00000002.2381649582.0000000002587000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2587000
Size:	4096

Details

Name:	00000008.00000000.2196638579.000000000CEA3000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CEA3000
Size:	237568

Details

Name:	00000005.00000003.2164704470.0000000003E60000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3E60000
Size:	368640

Details

Name:	00000005.00000002.2170824548.0000000002790000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2790000
Size:	2945024

Details

Name:	00000008.00000000.2181384967.0000000003672000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3672000
Size:	24576

Details

Name:	00000006.00000000.2164038891.0000000000400000.00000002.00020000.sdmp
TargetID:	6
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	0000000A.00000002.2381219061.0000000002B60000.00000002.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B60000
Size:	24576

Details

Name:	00000008.00000000.2185381075.0000000004460000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	4460000
Size:	4096

Details

Name:	00000005.00000003.2164450922.0000000003CDA000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3CDA000
Size:	4096

Details

Name:	00000008.00000000.2185350676.00000000043BD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	43BD000
Size:	12288

Details

Name:	00000008.00000000.2196764744.000000000CFA3000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	CFA3000
Size:	237568

Details

Name:	00000006.00000002.2205211632.0000000000D50000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	D50000
Size:	876544

Details

Name:	00000008.00000002.2382553688.0000000002EB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2EB0000
Size:	4096

Details

Name:	00000005.00000002.2172725746.00000000030B2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	30B2000
Size:	4096

Details

Name:	00000004.00000002.2182268030.000000007EFDF000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7EFDF000
Size:	4096

Details

Name:	00000005.00000002.2173106299.0000000003175000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3175000
Size:	4096

Details

Name:	00000008.00000000.2185492980.00000000048B0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	48B0000
Size:	4096

Details

Name:	00000008.00000000.2178877609.0000000003312000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	3312000
Size:	16384

Details

Name:	00000006.00000003.2169573558.0000000000B37000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	B37000
Size:	4096

Details

Name:	00000006.00000002.2204938492.00000000002A0000.00000004.00000020.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2A0000
Size:	16384

Details

Name:	00000008.00000000.2171996840.00000000001C0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	1C0000
Size:	8192

Details

Name:	00000008.00000000.2191913722.0000000008BCD000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	8BCD000
Size:	376832

Details

Name:	00000005.00000000.2162663759.0000000000C90000.00000008.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	C90000
Size:	8192

Details

Name:	00000008.00000000.2175605608.00000000025A0000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	25A0000
Size:	16384

Details

Name:	00000005.00000002.2169471910.00000000000B0000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	B0000
Size:	28672

Details

Name:	00000005.00000003.2167887446.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000008.00000002.2382111909.0000000002D20000.00000020.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute read
Base address:	2D20000
Size:	65536

Details

Name:	00000006.00000002.2205207221.0000000000D40000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	D40000
Size:	4096

Details

Name:	00000008.00000002.2381977935.0000000002B40000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2B40000
Size:	8192

Details

Name:	0000000A.00000002.2380465705.0000000000755000.00000004.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	755000
Size:	45056

Details

Name:	00000008.00000000.2186166320.00000000058AF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	58AF000
Size:	8192

Details

Name:	00000008.00000000.2181618841.00000000039F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	39F0000
Size:	8192

Details

Name:	00000005.00000002.2169592371.000000000065F000.00000004.00000010.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	stack
Protect:	page read and write
Base address:	65F000
Size:	4096

Details

Name:	00000007.00000002.2380161769.0000000000220000.00000004.00000001.sdmp
TargetID:	7
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	220000
Size:	4096

Details

Name:	00000004.00000003.2161227571.0000000002670000.00000004.00000001.sdmp
TargetID:	4
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2670000
Size:	4096

Details

Name:	00000008.00000000.2186312825.0000000005B71000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	5B71000
Size:	1507328

Details

Name:	00000008.00000000.2196381780.000000000C6D8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	C6D8000
Size:	4096

Details

Name:	00000005.00000001.2164253278.0000000003C00000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	3C00000
Size:	4096

Details

Name:	00000008.00000000.2187555152.00000000062F2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	62F2000
Size:	3809280

Details

Name:	00000005.00000002.2172739833.00000000030B4000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	30B4000
Size:	118784

Details

Name:	00000005.00000003.2166911142.0000000003EC0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3EC0000
Size:	20480

Details

Name:	00000006.00000003.2169561297.0000000000B20000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	B20000
Size:	4096

Details

Name:	00000008.00000002.2382132490.0000000002D30000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2D30000
Size:	4096

Details

Name:	00000008.00000002.2381915053.0000000002A90000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A90000
Size:	12288

Details

Name:	00000008.00000000.2171784032.0000000000010000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	10000
Size:	4096

Details

Name:	00000008.00000000.2187478062.00000000062C5000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	62C5000
Size:	180224

Details

Name:	0000000A.00000002.2380781426.0000000000AB1000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	AB1000
Size:	4096

Details

Name:	00000008.00000002.2381836001.0000000002993000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	2993000
Size:	4096

Details

Name:	00000005.00000002.2171950165.0000000002ED2000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2ED2000
Size:	16384

Details

Name:	00000008.00000000.2177061197.0000000002DBF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2DBF000
Size:	4096

Details

Name:	00000008.00000002.2380232816.00000000001DD000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1DD000
Size:	12288

Details

Name:	00000006.00000003.2168773831.00000000002AE000.00000004.00000001.sdmp
TargetID:	6
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2AE000
Size:	8192

Details

Name:	00000004.00000002.2181091515.00000000005A0000.00000004.00000040.sdmp
TargetID:	4
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	5A0000
Size:	12288

Details

Name:	00000006.00000002.2205066899.0000000000BD0000.00000040.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	BD0000
Size:	876544

Details

Name:	00000005.00000002.2173150541.00000000031B6000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	31B6000
Size:	4096

Details

Name:	00000008.00000000.2176661323.0000000002A50000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	2A50000
Size:	8192

Details

Name:	00000008.00000000.2195993697.000000000B0B5000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	heap private
Protect:	page read and write
Base address:	B0B5000
Size:	45056

Details

Name:	00000008.00000000.2191625546.0000000008890000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	8890000
Size:	733184

Details

Name:	00000008.00000000.2176605676.0000000002900000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page read and write
Base address:	2900000
Size:	4096

Details

Name:	00000008.00000000.2185412910.0000000004500000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	4500000
Size:	16384

Details

Name:	00000008.00000000.2189933935.0000000006DEF000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	6DEF000
Size:	90112

Details

Name:	00000008.00000002.2382053550.0000000002C80000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2C80000
Size:	4096

Details

Name:	00000008.00000000.2186495493.0000000005CE2000.00000002.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page readonly
Base address:	5CE2000
Size:	1089536

Details

Name:	00000008.00000000.2176904981.0000000002BC0000.00000008.00000001.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown
Protect:	page write copy
Base address:	2BC0000
Size:	20480

Details

Name:	00000005.00000002.2171962683.0000000002ED8000.00000002.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	2ED8000
Size:	1019904

Details

Name:	0000000A.00000002.2380845063.0000000000B30000.00000040.00000001.sdmp
TargetID:	10
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B30000
Size:	12288

Details

Name:	00000006.00000002.2205346099.0000000000FD0000.00000002.00000001.sdmp
TargetID:	6
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	FD0000
Size:	24576

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps