Automated Malware Analysis IOC Report for

Details

Name:	00000026.00000003.18434898565.00000138BE7B6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE7B6000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Nanocore Rat	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
Installs a raw input device (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18301521899.00000138BE774000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE774000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18438557231.00000138BD0C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD0C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Baldr	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected Knot Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Nemty Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Nephilim Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18317408849.00000138BDA0D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA0D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18343624782.00000138BE12C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE12C000
Size:	94208

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18312208260.00000138BDE5C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE5C000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18303257076.00000138BE522000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE522000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18424475350.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18347059262.00000138BDD2C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD2C000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18348911082.00000138BD189000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD189000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Contains strings related to BOT control commands	Remote Access Functionality
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18433827604.00000138BC9C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BC9C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Mock Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18309026309.00000138BD4A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4A8000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18430871789.00000138BE2D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE2D0000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected HawkEye Rat	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Artemon Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected ByteLocker Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected LazParking Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
May modify the system service descriptor table (often done to hook functions)	Hooking and other Techniques for Hiding and Protection	Credential API Hooking
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
Public key (encryption) found	Cryptography	Archive Collected Data
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18293544646.00000138BD8C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18432962909.00000138BE62A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE62A000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found Tor onion address	Networking	Proxy
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18336058119.00000138BD221000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD221000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18331471007.00000138BD776000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD776000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Binary or sample is protected by dotNetProtector	Data Obfuscation
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18346820069.00000138BE12C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE12C000
Size:	94208

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18333799062.00000138BDC1C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDC1C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18311417254.00000138BCA04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18296951613.00000138BE396000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE396000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18351550928.00000138BCD89000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD89000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara detected Winexe tool	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18337788205.00000138BD0C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD0C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18437644222.00000138BDCE2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCE2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18327500976.00000138BDB98000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB98000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18314933274.00000138BCB04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18338362697.00000138BCE4E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE4E000
Size:	221184

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18329938261.00000138BD734000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD734000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18345351380.00000138BE66C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE66C000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery

Details

Name:	00000026.00000003.18322967354.00000138BCA81000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA81000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18415619805.00000138BD881000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD881000
Size:	532480

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18434572336.00000138BE6AE000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6AE000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected GoGoogle ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Wannacry ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18329040392.00000138BCB04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18345693514.00000138BE774000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE774000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000026.00000003.18293843088.00000138BC981000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BC981000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found string related to ransomware	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
Found strings related to Crypto-Mining	Bitcoin Miner
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18306892097.00000138BD524000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD524000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18297604848.00000138BD4A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4A8000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18344277872.00000138BE12C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE12C000
Size:	94208

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18409070283.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18331763483.00000138BE49F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE49F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18410085130.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18417573092.00000138BD8B1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18323946155.00000138BDB98000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB98000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000026.00000003.18436729907.00000138BE5E7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5E7000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected NoCry Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found Tor onion address	Networking	Proxy
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18344712542.00000138BD9CA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD9CA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18355537254.00000138BCF99000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF99000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18349576485.00000138BE313000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE313000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18435519768.00000138BD45D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45D000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Yara detected Costura Assembly Loader	Data Obfuscation
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18357184238.00000138BD9CA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD9CA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands

Details

Name:	00000026.00000003.18418537892.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18408563136.00000138BD8B1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18306564142.00000138BD4E3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4E3000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18352805869.00000138BD221000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD221000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18423541232.00000138BD8B1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18324581744.00000138BDC1C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDC1C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18334733543.00000138BCF14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF14000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18435217053.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Yara detected LimeRAT	Key, Mouse, Clipboard, Microphone and Screen Capturing, Boot Survival, Malware Analysis System Evasion, Lowering of HIPS / PFW / Operating System Security Settings
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18291167151.00000138BE1C8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1C8000
Size:	139264

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18327835238.00000138BDC5F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDC5F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18330538197.00000138BE396000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE396000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000026.00000003.18438856533.00000138BDFB8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFB8000
Size:	77824

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18316462962.00000138BD524000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD524000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary

Details

Name:	00000026.00000003.18436125478.00000138BD62B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD62B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected LimeRAT	Key, Mouse, Clipboard, Microphone and Screen Capturing, Boot Survival, Malware Analysis System Evasion, Lowering of HIPS / PFW / Operating System Security Settings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18312795035.00000138BEAE5000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEAE5000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18358332585.00000138BD221000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD221000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18326787908.00000138BE45C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE45C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18327109777.00000138BDB15000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB15000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18347347691.00000138BEAA2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEAA2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18424893452.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18338726635.00000138BCF14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF14000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18331150591.00000138BD6B1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD6B1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18431158407.00000138BE311000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE311000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected GhostRat	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18292669743.00000138BD567000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD567000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18297254258.00000138BD45F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected UACMe UAC Bypass tool	Exploits
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18354456744.00000138BD776000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD776000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18330858645.00000138BE45C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE45C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18431738263.00000138BE1C7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1C7000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Wannacry ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18294992845.00000138BE1C8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1C8000
Size:	139264

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18336867211.00000138BDB98000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB98000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000005.00000002.15127086137.00000000022F0000.00000040.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	22F0000
Size:	65536

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Yara detected GuLoader	Data Obfuscation

Details

Name:	00000026.00000003.18314057962.00000138BE8D4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE8D4000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18430007878.00000138BEA1E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEA1E000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Imminent RAT	Remote Access Functionality	Remote Access Software
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara detected Credential Stealer	Stealing of Sensitive Information
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18309314406.00000138BD524000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD524000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary

Details

Name:	00000026.00000003.18318886682.00000138BE45C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE45C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18326445165.00000138BE3D9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE3D9000
Size:	20480

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18430579741.00000138BEBEB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEBEB000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Niros Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18430295296.00000138BEBAA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEBAA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected HiddenTear ransomware	Spam, unwanted Advertisements and Ransom Demands
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18322216000.00000138BDE5C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE5C000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18308141829.00000138BCCD6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCCD6000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected AllatoriJARObfuscator	Data Obfuscation
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18306821141.00000138BD516000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD516000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18335675853.00000138BD1CB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD1CB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara detected Costura Assembly Loader	Data Obfuscation
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18357864029.00000138BE774000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE774000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000026.00000003.18433249672.00000138BE66B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE66B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Buran Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Gocoder ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18342844275.00000138BE522000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE522000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18342357735.00000138BDE5C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE5C000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18317720831.00000138BDA90000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA90000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18341014844.00000138BCCD6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCCD6000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected AllatoriJARObfuscator	Data Obfuscation

Details

Name:	00000026.00000003.18432385873.00000138BDEF2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEF2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18290273099.00000138BE733000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE733000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18323286323.00000138BCB04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18424078658.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18313135929.00000138BE99B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE99B000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara detected AllatoriJARObfuscator	Data Obfuscation
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18409582995.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18299088622.00000138BDEB1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEB1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected UACMe UAC Bypass tool	Exploits
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18293349131.00000138BD896000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD896000
Size:	176128

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AllatoriJARObfuscator	Data Obfuscation
Yara detected MSILLoadEncryptedAssembly	Data Obfuscation
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18329637762.00000138BD6F3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD6F3000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18332072554.00000138BE522000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE522000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18341553900.00000138BCF14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF14000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18325502433.00000138BEAA2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEAA2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18433546699.00000138BC981000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BC981000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Linux EvilGnome RC5 key	Key, Mouse, Clipboard, Microphone and Screen Capturing, Remote Access Functionality	Remote Access Software
Yara detected Metasploit Payload	Remote Access Functionality
Yara detected Meterpreter	Networking, Remote Access Functionality
Yara detected RevengeRAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18354111280.00000138BE522000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE522000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18436433001.00000138BE5A6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5A6000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found potential ransomware demand text	Spam, unwanted Advertisements and Ransom Demands
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18306680829.00000138BD4FA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4FA000
Size:	110592

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18342492638.00000138BE45C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE45C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18418142617.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18437958836.00000138BDD23000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD23000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found potential ransomware demand text	Spam, unwanted Advertisements and Ransom Demands
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18319503784.00000138BE66C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE66C000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18339341305.00000138BE774000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE774000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000026.00000003.18435819604.00000138BD5EA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5EA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clop Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cute Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18330244639.00000138BD776000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD776000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18306268361.00000138BCF14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF14000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18353734046.00000138BDA90000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA90000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18290586958.00000138BE774000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE774000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000026.00000003.18300303304.00000138BE24D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE24D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

Details

Name:	00000026.00000003.18300587499.00000138BE28E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE28E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18431448870.00000138BE186000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE186000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000026.00000003.18348013322.00000138BE8D4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE8D4000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18291761539.00000138BCE4E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE4E000
Size:	221184

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18321311969.00000138BE145000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE145000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18289807011.00000138BEB27000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEB27000
Size:	196608

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18305060553.00000138BDA90000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA90000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18418975958.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18317087585.00000138BCA04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18320434515.00000138BD905000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD905000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000026.00000003.18432672691.00000138BDF33000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF33000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands

Details

Name:	00000026.00000003.18301189769.00000138BE6F1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6F1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality

Details

Name:	00000026.00000003.18437333856.00000138BE03B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE03B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Clop Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Nemty Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000026.00000003.18311707231.00000138BDDEB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDDEB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Growtopia	Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary

Details

Name:	00000026.00000003.18306077924.00000138BCEEA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCEEA000
Size:	167936

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000026.00000003.18351208505.00000138BD776000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD776000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18315232073.00000138BDD67000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD67000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000026.00000003.18349361933.00000138BD221000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD221000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000028.00000003.18519926064.00000215F83EF000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83EF000
Size:	12288

Details

Name:	00000026.00000003.18348303027.00000138BE916000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE916000
Size:	4096

Details

Name:	00000001.00000003.14629072026.000002DEA15D3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D3000
Size:	20480

Details

Name:	00000001.00000003.14631900524.000002DEA1809000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1809000
Size:	24576

Details

Name:	00000026.00000003.18292362950.00000138BDF76000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF76000
Size:	77824

Details

Name:	0000002A.00000003.18539915623.0000022796F06000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F06000
Size:	4096

Details

Name:	00000026.00000000.18231395699.00007FF78E899000.00000008.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF78E899000
Size:	8192

Details

Name:	00000001.00000003.14633172544.000002DEA1C1B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C1B000
Size:	69632

Details

Name:	0000002C.00000003.18641257783.0000016FFD229000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD229000
Size:	57344

Details

Name:	0000001D.00000002.19664829929.0000019F0C200000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0C200000
Size:	8192

Details

Name:	00000026.00000003.18326117215.00000138BCBCA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCBCA000
Size:	4096

Details

Name:	00000020.00000002.19666666188.00000296DEA15000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEA15000
Size:	8192

Details

Name:	00000020.00000003.18139389644.00000296E3E50000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E50000
Size:	8192

Details

Name:	00000001.00000002.14718706697.000002DE9F740000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2DE9F740000
Size:	16384

Details

Name:	0000002A.00000003.18536722144.0000022796F3D000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F3D000
Size:	196608

Details

Name:	00000012.00000003.18108864102.000001CCB0C45000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C45000
Size:	262144

Details

Name:	00000020.00000002.19672296458.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000026.00000003.18294785233.00000138AA777000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA777000
Size:	81920

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000002D.00000003.18686127553.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	53248

Details

Name:	00000026.00000000.18231209972.00007FF78E877000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF78E877000
Size:	139264

Details

Name:	00000020.00000002.19664424315.00000296DE27B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE27B000
Size:	4096

Details

Name:	0000002A.00000003.18540335246.0000022796E62000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E62000
Size:	4096

Details

Name:	00000020.00000003.18187482099.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000003.14628852635.000002DEA15C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C4000
Size:	20480

Details

Name:	00000001.00000003.14630232495.000002DEA15C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C4000
Size:	20480

Details

Name:	00000020.00000002.19672381235.00000296E4100000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4100000
Size:	81920

Details

Name:	00000001.00000002.14721558276.00007FF4F8394000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8394000
Size:	4096

Details

Name:	00000012.00000002.19668744236.00007FF5676CE000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676CE000
Size:	12288

Details

Name:	0000000D.00000002.19662153748.000000000283F000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	283F000
Size:	12288

Details

Name:	00000020.00000003.18245466129.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	57344

Details

Name:	00000028.00000003.18520688907.00000215F83D7000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83D7000
Size:	49152

Details

Name:	00000026.00000003.18347687691.00000138BDAD3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDAD3000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
Binary or sample is protected by dotNetProtector	Data Obfuscation
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Contains strings related to BOT control commands	Remote Access Functionality
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14624438588.000002DEA1ED0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1ED0000
Size:	69632

Details

Name:	00000026.00000003.18324271972.00000138BDBDB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDBDB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14614377450.000002DEA144C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA144C000
Size:	20480

Details

Name:	00000001.00000002.14721239403.00007FF4F7DD3000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7DD3000
Size:	4096

Details

Name:	00000001.00000003.14628658265.000002DEA1596000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1596000
Size:	61440

Details

Name:	0000002D.00000002.19661032331.000001A8F8BB0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8BB0000
Size:	4096

Details

Name:	00000020.00000003.18204043933.00000296E4403000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4403000
Size:	126976

Details

Name:	00000028.00000003.18518663088.00000215F83D4000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83D4000
Size:	102400

Details

Name:	00000001.00000003.14630446929.000002DEA15BF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BF000
Size:	8192

Details

Name:	00000026.00000003.18315823751.00000138BDEF2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEF2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000003.18159388693.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000026.00000003.18268996153.00000138AEB7A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AEB7A000
Size:	1228800

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002D.00000002.19668170987.00007FF7B5879000.00000004.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF7B5879000
Size:	12288

Details

Name:	0000002C.00000003.18643767640.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	28672

Details

Name:	00000001.00000003.14648022319.000002DEA200C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200C000
Size:	4096

Details

Name:	0000002C.00000003.18655503222.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	61440

Details

Name:	00000026.00000003.18348616803.00000138BCC0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCC0C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000003.18626615080.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	143360

Details

Name:	00000001.00000003.14708355488.000002DEA16E0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16E0000
Size:	143360

Details

Name:	00000026.00000003.18345612865.00000138BE6A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6A8000
Size:	20480

Details

Name:	00000020.00000003.18187654255.00000296E4445000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4445000
Size:	233472

Details

Name:	00000001.00000002.14721642890.00007FF4F83EE000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F83EE000
Size:	4096

Details

Name:	00000020.00000003.18202085046.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000020.00000003.18146398278.00000296DEBAC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBAC000
Size:	4096

Details

Name:	00000005.00000000.14652482326.0000000000400000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	0000002C.00000003.18632498745.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	180224

Details

Name:	00000028.00000003.18520446972.00000215F841B000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F841B000
Size:	8192

Details

Name:	00000001.00000003.14638437810.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	73728

Details

Name:	00000026.00000003.18347977735.00000138BDB14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB14000
Size:	4096

Details

Name:	00000028.00000003.18519546410.00000215F83F9000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83F9000
Size:	147456

Details

Name:	00000001.00000003.14715225938.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	77824

Details

Name:	00000020.00000003.18231824321.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	122880

Details

Name:	00000025.00000003.18577994808.0000021B53AAA000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AAA000
Size:	12288

Details

Name:	00000001.00000003.14615146861.000002DE9F5A2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A2000
Size:	139264

Details

Name:	0000002C.00000003.18659497323.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000001.00000003.14715446320.000002DE9F59C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F59C000
Size:	24576

Details

Name:	00000020.00000003.18160117600.00000296E3E20000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E20000
Size:	4096

Details

Name:	0000001D.00000002.19666183431.00007FF5EB95A000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EB95A000
Size:	8192

Details

Name:	0000002D.00000003.18680633616.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	258048

Details

Name:	00000020.00000003.18231208984.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	0000002C.00000003.18649123964.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	69632

Details

Name:	00000001.00000003.14635860731.000002DEA1CB4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CB4000
Size:	65536

Details

Name:	00000001.00000003.14715532126.000002DE9F517000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F517000
Size:	32768

Details

Name:	00000026.00000003.18332668729.00000138BD2B0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD2B0000
Size:	135168

Signature Hits	Behavior Group	Mitre Attack
Detected Hacktool Mimikatz	Privilege Escalation	OS Credential Dumping
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000012.00000002.19661000715.000001CCB0A80000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0A80000
Size:	118784

Details

Name:	00000001.00000003.14630351641.000002DEA15D3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D3000
Size:	20480

Details

Name:	00000020.00000003.18159928345.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	0000002C.00000003.18666996592.0000016FFD220000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD220000
Size:	143360

Details

Name:	00000001.00000003.14716237034.000002DEA18DA000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA18DA000
Size:	8192

Details

Name:	00000020.00000002.19662178845.00000296DE120000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE120000
Size:	118784

Details

Name:	00000026.00000003.18295324067.00000138BE20A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE20A000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000003.18647910779.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	28672

Details

Name:	0000002C.00000002.19662379723.0000016FFD3C0000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD3C0000
Size:	4096

Details

Name:	0000002D.00000003.18692658182.000001A8F8CAE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CAE000
Size:	49152

Details

Name:	00000026.00000003.18357112462.00000138BDCE2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCE2000
Size:	4096

Details

Name:	0000002A.00000003.18538606592.0000022796EF4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EF4000
Size:	20480

Details

Name:	00000026.00000003.18355485883.00000138BD01C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD01C000
Size:	4096

Details

Name:	00000001.00000003.14646680467.000002DEA15A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A8000
Size:	16384

Details

Name:	00000001.00000003.14716474148.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	8192

Details

Name:	00000020.00000003.18245113453.00000296E4468000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4468000
Size:	233472

Details

Name:	0000002A.00000003.18540113687.0000022796EE7000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EE7000
Size:	28672

Details

Name:	0000002C.00000003.18622649321.0000016FFD1C0000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD1C0000
Size:	65536

Details

Name:	00000028.00000002.18524910565.00007FF52FAEF000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAEF000
Size:	8192

Details

Name:	0000001D.00000002.19666772496.00007FF5EBE6E000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBE6E000
Size:	4096

Details

Name:	00000005.00000002.15128441575.0000000002D39000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2D39000
Size:	24576

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000001.00000002.14721300652.00007FF4F80BE000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F80BE000
Size:	16384

Details

Name:	00000025.00000002.18578783032.0000021B53A90000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	21B53A90000
Size:	40960

Details

Name:	0000002C.00000003.18656457501.0000016FFD23A000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23A000
Size:	28672

Details

Name:	00000020.00000003.18191691578.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000020.00000003.18215504060.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000025.00000002.18579263965.00007DF573522000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573522000
Size:	4096

Details

Name:	00000005.00000002.15134671017.000000007FFC0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC0000
Size:	4096

Details

Name:	00000026.00000003.18240715466.00000138AD073000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AD073000
Size:	8192

Details

Name:	00000001.00000002.14722682346.00007FF4F853A000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F853A000
Size:	65536

Details

Name:	00000026.00000003.18284309259.00000138AA7A7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7A7000
Size:	45056

Details

Name:	00000026.00000003.18349877375.00000138BE354000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE354000
Size:	4096

Details

Name:	00000020.00000002.19676149546.00007FF4FEBCF000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBCF000
Size:	4096

Details

Name:	00000028.00000002.18523478648.00000215F7AB0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7AB0000
Size:	4096

Details

Name:	00000020.00000003.18186830685.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000020.00000002.19670953665.00000296DFD90000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DFD90000
Size:	24576

Details

Name:	00000026.00000003.18277691299.00000138AA767000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA767000
Size:	65536

Details

Name:	00000028.00000002.18525001719.00007FF52FB16000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB16000
Size:	16384

Details

Name:	00000020.00000003.18191172655.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000028.00000002.18523657673.00000215F7BD9000.00000004.00000020.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	215F7BD9000
Size:	151552

Details

Name:	00000012.00000000.18108509085.00007FF56770F000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56770F000
Size:	20480

Details

Name:	00000020.00000003.18188707223.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000020.00000002.19676363605.00007FF4FEBFB000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBFB000
Size:	16384

Details

Name:	00000001.00000003.14625119032.000002DEA1E89000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E89000
Size:	32768

Details

Name:	0000002C.00000003.18661181240.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000026.00000003.18423300022.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	40960

Details

Name:	00000020.00000003.18217120407.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000001.00000003.14635837530.000002DEA170A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170A000
Size:	4096

Details

Name:	00000020.00000003.18174019423.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000001.00000002.14720974756.00007DF4002D0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4002D0000
Size:	20480

Details

Name:	0000002C.00000003.18660018675.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	53248

Details

Name:	00000001.00000002.14720373353.000002DEA1610000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1610000
Size:	4096

Details

Name:	0000002C.00000000.18614208922.00007FF6A3711000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A3711000
Size:	7516160

Details

Name:	00000020.00000003.18202882104.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000020.00000003.18219784174.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000020.00000003.18202583397.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000001.00000003.14630481100.000002DEA15C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C4000
Size:	20480

Details

Name:	0000002C.00000003.18649013174.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	28672

Details

Name:	00000001.00000003.14634798293.000002DEA1CAB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CAB000
Size:	102400

Details

Name:	0000002C.00000003.18666348196.0000016FFD20D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD20D000
Size:	20480

Details

Name:	00000026.00000003.18354072977.00000138BDB14000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB14000
Size:	4096

Details

Name:	0000002D.00000003.18684378180.000001A8F8CC0000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC0000
Size:	65536

Details

Name:	00000001.00000003.14709218602.000002DEA1763000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1763000
Size:	4096

Details

Name:	00000020.00000003.18231249001.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000028.00000003.18521749500.00000215F83A6000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A6000
Size:	12288

Details

Name:	00000005.00000002.15134614086.000000007FFB2000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB2000
Size:	4096

Details

Name:	0000002D.00000002.19665059893.00007FF5AFA7C000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA7C000
Size:	12288

Details

Name:	00000001.00000003.14630736047.000002DEA17AB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17AB000
Size:	73728

Details

Name:	00000026.00000003.18304770549.00000138BDA4F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA4F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary or sample is protected by dotNetProtector	Data Obfuscation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18216688322.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	0000002D.00000002.19665628864.00007FF5AFAB9000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAB9000
Size:	4096

Details

Name:	00000001.00000003.14628886296.000002DEA15CC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15CC000
Size:	20480

Details

Name:	00000020.00000003.18160016980.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	0000002C.00000003.18662365002.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	61440

Details

Name:	00000020.00000002.19671466287.00000296E3F40000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F40000
Size:	8192

Details

Name:	00000020.00000002.19665481500.00000296DE2F9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE2F9000
Size:	32768

Details

Name:	00000026.00000003.18343744956.00000138BDFFA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFFA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18245760453.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	122880

Details

Name:	00000020.00000000.18136112544.00000296DE120000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE120000
Size:	118784

Details

Name:	00000001.00000003.14640768773.000002DEA1C1C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C1C000
Size:	36864

Details

Name:	00000020.00000003.18215040219.00000296DEBA7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA7000
Size:	16384

Details

Name:	00000020.00000003.18139517284.00000296E3E64000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E64000
Size:	4096

Details

Name:	00000001.00000003.14620957139.000002DEA1DD5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DD5000
Size:	69632

Details

Name:	00000026.00000003.18322318413.00000138BD5A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5A8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000000.18136461216.00007DF508B90000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B90000
Size:	4096

Details

Name:	00000028.00000003.18521790067.00000215F83B3000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B3000
Size:	16384

Details

Name:	0000002D.00000000.18669490852.00007FF59875F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF59875F000
Size:	4096

Details

Name:	00000025.00000002.18580029135.00007FF7202D0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7202D0000
Size:	4096

Details

Name:	00000001.00000003.14715584141.000002DE9F517000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F517000
Size:	32768

Details

Name:	00000020.00000002.19677136950.00007FF4FEC69000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC69000
Size:	32768

Details

Name:	0000002C.00000003.18657841754.0000016FFD23C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23C000
Size:	28672

Details

Name:	0000001D.00000002.19666551512.00007FF5EBBEA000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBBEA000
Size:	4096

Details

Name:	00000020.00000003.18175322526.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000001.00000003.14634228688.000002DEA1C75000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C75000
Size:	69632

Details

Name:	00000001.00000002.14718584571.000002DE9F5CB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5CB000
Size:	8192

Details

Name:	00000020.00000003.18189625552.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000001.00000003.14612354565.000002DEA14C1000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14C1000
Size:	20480

Details

Name:	0000000D.00000002.19661877125.0000000000BD1000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	BD1000
Size:	12288

Details

Name:	00000020.00000002.19676561801.00007FF4FEC23000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC23000
Size:	4096

Details

Name:	00000026.00000003.18284588084.00000138AA787000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA787000
Size:	65536

Details

Name:	0000001D.00000002.19660815904.00000048D1C7D000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	48D1C7D000
Size:	12288

Details

Name:	00000012.00000002.19667515245.00007DF5715E0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715E0000
Size:	12288

Details

Name:	00000001.00000002.14720310597.000002DEA15BD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BD000
Size:	16384

Details

Name:	00000028.00000002.18524953622.00007FF52FAF5000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAF5000
Size:	12288

Details

Name:	0000002C.00000003.18652840674.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	36864

Details

Name:	00000001.00000003.14614264458.000002DEA1484000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1484000
Size:	20480

Details

Name:	00000026.00000003.18344077733.00000138BE102000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE102000
Size:	167936

Details

Name:	00000001.00000003.14641884229.000002DEA160C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160C000
Size:	12288

Details

Name:	00000020.00000003.18188756815.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000001.00000003.14709663026.000002DEA160C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160C000
Size:	12288

Details

Name:	00000026.00000003.18324900169.00000138BEA1E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEA1E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000020.00000003.18217313159.00000296E4457000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4457000
Size:	233472

Details

Name:	0000001D.00000002.19668572896.00007FF5EC28B000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC28B000
Size:	8192

Details

Name:	00000001.00000002.14718195056.000002DE9F517000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F517000
Size:	32768

Details

Name:	00000001.00000003.14715372561.000002DE9F5D4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D4000
Size:	32768

Details

Name:	00000001.00000003.14613495010.000002DEA1440000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1440000
Size:	36864

Details

Name:	00000020.00000003.18176077357.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	0000001D.00000002.19667039135.00007FF5EC0C1000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC0C1000
Size:	4096

Details

Name:	00000020.00000003.18174117811.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	00000001.00000002.14717683573.000002DE9F4C0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F4C0000
Size:	4096

Details

Name:	0000002D.00000003.18683324363.000001A8F8CC0000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC0000
Size:	61440

Details

Name:	00000020.00000003.18173770222.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	00000001.00000002.14717199166.000000EDDBFFB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDBFFB000
Size:	20480

Details

Name:	00000005.00000002.15134380169.000000001C400000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1C400000
Size:	4096

Details

Name:	00000020.00000002.19669860045.00000296DF2A1000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DF2A1000
Size:	4096

Details

Name:	00000001.00000002.14722641085.00007FF4F8533000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8533000
Size:	24576

Details

Name:	00000001.00000003.14622669250.000002DEA1E42000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E42000
Size:	73728

Details

Name:	0000002D.00000002.19661882745.000001A8F8C50000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8C50000
Size:	45056

Details

Name:	00000001.00000003.14623199406.000002DEA1DFE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DFE000
Size:	65536

Details

Name:	00000020.00000003.18216910508.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000020.00000003.18215875713.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000001.00000002.14721802187.00007FF4F844B000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F844B000
Size:	49152

Details

Name:	00000026.00000003.18323600754.00000138BDB57000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB57000
Size:	147456

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000001D.00000000.18133752861.00007DF5F61E0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61E0000
Size:	12288

Details

Name:	00000025.00000002.18579467755.00007FF569488000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569488000
Size:	4096

Details

Name:	00000026.00000003.18240660686.00000138AD070000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AD070000
Size:	8192

Details

Name:	00000001.00000003.14634396867.000002DEA1BC5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BC5000
Size:	8192

Details

Name:	00000028.00000000.18509304990.00007DF539A12000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A12000
Size:	4096

Details

Name:	00000020.00000002.19661017198.000000B13567E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B13567E000
Size:	8192

Details

Name:	00000001.00000003.14711547602.000002DEA157B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA157B000
Size:	16384

Details

Name:	00000001.00000003.14642422132.000002DEA159A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159A000
Size:	45056

Details

Name:	0000000D.00000002.19663123779.00000000029AB000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29AB000
Size:	4096

Details

Name:	00000026.00000003.18351876437.00000138BCDCA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCDCA000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000025.00000002.18580452533.00007FF720311000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF720311000
Size:	10485760

Details

Name:	0000002A.00000003.18539850998.0000022796F06000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F06000
Size:	4096

Details

Name:	00000005.00000002.15125554416.0000000000401000.00000020.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	73728

Details

Name:	00000026.00000003.18332044939.00000138BE4E0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE4E0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000005.00000002.15126409935.0000000000C30000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	C30000
Size:	69632

Details

Name:	00000026.00000003.18322662955.00000138BD62C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD62C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000002.19675995079.00007FF4FEAE8000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEAE8000
Size:	4096

Details

Name:	00000001.00000003.14614298952.000002DEA1490000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1490000
Size:	20480

Details

Name:	00000001.00000003.14631968531.000002DEA17C8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17C8000
Size:	12288

Details

Name:	00000020.00000003.18139479186.00000296E3E60000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E60000
Size:	4096

Details

Name:	0000002C.00000003.18651759424.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	28672

Details

Name:	00000026.00000003.18309610141.00000138BE5A6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5A6000
Size:	204800

Signature Hits	Behavior Group	Mitre Attack
Contains strings related to BOT control commands	Remote Access Functionality
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19672890860.00000296E4156000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4156000
Size:	73728

Details

Name:	00000026.00000003.18299971451.00000138BE07E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE07E000
Size:	4096

Details

Name:	00000025.00000000.18201210685.00007DF573520000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573520000
Size:	4096

Details

Name:	00000028.00000003.18522050985.00000215F838B000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F838B000
Size:	16384

Details

Name:	0000002C.00000002.19662486584.0000016FFD540000.00000004.00000040.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	16FFD540000
Size:	12288

Details

Name:	00000020.00000003.18219601356.00000296E41D5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41D5000
Size:	16384

Details

Name:	00000020.00000002.19674042368.00007DF406A40000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF406A40000
Size:	20480

Details

Name:	0000002C.00000002.19663576268.00007FF50B665000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B665000
Size:	8192

Details

Name:	0000002D.00000003.18687694882.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	65536

Details

Name:	00000026.00000003.18350359042.00000138BE7B7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE7B7000
Size:	98304

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000012.00000002.19660740216.000000784937C000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	784937C000
Size:	16384

Details

Name:	00000020.00000003.18147236316.00000296E4360000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4360000
Size:	4096

Details

Name:	00000001.00000003.14711579195.000002DEA158D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA158D000
Size:	53248

Details

Name:	0000002D.00000003.18689678244.000001A8F8CCE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCE000
Size:	73728

Details

Name:	00000020.00000003.18217639910.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000026.00000003.18438264865.00000138BD081000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD081000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000000.14610667594.00007DF502430000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502430000
Size:	12288

Details

Name:	00000020.00000003.18173628289.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	00000026.00000003.18321039197.00000138BD98C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD98C000
Size:	249856

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000002.18542451284.00007FF5C7DE0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DE0000
Size:	20480

Details

Name:	00000026.00000003.18338690648.00000138BCE90000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE90000
Size:	4096

Details

Name:	00000020.00000003.18215188626.00000296DEBA7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA7000
Size:	16384

Details

Name:	0000001D.00000002.19669114709.00007FF5EC2D5000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2D5000
Size:	20480

Details

Name:	00000026.00000003.18332878772.00000138BD2D2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD2D2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18274033128.00000138AF014000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AF014000
Size:	8192

Details

Name:	00000001.00000003.14624523668.000002DEA1EE2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EE2000
Size:	69632

Details

Name:	00000028.00000003.18522707064.00000215F8387000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8387000
Size:	4096

Details

Name:	00000001.00000003.14628764793.000002DEA15AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AF000
Size:	73728

Details

Name:	00000020.00000003.18191364268.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	4096

Details

Name:	00000026.00000003.18304476785.00000138BE2D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE2D0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19676695889.00007FF4FEC30000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC30000
Size:	16384

Details

Name:	00000026.00000003.18407903707.00000138AA767000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA767000
Size:	65536

Details

Name:	00000020.00000003.18215656048.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000020.00000003.18203829924.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	0000002A.00000003.18537674766.0000022796F49000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F49000
Size:	147456

Details

Name:	0000002D.00000000.18669289880.00007DF5B99D2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99D2000
Size:	4096

Details

Name:	0000002D.00000002.19665180207.00007FF5AFA80000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA80000
Size:	12288

Details

Name:	00000020.00000003.18244111688.00000296E4468000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4468000
Size:	233472

Details

Name:	0000002A.00000003.18540022851.0000022796E6E000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E6E000
Size:	4096

Details

Name:	0000001D.00000002.19664090630.0000019F0C09D000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C09D000
Size:	114688

Details

Name:	00000005.00000002.15127289168.0000000002BD0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2BD0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000001.00000002.14717113108.000000EDDBDFE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDBDFE000
Size:	8192

Details

Name:	00000001.00000003.14612691005.000002DEA149D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA149D000
Size:	49152

Details

Name:	00000025.00000001.18219936623.00007FF7202D0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7202D0000
Size:	4096

Details

Name:	00000001.00000003.14712824797.000002DE9F5D2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D2000
Size:	40960

Details

Name:	0000002A.00000003.18535195070.0000022796732000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796732000
Size:	45056

Details

Name:	0000002C.00000003.18658625209.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	24576

Details

Name:	00000020.00000003.18188132935.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000001.00000003.14614669793.000002DEA1444000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1444000
Size:	4096

Details

Name:	00000026.00000003.18329330778.00000138BCB46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB46000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected RemCom RemoteAdmin tool	Remote Access Functionality
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19665256001.00000296DE2E7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE2E7000
Size:	8192

Details

Name:	0000002C.00000003.18663006350.0000016FFD23F000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23F000
Size:	28672

Details

Name:	00000020.00000003.18191917491.00000296E41FD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41FD000
Size:	12288

Details

Name:	0000001D.00000002.19667346914.00007FF5EC157000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC157000
Size:	4096

Details

Name:	00000001.00000003.14623508459.000002DEA1E24000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E24000
Size:	65536

Details

Name:	00000001.00000003.14708595869.000002DEA1706000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1706000
Size:	24576

Details

Name:	00000026.00000003.18304158043.00000138BE20A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE20A000
Size:	266240

Details

Name:	00000001.00000003.14709793758.000002DE9F59C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F59C000
Size:	274432

Details

Name:	0000002A.00000002.18540701880.0000002A4ACEB000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A4ACEB000
Size:	20480

Details

Name:	00000001.00000003.14622553510.000002DEA1EA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA2000
Size:	102400

Details

Name:	00000026.00000003.18337156957.00000138BDBDA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDBDA000
Size:	4096

Details

Name:	00000020.00000003.18159807736.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000020.00000003.18244456321.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	57344

Details

Name:	00000001.00000002.14720062074.000002DEA1410000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1410000
Size:	4096

Details

Name:	00000020.00000003.18202763340.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000020.00000003.18188425664.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000026.00000000.18230361914.00007DF5CF142000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5CF142000
Size:	4096

Details

Name:	00000020.00000002.19674753429.00007FF4FE50C000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE50C000
Size:	16384

Details

Name:	00000020.00000003.18138904171.00000296E3EA0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EA0000
Size:	12288

Details

Name:	00000020.00000003.18159124092.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000005.00000002.15125456808.00000000001F0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1F0000
Size:	4096

Details

Name:	0000002D.00000000.18669343525.00007DF5B99E0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99E0000
Size:	4096

Details

Name:	00000005.00000002.15125707671.0000000000420000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	420000
Size:	4096

Details

Name:	00000001.00000002.14721983855.00007FF4F84B5000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84B5000
Size:	4096

Details

Name:	00000028.00000002.18524428263.00007FF52F962000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52F962000
Size:	12288

Details

Name:	00000020.00000002.19669785003.00000296DEBF9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBF9000
Size:	28672

Details

Name:	00000012.00000002.19668907990.00007FF5676DD000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676DD000
Size:	8192

Details

Name:	0000002D.00000003.18682683256.000001A8F8CBF000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBF000
Size:	262144

Details

Name:	00000026.00000003.18292082098.00000138BDF35000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF35000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May enable test signing (to load unsigned drivers)	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	0000000D.00000002.19667826356.0000000003620000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	3620000
Size:	323584

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery

Details

Name:	00000005.00000002.15125507044.000000000026A000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26A000
Size:	4096

Details

Name:	00000026.00000003.18292961558.00000138BD5A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5A8000
Size:	266240

Details

Name:	00000001.00000003.14644651601.000002DEA15D8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D8000
Size:	163840

Details

Name:	00000026.00000003.18326492976.00000138BE3E0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE3E0000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18174645813.00000296E4424000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4424000
Size:	233472

Details

Name:	00000020.00000003.18217958406.00000296E4472000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4472000
Size:	122880

Details

Name:	00000028.00000002.18523903412.00000215F7D40000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	215F7D40000
Size:	4096

Details

Name:	00000026.00000003.18339634370.00000138BD24F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD24F000
Size:	139264

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19675773222.00007FF4FEAC1000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEAC1000
Size:	16384

Details

Name:	00000026.00000003.18408962794.00000138BD8A1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8A1000
Size:	65536

Details

Name:	00000001.00000002.14717719870.000002DE9F4D1000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F4D1000
Size:	12288

Details

Name:	00000026.00000003.18342149722.00000138BDE2C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE2C000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.14717649011.000002DE9F4B0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F4B0000
Size:	4096

Details

Name:	00000012.00000002.19667092254.000001CCB1577000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1577000
Size:	12288

Details

Name:	00000020.00000003.18203863561.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000026.00000003.18307192462.00000138BE9DD000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE9DD000
Size:	49152

Details

Name:	00000005.00000003.14742991266.00000000004C4000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	4C4000
Size:	8192

Details

Name:	00000001.00000003.14639956433.000002DEA1C25000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C25000
Size:	32768

Details

Name:	00000001.00000003.14714748428.000002DEA159B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159B000
Size:	126976

Details

Name:	0000001D.00000002.19666077497.00007FF5EB42D000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EB42D000
Size:	28672

Details

Name:	00000001.00000003.14641916518.000002DEA15C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C4000
Size:	20480

Details

Name:	00000005.00000002.15125411347.00000000001D0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D0000
Size:	4096

Details

Name:	00000026.00000003.18337288122.00000138BDCB4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCB4000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18323778141.00000138BDB7E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB7E000
Size:	36864

Details

Name:	00000020.00000003.18138822495.00000296E3E9A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E9A000
Size:	4096

Details

Name:	0000000D.00000002.19662423408.00000000028D0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28D0000
Size:	16384

Details

Name:	0000002C.00000003.18645927750.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	49152

Details

Name:	0000002D.00000002.19665560767.00007FF5AFAB6000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAB6000
Size:	8192

Details

Name:	00000020.00000002.19676806105.00007FF4FEC3C000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC3C000
Size:	8192

Details

Name:	00000001.00000003.14635790762.000002DEA1702000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1702000
Size:	28672

Details

Name:	00000026.00000003.18341846775.00000138BCF56000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF56000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000003.18660432787.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	53248

Details

Name:	00000026.00000003.18342454697.00000138BDE6E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE6E000
Size:	4096

Details

Name:	00000001.00000003.14633940613.000002DEA1BFF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BFF000
Size:	45056

Details

Name:	00000020.00000003.18203117810.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000001.00000002.14721123892.00007FF4E0F3B000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4E0F3B000
Size:	4096

Details

Name:	00000026.00000003.18290876432.00000138BE187000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE187000
Size:	229376

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14612995184.000002DEA146D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA146D000
Size:	114688

Details

Name:	0000001D.00000002.19661637904.0000019F0BDF0000.00000004.00000020.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	19F0BDF0000
Size:	12288

Details

Name:	00000001.00000003.14647643459.000002DEA1FB3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB3000
Size:	8192

Details

Name:	00000020.00000003.18139559912.00000296E3E6C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E6C000
Size:	4096

Details

Name:	00000020.00000003.18138430815.00000296E3E7A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E7A000
Size:	8192

Details

Name:	00000026.00000003.18296654379.00000138BE355000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE355000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
URLs found in memory or binary data	Networking

Details

Name:	0000000D.00000002.19660346104.0000000000900000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	900000
Size:	4096

Details

Name:	0000002A.00000003.18538051461.0000022796F20000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F20000
Size:	16384

Details

Name:	0000002A.00000003.18536685587.0000022796F07000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F07000
Size:	12288

Details

Name:	00000020.00000003.18246137538.00000296E4446000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4446000
Size:	94208

Details

Name:	0000002A.00000002.18543029864.00007FF5C7E6E000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E6E000
Size:	24576

Details

Name:	0000002C.00000002.19664992010.00007FF6A370E000.00000004.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF6A370E000
Size:	12288

Details

Name:	0000002A.00000000.18526079793.00000227965F0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	227965F0000
Size:	118784

Details

Name:	00000026.00000003.18418022047.00000138BCA49000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA49000
Size:	4096

Details

Name:	0000002A.00000002.18542184652.00007FF5C72BE000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C72BE000
Size:	28672

Details

Name:	0000001D.00000002.19666811487.00007FF5EC016000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC016000
Size:	4096

Details

Name:	0000001D.00000002.19666689767.00007FF5EBE22000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBE22000
Size:	8192

Details

Name:	00000020.00000003.18219396571.00000296E41D5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41D5000
Size:	16384

Details

Name:	0000002C.00000003.18666910074.0000016FFD215000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD215000
Size:	36864

Details

Name:	00000001.00000003.14642946867.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	4096

Details

Name:	00000001.00000003.14715953767.000002DEA1BAE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BAE000
Size:	28672

Details

Name:	00000020.00000003.18204602534.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000001.00000003.14634036055.000002DEA1C3F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3F000
Size:	69632

Details

Name:	00000001.00000002.14721011038.00007DF502410000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502410000
Size:	4096

Details

Name:	00000001.00000002.14720822571.000002DEA1E68000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E68000
Size:	4096

Details

Name:	00000020.00000003.18146620235.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000012.00000002.19669182673.00007FF56770E000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56770E000
Size:	24576

Details

Name:	00000001.00000002.14722842596.00007FF4F855E000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F855E000
Size:	24576

Details

Name:	00000001.00000003.14642913220.000002DEA1BE0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE0000
Size:	12288

Details

Name:	00000028.00000003.18521598034.00000215F83CE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83CE000
Size:	8192

Details

Name:	00000028.00000003.18522270187.00000215F838A000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F838A000
Size:	4096

Details

Name:	0000002A.00000002.18542030392.00007DF5D1D22000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D22000
Size:	4096

Details

Name:	00000025.00000002.18579353411.00007DF573540000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573540000
Size:	12288

Details

Name:	0000002C.00000003.18663599046.0000016FFD240000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD240000
Size:	61440

Details

Name:	00000005.00000003.14742869383.000000001C401000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1C401000
Size:	49152

Details

Name:	0000002C.00000002.19663090077.00007FF50B3E4000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B3E4000
Size:	8192

Details

Name:	00000025.00000003.18229394414.0000021B53ABF000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53ABF000
Size:	8192

Details

Name:	0000002C.00000003.18655333927.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	24576

Details

Name:	00000005.00000002.15125316791.000000000019B000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19B000
Size:	20480

Details

Name:	00000001.00000003.14715321293.000002DE9F5CD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5CD000
Size:	8192

Details

Name:	0000001D.00000002.19661580861.0000019F0BDD0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BDD0000
Size:	4096

Details

Name:	00000001.00000003.14623854276.000002DEA1DEE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DEE000
Size:	24576

Details

Name:	00000028.00000003.18521829422.00000215F839F000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F839F000
Size:	20480

Details

Name:	00000020.00000003.18219305204.00000296E41C9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41C9000
Size:	8192

Details

Name:	00000001.00000003.14622216376.000002DEA1E55000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E55000
Size:	69632

Details

Name:	00000001.00000003.14643282770.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	00000026.00000003.18302686558.00000138BD62C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD62C000
Size:	266240

Details

Name:	0000002D.00000002.19667784619.00007FF7B5857000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B5857000
Size:	139264

Details

Name:	00000012.00000002.19664867431.000001CCB0D02000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0D02000
Size:	12288

Details

Name:	00000028.00000002.18525093253.00007FF52FB20000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB20000
Size:	4096

Details

Name:	0000002A.00000003.18538654146.0000022796F6B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F6B000
Size:	8192

Details

Name:	00000001.00000003.14642245787.000002DEA1BBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BBC000
Size:	159744

Details

Name:	0000002C.00000003.18662693706.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000020.00000002.19666738977.00000296DEB00000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB00000
Size:	73728

Details

Name:	00000028.00000003.18518165953.00000215F83B7000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B7000
Size:	12288

Details

Name:	00000028.00000003.18518202860.00000215F83ED000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83ED000
Size:	196608

Details

Name:	00000012.00000002.19669014301.00007FF567700000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567700000
Size:	24576

Details

Name:	0000002D.00000001.18671018694.00007FF7B57C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B57C0000
Size:	4096

Details

Name:	00000001.00000003.14626014031.000002DEA1F4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F4E000
Size:	69632

Details

Name:	00000020.00000002.19674438581.00007FF4FDD43000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FDD43000
Size:	16384

Details

Name:	0000002D.00000002.19663089091.000001A8F8CB1000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8CB1000
Size:	36864

Details

Name:	00000001.00000003.14645094108.000002DEA1FB2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB2000
Size:	12288

Details

Name:	00000020.00000002.19665038150.00000296DE29E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE29E000
Size:	24576

Details

Name:	00000001.00000003.14626470141.000002DEA1F3C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F3C000
Size:	69632

Details

Name:	0000002A.00000003.18540084799.0000022796E6A000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E6A000
Size:	4096

Details

Name:	00000001.00000002.14720082326.000002DEA1510000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1510000
Size:	4096

Details

Name:	0000001D.00000002.19661124680.0000019F0BDA0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BDA0000
Size:	118784

Details

Name:	00000026.00000003.18321988478.00000138BDE2C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE2C000
Size:	184320

Details

Name:	00000001.00000002.14718473872.000002DE9F5AA000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5AA000
Size:	53248

Details

Name:	00000001.00000003.14639871910.000002DEA1C76000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C76000
Size:	69632

Details

Name:	00000026.00000003.18301491987.00000138BE732000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE732000
Size:	4096

Details

Name:	00000001.00000003.14628922157.000002DEA15D3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D3000
Size:	20480

Details

Name:	00000020.00000003.18219939251.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000003.18231083986.00000296E443E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E443E000
Size:	24576

Details

Name:	00000001.00000003.14634139804.000002DEA1C63000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C63000
Size:	69632

Details

Name:	00000001.00000002.14721722939.00007FF4F8439000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8439000
Size:	4096

Details

Name:	00000001.00000003.14613712160.000002DEA1434000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1434000
Size:	32768

Details

Name:	00000001.00000003.14641782512.000002DEA1D3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D3E000
Size:	20480

Details

Name:	00000020.00000003.18215142872.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000001.00000003.14631066754.000002DEA17F9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17F9000
Size:	90112

Details

Name:	00000001.00000003.14627078425.000002DEA1F4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F4E000
Size:	69632

Details

Name:	00000020.00000003.18233563502.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	57344

Details

Name:	00000020.00000003.18232979844.00000296E4443000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4443000
Size:	36864

Details

Name:	00000001.00000003.14632866622.000002DEA1BE0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE0000
Size:	122880

Details

Name:	00000001.00000003.14613131166.000002DEA1495000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1495000
Size:	32768

Details

Name:	0000002D.00000000.18669639885.00007FF7B57C1000.00000020.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF7B57C1000
Size:	614400

Details

Name:	0000002A.00000002.18542743074.00007FF5C7E15000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E15000
Size:	12288

Details

Name:	00000026.00000003.18313767816.00000138BE892000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE892000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.14716772998.000000EDDB4F9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDB4F9000
Size:	28672

Details

Name:	00000026.00000003.18355861504.00000138BCFDA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCFDA000
Size:	4096

Details

Name:	00000001.00000003.14623976282.000002DEA1E38000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E38000
Size:	40960

Details

Name:	00000026.00000003.18303554710.00000138BE851000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE851000
Size:	49152

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000000D.00000002.19668686504.0000000004A30000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	4A30000
Size:	12288

Details

Name:	00000001.00000003.14620755446.000002DEA1DA9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DA9000
Size:	69632

Details

Name:	00000020.00000003.18232727740.00000296E40A6000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40A6000
Size:	53248

Details

Name:	00000020.00000003.18220182961.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000028.00000002.18524101933.00007DF539A00000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A00000
Size:	4096

Details

Name:	00000001.00000003.14615457805.000002DE9F5A9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A9000
Size:	16384

Details

Name:	00000026.00000003.18353310052.00000138BD7FA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD7FA000
Size:	4096

Details

Name:	00000001.00000003.14636953613.000002DEA1CAB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CAB000
Size:	573440

Details

Name:	0000002A.00000003.18538480850.0000022796F03000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F03000
Size:	16384

Details

Name:	00000026.00000000.18230527857.00007FF78E7E1000.00000020.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF78E7E1000
Size:	614400

Details

Name:	00000028.00000002.18525191605.00007FF52FB47000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB47000
Size:	12288

Details

Name:	00000012.00000000.18108324591.00007DF5715D0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715D0000
Size:	4096

Details

Name:	00000001.00000003.14623656926.000002DEA1E91000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E91000
Size:	65536

Details

Name:	00000001.00000003.14630628624.000002DEA17BF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17BF000
Size:	57344

Details

Name:	0000002A.00000002.18541990072.00007DF5D1D20000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D20000
Size:	4096

Details

Name:	0000002C.00000003.18642843418.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	53248

Details

Name:	00000028.00000003.18519331703.00000215F83EE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83EE000
Size:	16384

Details

Name:	00000001.00000003.14712384388.000002DEA157A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA157A000
Size:	4096

Details

Name:	00000020.00000003.18251641486.00000296E41BB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41BB000
Size:	24576

Details

Name:	00000012.00000002.19667661600.00007FF566A8E000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF566A8E000
Size:	20480

Details

Name:	00000020.00000002.19673612444.00000296E41C2000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41C2000
Size:	94208

Details

Name:	00000020.00000002.19661518045.000000B135CF9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B135CF9000
Size:	28672

Details

Name:	00000001.00000003.14626782342.000002DEA1E69000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E69000
Size:	131072

Details

Name:	0000002C.00000003.18657213222.0000016FFD23C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23C000
Size:	24576

Details

Name:	0000001D.00000002.19661759429.0000019F0BEF0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BEF0000
Size:	4096

Details

Name:	00000001.00000003.14715634353.000002DEA1F98000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F98000
Size:	4096

Details

Name:	0000001D.00000002.19667686428.00007FF5EC1E9000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC1E9000
Size:	4096

Details

Name:	00000020.00000003.18138796946.00000296E3E98000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E98000
Size:	4096

Details

Name:	00000020.00000002.19671666721.00000296E4000000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4000000
Size:	73728

Details

Name:	00000020.00000003.18195772789.00000296E41FE000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41FE000
Size:	8192

Details

Name:	0000002C.00000003.18645347654.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	24576

Details

Name:	00000020.00000003.18162142798.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000002.19672205039.00000296E4060000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4060000
Size:	4096

Details

Name:	0000001D.00000002.19666623691.00007FF5EBD71000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBD71000
Size:	4096

Details

Name:	00000026.00000003.18319758664.00000138BE6A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6A8000
Size:	20480

Details

Name:	0000002C.00000003.18649980239.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	0000002C.00000003.18626165884.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	262144

Details

Name:	0000001D.00000002.19666252918.00007FF5EB95D000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EB95D000
Size:	32768

Details

Name:	00000012.00000002.19665791066.000001CCB1402000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1402000
Size:	4096

Details

Name:	00000025.00000002.18578661091.0000021B53A40000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A40000
Size:	12288

Details

Name:	00000020.00000003.18187926700.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000001.00000002.14721149050.00007FF4F7ABE000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7ABE000
Size:	4096

Details

Name:	00000020.00000003.18138077816.00000296E3E67000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E67000
Size:	4096

Details

Name:	0000002C.00000000.18613683801.00007FF4EFE9B000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4EFE9B000
Size:	4096

Details

Name:	00000001.00000002.14721580749.00007FF4F83AB000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F83AB000
Size:	16384

Details

Name:	00000026.00000003.18291128662.00000138BE1C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1C2000
Size:	16384

Details

Name:	00000020.00000003.18161037961.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	0000002C.00000003.18646826293.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	65536

Details

Name:	00000020.00000002.19677009372.00007FF4FEC55000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC55000
Size:	8192

Details

Name:	00000026.00000003.18299375326.00000138BDEF2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEF2000
Size:	266240

Details

Name:	0000002D.00000003.18692451479.000001A8F8CC7000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC7000
Size:	61440

Details

Name:	0000002A.00000003.18539491456.0000022796F17000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F17000
Size:	36864

Details

Name:	0000002C.00000003.18647408991.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	57344

Details

Name:	0000002D.00000003.18690631794.000001A8F8CD2000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CD2000
Size:	245760

Details

Name:	0000002A.00000002.18540904847.00000227965F0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	227965F0000
Size:	118784

Details

Name:	0000002D.00000003.18678616312.000001A8F8CBA000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBA000
Size:	32768

Details

Name:	00000001.00000003.14648044296.000002DEA200F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200F000
Size:	4096

Details

Name:	00000026.00000003.18277159412.00000138AA7A9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7A9000
Size:	36864

Details

Name:	00000001.00000002.14716844031.000000EDDB5FE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDB5FE000
Size:	8192

Details

Name:	00000028.00000002.18524042368.00007DF4378C0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4378C0000
Size:	20480

Details

Name:	00000012.00000000.18108380466.00007DF5715D2000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715D2000
Size:	4096

Details

Name:	0000001D.00000002.19660910677.00000048D1D7E000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	48D1D7E000
Size:	8192

Details

Name:	0000001D.00000003.18434493543.0000019F0C09A000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C09A000
Size:	4096

Details

Name:	00000028.00000002.18523515689.00000215F7BA0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7BA0000
Size:	4096

Details

Name:	0000002A.00000003.18540206912.0000022796EE0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EE0000
Size:	28672

Details

Name:	00000028.00000003.18520280744.00000215F8385000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8385000
Size:	12288

Details

Name:	00000012.00000002.19665270524.000001CCB11B0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB11B0000
Size:	4096

Details

Name:	00000026.00000003.18339963270.00000138BD2D2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD2D2000
Size:	262144

Details

Name:	00000026.00000003.18429216145.00000138BD7FA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD7FA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000025.00000003.18220226409.0000021B53D40000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53D40000
Size:	65536

Details

Name:	0000002C.00000003.18642090123.0000016FFD22E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22E000
Size:	65536

Details

Name:	0000002C.00000003.18662838916.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	0000002D.00000002.19665789074.00007FF5AFADE000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFADE000
Size:	12288

Details

Name:	00000005.00000002.15125728890.000000000049E000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	49E000
Size:	8192

Details

Name:	00000001.00000003.14640644895.000002DEA1D38000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D38000
Size:	4096

Details

Name:	00000026.00000003.18277446687.00000138AA787000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA787000
Size:	65536

Details

Name:	00000028.00000003.18520147143.00000215F83A9000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A9000
Size:	4096

Details

Name:	00000001.00000003.14623896045.000002DEA1DFB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DFB000
Size:	12288

Details

Name:	00000001.00000003.14712585243.000002DE9F5A2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A2000
Size:	86016

Details

Name:	0000001D.00000002.19666352859.00007FF5EB966000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EB966000
Size:	36864

Details

Name:	00000001.00000002.14720841419.000002DEA1F90000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F90000
Size:	4096

Details

Name:	00000020.00000003.18158619914.00000296E4403000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4403000
Size:	233472

Details

Name:	00000001.00000003.14626366072.000002DEA1F2A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F2A000
Size:	69632

Details

Name:	00000020.00000003.18191389213.00000296E443F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E443F000
Size:	122880

Details

Name:	0000000D.00000002.19667368579.0000000003290000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	3290000
Size:	32768

Details

Name:	0000000D.00000000.14857939986.000000007F760000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F760000
Size:	12288

Details

Name:	00000020.00000002.19661708415.000000B135EFD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B135EFD000
Size:	12288

Details

Name:	00000025.00000002.18578724427.0000021B53A70000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A70000
Size:	4096

Details

Name:	0000001D.00000002.19667293697.00007FF5EC155000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC155000
Size:	4096

Details

Name:	00000026.00000003.18333498606.00000138BCD46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD46000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000003.18187505122.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000001.00000003.14623277408.000002DEA1E0F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E0F000
Size:	151552

Details

Name:	00000001.00000003.14634449012.000002DEA1BE4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE4000
Size:	40960

Details

Name:	00000001.00000003.14638825977.000002DEA16B6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B6000
Size:	282624

Details

Name:	0000002D.00000002.19668279163.00007FF7B587C000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B587C000
Size:	28672

Details

Name:	00000012.00000002.19668140009.00007FF56767C000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56767C000
Size:	8192

Details

Name:	00000020.00000003.18139355621.00000296E3F70000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F70000
Size:	4096

Details

Name:	00000001.00000003.14629691021.000002DEA17CD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17CD000
Size:	81920

Details

Name:	0000002D.00000000.18670521946.00007FF7B5857000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B5857000
Size:	139264

Details

Name:	00000001.00000003.14643943451.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	00000020.00000002.19673869945.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	24576

Details

Name:	0000000D.00000002.19665461719.0000000003080000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3080000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	0000002C.00000003.18663408882.0000016FFD240000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD240000
Size:	24576

Details

Name:	00000001.00000003.14645141978.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	00000001.00000003.14612883239.000002DEA1489000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1489000
Size:	81920

Details

Name:	00000028.00000003.18520330475.00000215F838A000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F838A000
Size:	20480

Details

Name:	00000001.00000003.14708674409.000002DEA170E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170E000
Size:	286720

Details

Name:	0000002C.00000003.18634017309.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	110592

Details

Name:	00000005.00000002.15127231146.0000000002A50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A50000
Size:	20480

Details

Name:	00000012.00000002.19667831155.00007FF566CD8000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF566CD8000
Size:	4096

Details

Name:	0000000D.00000002.19665317313.0000000002E2D000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2E2D000
Size:	8192

Details

Name:	00000001.00000003.14640707009.000002DEA1BE3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE3000
Size:	45056

Details

Name:	00000020.00000002.19671033868.00000296E3D90000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3D90000
Size:	4096

Details

Name:	00000012.00000002.19669109429.00007FF567707000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567707000
Size:	12288

Details

Name:	0000002A.00000003.18537122900.0000022796F34000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F34000
Size:	36864

Details

Name:	00000001.00000003.14644969537.000002DEA1F92000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F92000
Size:	20480

Details

Name:	00000020.00000003.18202689415.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000026.00000003.18309839037.00000138BE5D9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5D9000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14613545225.000002DEA143C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA143C000
Size:	16384

Details

Name:	00000005.00000002.15126261174.00000000007EF000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7EF000
Size:	4096

Details

Name:	00000012.00000002.19667168923.00007DF46F480000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF46F480000
Size:	20480

Details

Name:	0000001D.00000002.19662046067.0000019F0BF60000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0BF60000
Size:	4096

Details

Name:	00000001.00000003.14622757097.000002DEA1E55000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E55000
Size:	69632

Details

Name:	00000020.00000003.18203691741.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	0000001D.00000002.19668474533.00007FF5EC280000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC280000
Size:	20480

Details

Name:	0000002C.00000003.18639829017.0000016FFD226000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD226000
Size:	131072

Details

Name:	00000020.00000002.19673824164.00000296E4400000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4400000
Size:	4096

Details

Name:	0000001D.00000002.19669383761.00007FF5EC307000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC307000
Size:	12288

Details

Name:	0000002C.00000003.18659868306.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	53248

Details

Name:	00000001.00000003.14640230753.000002DEA1C76000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C76000
Size:	69632

Details

Name:	0000000D.00000002.19663596594.00000000029E5000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29E5000
Size:	32768

Details

Name:	00000028.00000003.18522668973.00000215F8384000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8384000
Size:	4096

Details

Name:	00000026.00000003.18296356390.00000138BE0C0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE0C0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Contains functionality to query the security center for anti-virus and firewall products	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000005.00000002.15127340401.0000000002BF0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2BF0000
Size:	8192

Details

Name:	00000020.00000003.18232237931.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	57344

Details

Name:	00000020.00000003.18204216778.00000296E4410000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4410000
Size:	73728

Details

Name:	00000001.00000003.14647010008.000002DEA1C88000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C88000
Size:	4096

Details

Name:	0000001D.00000002.19662178260.0000019F0C000000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C000000
Size:	73728

Details

Name:	00000020.00000003.18172536153.00000296E41A8000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41A8000
Size:	12288

Details

Name:	00000028.00000000.18508884209.00000215F7A80000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7A80000
Size:	118784

Details

Name:	00000028.00000002.18524386809.00007FF52EFA7000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52EFA7000
Size:	4096

Details

Name:	00000020.00000003.18204794103.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	0000002A.00000002.18541818146.00000227968D0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	227968D0000
Size:	4096

Details

Name:	00000026.00000003.18356873738.00000138BDCB4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCB4000
Size:	184320

Details

Name:	0000002A.00000003.18540051104.0000022796E67000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E67000
Size:	8192

Details

Name:	0000002A.00000003.18536161497.0000022796F0A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F0A000
Size:	405504

Details

Name:	00000001.00000003.14621563420.000002DEA1DF4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DF4000
Size:	106496

Details

Name:	0000002A.00000002.18540755791.0000002A4AD6E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A4AD6E000
Size:	8192

Details

Name:	00000020.00000003.18221076715.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000026.00000003.18345323936.00000138BCE0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE0C000
Size:	4096

Details

Name:	0000002C.00000000.18613831944.00007FF6A36D1000.00000020.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF6A36D1000
Size:	188416

Details

Name:	00000026.00000003.18357803120.00000138BE312000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE312000
Size:	4096

Details

Name:	00000020.00000003.18216038672.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	0000002C.00000003.18659195503.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	65536

Details

Name:	0000002D.00000003.18682358776.000001A8F8CBF000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBF000
Size:	110592

Details

Name:	00000025.00000002.18579294828.00007DF573530000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573530000
Size:	4096

Details

Name:	00000020.00000002.19663037777.00000296DE200000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE200000
Size:	73728

Details

Name:	00000005.00000002.15127369048.0000000002BF4000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2BF4000
Size:	8192

Details

Name:	0000002C.00000002.19663494370.00007FF50B65B000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B65B000
Size:	4096

Details

Name:	00000020.00000003.18216540967.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000020.00000002.19675836051.00007FF4FEAC7000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEAC7000
Size:	4096

Details

Name:	0000002C.00000003.18656360392.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	0000002D.00000002.19660764120.000000938AE7E000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	938AE7E000
Size:	8192

Details

Name:	00000001.00000003.14640312183.000002DEA1C52000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C52000
Size:	69632

Details

Name:	00000005.00000002.15126628009.00000000021F0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	21F0000
Size:	4096

Details

Name:	00000001.00000003.14642789944.000002DEA15A2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A2000
Size:	12288

Details

Name:	00000026.00000003.18356318960.00000138BCF98000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF98000
Size:	4096

Details

Name:	00000020.00000002.19660946421.000000B1354FF000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1354FF000
Size:	4096

Details

Name:	00000026.00000003.18251884113.00000138ADA76000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADA76000
Size:	610304

Details

Name:	00000025.00000000.18201000447.0000021B53A20000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A20000
Size:	118784

Details

Name:	00000001.00000003.14625219578.000002DEA1F07000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F07000
Size:	65536

Details

Name:	0000002D.00000002.19663732375.000001A8F8FC5000.00000004.00000040.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1A8F8FC5000
Size:	4096

Details

Name:	00000020.00000003.18188630972.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000001.00000003.14615413126.000002DE9F5BC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5BC000
Size:	32768

Details

Name:	00000020.00000003.18232585823.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	122880

Details

Name:	0000002C.00000003.18652555188.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	53248

Details

Name:	00000020.00000003.18161940788.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	4096

Details

Name:	00000001.00000003.14644246649.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	00000001.00000003.14638306311.000002DEA1D39000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D39000
Size:	40960

Details

Name:	00000001.00000003.14710792713.000002DEA16DA000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16DA000
Size:	20480

Details

Name:	00000020.00000002.19667556472.00000296DEB45000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB45000
Size:	53248

Details

Name:	00000020.00000002.19675365444.00007FF4FE99B000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE99B000
Size:	8192

Details

Name:	00000020.00000003.18160497103.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000026.00000003.18310798250.00000138BDEB0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEB0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14630873535.000002DEA17C8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17C8000
Size:	20480

Details

Name:	00000025.00000003.18223187995.0000021B53AC1000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AC1000
Size:	12288

Details

Name:	00000001.00000003.14714896574.000002DEA15BD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BD000
Size:	16384

Details

Name:	00000020.00000003.18219810221.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	0000002C.00000002.19663427090.00007FF50B650000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B650000
Size:	20480

Details

Name:	00000025.00000003.18228989714.0000021B53AC4000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AC4000
Size:	262144

Details

Name:	00000001.00000003.14644898672.000002DEA1BCC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BCC000
Size:	12288

Details

Name:	0000002A.00000003.18539135306.0000022796F4C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F4C000
Size:	36864

Details

Name:	0000002D.00000002.19663794008.000001A8F8FD0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8FD0000
Size:	8192

Details

Name:	00000020.00000002.19673445996.00000296E41B5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B5000
Size:	8192

Details

Name:	0000002C.00000002.19662784031.00007DF5155A0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155A0000
Size:	4096

Details

Name:	0000002D.00000003.18684689440.000001A8F8CC2000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC2000
Size:	61440

Details

Name:	00000020.00000003.18162042024.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000020.00000003.18139296038.00000296E3EC1000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EC1000
Size:	12288

Details

Name:	00000020.00000002.19663955143.00000296DE24D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE24D000
Size:	12288

Details

Name:	00000001.00000003.14640825001.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	4096

Details

Name:	00000012.00000000.18108269836.00007DF5715C2000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715C2000
Size:	4096

Details

Name:	00000020.00000003.18215365429.00000296DEBA7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA7000
Size:	16384

Details

Name:	0000002D.00000002.19665992402.00007FF5AFAED000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAED000
Size:	8192

Details

Name:	0000001D.00000002.19668137650.00007FF5EC26C000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC26C000
Size:	12288

Details

Name:	0000002A.00000002.18542249311.00007FF5C72C7000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C72C7000
Size:	4096

Details

Name:	00000001.00000003.14630578318.000002DEA15D3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D3000
Size:	20480

Details

Name:	00000012.00000002.19666855644.000001CCB155F000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB155F000
Size:	20480

Details

Name:	0000002A.00000002.18542574842.00007FF5C7DF5000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DF5000
Size:	8192

Details

Name:	00000026.00000003.18309912138.00000138BE5E8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5E8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000003.18662117110.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	61440

Details

Name:	00000001.00000002.14720955616.000002DEA200F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200F000
Size:	4096

Details

Name:	00000020.00000002.19662863683.00000296DE1C0000.00000004.00000040.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	296DE1C0000
Size:	4096

Details

Name:	00000020.00000003.18232891114.00000296E442D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E442D000
Size:	69632

Details

Name:	00000005.00000002.15126964472.00000000022B9000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	22B9000
Size:	24576

Details

Name:	00000001.00000003.14715892430.000002DEA1BA0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BA0000
Size:	53248

Details

Name:	0000002C.00000003.18660816229.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	0000002C.00000002.19660908938.0000016FFD150000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD150000
Size:	118784

Details

Name:	00000026.00000003.18349915016.00000138BD2D2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD2D2000
Size:	262144

Details

Name:	0000002A.00000000.18526402294.00007FF5C7E6F000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E6F000
Size:	20480

Details

Name:	00000001.00000002.14722174995.00007FF4F84D0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84D0000
Size:	20480

Details

Name:	00000020.00000003.18138133028.00000296E3E69000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E69000
Size:	4096

Details

Name:	0000002C.00000003.18647302820.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	28672

Details

Name:	00000026.00000003.18358227094.00000138BD20C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD20C000
Size:	77824

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14639478763.000002DEA175B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA175B000
Size:	28672

Details

Name:	00000028.00000002.18524730721.00007FF52FAD0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAD0000
Size:	4096

Details

Name:	00000020.00000003.18138593203.00000296E3E8A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E8A000
Size:	4096

Details

Name:	00000020.00000000.18136577797.00007DF508BA0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508BA0000
Size:	12288

Details

Name:	00000020.00000003.18233956649.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	122880

Details

Name:	0000002C.00000003.18645727224.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	57344

Details

Name:	00000026.00000003.18254290976.00000138ADCB4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCB4000
Size:	4096

Details

Name:	00000001.00000003.14629034407.000002DEA15CC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15CC000
Size:	20480

Details

Name:	00000026.00000003.18257973821.00000138AE116000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AE116000
Size:	10485760

Details

Name:	00000020.00000003.18172010181.00000296E416E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E416E000
Size:	20480

Details

Name:	00000001.00000003.14628144968.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	00000001.00000003.14628444003.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	00000020.00000003.18217923146.00000296E4456000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4456000
Size:	4096

Details

Name:	00000001.00000003.14640145649.000002DEA1C64000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C64000
Size:	69632

Details

Name:	00000020.00000002.19674875593.00007FF4FE553000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE553000
Size:	20480

Details

Name:	00000001.00000003.14621043001.000002DEA1DE7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DE7000
Size:	159744

Details

Name:	00000020.00000003.18191545529.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	0000001D.00000002.19664509013.0000019F0C100000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C100000
Size:	4096

Details

Name:	00000012.00000002.19662993261.000001CCB0C58000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C58000
Size:	90112

Details

Name:	0000002A.00000002.18542653372.00007FF5C7E09000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E09000
Size:	16384

Details

Name:	0000000D.00000002.19665540839.0000000003090000.00000002.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page readonly
Base address:	3090000
Size:	4096

Details

Name:	00000025.00000002.18579724965.00007FF5695F5000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5695F5000
Size:	8192

Details

Name:	00000012.00000002.19661368905.000001CCB0AA0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0AA0000
Size:	12288

Details

Name:	0000002C.00000003.18656997162.0000016FFD23A000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23A000
Size:	28672

Details

Name:	00000026.00000003.18343431298.00000138BE102000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE102000
Size:	167936

Details

Name:	00000020.00000003.18162003018.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000001.00000003.14633686865.000002DEA1C52000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C52000
Size:	65536

Details

Name:	00000025.00000000.18201454045.00007FF56966F000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56966F000
Size:	20480

Details

Name:	00000020.00000002.19664300934.00000296DE274000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE274000
Size:	4096

Details

Name:	00000005.00000002.15126097366.0000000000613000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	613000
Size:	143360

Details

Name:	00000005.00000002.15125477638.0000000000266000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	266000
Size:	12288

Details

Name:	0000000D.00000002.19666716558.00000000031DD000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	31DD000
Size:	131072

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000003.18139094501.00000296E3EB1000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EB1000
Size:	4096

Details

Name:	00000001.00000003.14641717058.000002DEA1D3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D3E000
Size:	20480

Details

Name:	00000001.00000003.14624694264.000002DEA1EAB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EAB000
Size:	65536

Details

Name:	0000000D.00000002.19662741140.0000000002982000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2982000
Size:	12288

Details

Name:	00000020.00000003.18147154486.00000296E4360000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4360000
Size:	4096

Details

Name:	00000020.00000003.18202979787.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	0000002D.00000002.19662988284.000001A8F8CAE000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8CAE000
Size:	8192

Details

Name:	00000020.00000003.18187359052.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	0000002D.00000003.18691240042.000001A8F8CD6000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CD6000
Size:	65536

Details

Name:	00000026.00000003.18352509630.00000138BD16D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD16D000
Size:	106496

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002C.00000003.18652995197.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	36864

Details

Name:	0000002C.00000003.18656665993.0000016FFD23A000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23A000
Size:	28672

Details

Name:	00000020.00000003.18189984067.00000296E443F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E443F000
Size:	122880

Details

Name:	00000020.00000002.19675884968.00007FF4FEADF000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEADF000
Size:	8192

Details

Name:	00000001.00000003.14621698839.000002DEA1DBB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DBB000
Size:	36864

Details

Name:	00000020.00000002.19673276215.00000296E4198000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4198000
Size:	69632

Details

Name:	00000001.00000002.14717018717.000000EDDBAFE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDBAFE000
Size:	8192

Details

Name:	0000002C.00000003.18630374954.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	258048

Details

Name:	0000002D.00000003.18679442573.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	258048

Details

Name:	00000020.00000003.18203953146.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000001.00000002.14717515178.000002DE9F410000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F410000
Size:	12288

Details

Name:	00000020.00000003.18173838204.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	0000002C.00000002.19660350205.0000006AB3F2C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6AB3F2C000
Size:	16384

Details

Name:	00000020.00000002.19676101734.00007FF4FEBA9000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBA9000
Size:	4096

Details

Name:	00000001.00000002.14717159337.000000EDDBEFF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDBEFF000
Size:	4096

Details

Name:	00000001.00000002.14722551852.00007FF4F8525000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8525000
Size:	20480

Details

Name:	0000002C.00000003.18648694683.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	69632

Details

Name:	00000001.00000003.14614023511.000002DEA14A4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14A4000
Size:	20480

Details

Name:	0000002C.00000003.18622817120.0000016FFD1C0000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD1C0000
Size:	180224

Details

Name:	00000020.00000003.18159616828.00000296E441E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E441E000
Size:	122880

Details

Name:	0000002D.00000002.19661411286.000001A8F8BE0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8BE0000
Size:	12288

Details

Name:	00000020.00000003.18185749018.00000296DEB9E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9E000
Size:	12288

Details

Name:	0000002C.00000002.19661368947.0000016FFD1A0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD1A0000
Size:	4096

Details

Name:	00000020.00000003.18202178923.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000001.00000003.14713492025.000002DEA1763000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1763000
Size:	4096

Details

Name:	0000000D.00000000.14857715011.00000000009E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	9E0000
Size:	8192

Details

Name:	00000025.00000002.18578697825.0000021B53A50000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A50000
Size:	4096

Details

Name:	00000028.00000002.18524862456.00007FF52FAE9000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAE9000
Size:	16384

Details

Name:	00000001.00000003.14621912122.000002DEA1E0F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E0F000
Size:	151552

Details

Name:	00000001.00000002.14721960008.00007FF4F84A8000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84A8000
Size:	4096

Details

Name:	00000001.00000003.14640565617.000002DEA1D27000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D27000
Size:	65536

Details

Name:	00000001.00000003.14647978601.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	00000020.00000003.18218701842.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000020.00000002.19666493584.00000296DE940000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE940000
Size:	4096

Details

Name:	00000001.00000002.14721031153.00007DF502412000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502412000
Size:	4096

Details

Name:	00000026.00000003.18328448717.00000138BD62C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD62C000
Size:	266240

Details

Name:	0000001D.00000002.19668065936.00007FF5EC267000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC267000
Size:	8192

Details

Name:	00000026.00000003.18314349341.00000138BD01D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD01D000
Size:	212992

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18190294388.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000001.00000003.14632119401.000002DEA160E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160E000
Size:	4096

Details

Name:	00000001.00000003.14642518565.000002DEA15AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AF000
Size:	45056

Details

Name:	0000000D.00000000.14857753538.0000000002A68000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A68000
Size:	20480

Details

Name:	0000001D.00000000.18133639590.00007DF5F61C0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61C0000
Size:	4096

Details

Name:	00000020.00000002.19674698835.00007FF4FE3AE000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE3AE000
Size:	4096

Details

Name:	0000002C.00000000.18613301057.00007DF515590000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF515590000
Size:	4096

Details

Name:	00000026.00000003.18330827201.00000138BE3D8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE3D8000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000001.00000003.14634421481.000002DEA1BE0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE0000
Size:	12288

Details

Name:	00000028.00000003.18520386543.00000215F83A4000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A4000
Size:	20480

Details

Name:	00000020.00000002.19672697736.00000296E4138000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4138000
Size:	102400

Details

Name:	0000002C.00000003.18650142304.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	00000028.00000003.18522176628.00000215F8387000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8387000
Size:	8192

Details

Name:	00000001.00000002.14717334523.000002DE9F3F0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F3F0000
Size:	118784

Details

Name:	00000026.00000003.18352319451.00000138BD147000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD147000
Size:	147456

Details

Name:	00000001.00000003.14633430892.000002DEA1C1B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C1B000
Size:	69632

Details

Name:	00000001.00000003.14620501670.000002DEA1D73000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D73000
Size:	69632

Details

Name:	00000012.00000002.19667318672.00007DF5715C2000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715C2000
Size:	4096

Details

Name:	00000026.00000003.18317377183.00000138BCA46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA46000
Size:	8192

Details

Name:	00000005.00000000.14652783023.000000007FFD0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFD0000
Size:	12288

Details

Name:	0000000D.00000002.19667740088.0000000003610000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	3610000
Size:	4096

Details

Name:	00000020.00000003.18174059373.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	20480

Details

Name:	00000020.00000003.18231443054.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	57344

Details

Name:	00000001.00000003.14614056920.000002DEA14B0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14B0000
Size:	36864

Details

Name:	0000001D.00000002.19669214221.00007FF5EC2DD000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2DD000
Size:	8192

Details

Name:	00000001.00000003.14631207425.000002DEA1606000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1606000
Size:	36864

Details

Name:	0000000D.00000002.19663173348.00000000029AE000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29AE000
Size:	24576

Details

Name:	0000002C.00000003.18660216035.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	65536

Details

Name:	00000001.00000002.14718133120.000002DE9F510000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F510000
Size:	24576

Details

Name:	00000020.00000003.18218432742.00000296E4457000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4457000
Size:	233472

Details

Name:	00000020.00000003.18190154980.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000012.00000002.19668546358.00007FF5676A9000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676A9000
Size:	16384

Details

Name:	00000020.00000002.19665873347.00000296DE313000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE313000
Size:	4096

Details

Name:	00000026.00000003.18316152404.00000138BDFFA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFFA000
Size:	266240

Details

Name:	0000002C.00000003.18646329115.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	28672

Details

Name:	00000005.00000002.15126014162.00000000005FE000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5FE000
Size:	61440

Details

Name:	0000000D.00000002.19661421679.0000000000B00000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	B00000
Size:	4096

Details

Name:	00000001.00000002.14720634022.000002DEA1BAE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BAE000
Size:	28672

Details

Name:	0000000D.00000000.14857836759.000000007F742000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F742000
Size:	4096

Details

Name:	00000005.00000002.15127027042.00000000022C0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	22C0000
Size:	8192

Details

Name:	0000002D.00000003.18685930952.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	61440

Details

Name:	0000002D.00000003.18680987080.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	90112

Details

Name:	00000001.00000000.14610633356.00007DF502420000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502420000
Size:	4096

Details

Name:	0000002A.00000003.18539744404.0000022796F1E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F1E000
Size:	8192

Details

Name:	00000020.00000003.18214990793.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000020.00000002.19666045575.00000296DE4D0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE4D0000
Size:	8192

Details

Name:	00000026.00000003.18295167449.00000138BE1EC000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1EC000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000028.00000003.18518798887.00000215F83E4000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83E4000
Size:	36864

Details

Name:	00000001.00000002.14717846605.000002DE9F4E9000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2DE9F4E9000
Size:	32768

Details

Name:	0000002C.00000003.18653192610.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	49152

Details

Name:	00000001.00000002.14721216799.00007FF4F7DD0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7DD0000
Size:	8192

Details

Name:	00000028.00000002.18524517635.00007FF52FAAC000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAAC000
Size:	12288

Details

Name:	00000001.00000003.14647049689.000002DEA1CB2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CB2000
Size:	479232

Details

Name:	00000026.00000003.18354037540.00000138BDAD2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDAD2000
Size:	4096

Details

Name:	0000000D.00000000.14857805381.000000007F740000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F740000
Size:	4096

Details

Name:	0000002C.00000003.18658007795.0000016FFD23C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23C000
Size:	28672

Details

Name:	00000026.00000003.18341230495.00000138BCD04000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD04000
Size:	4096

Details

Name:	0000000D.00000002.19665403004.0000000003040000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3040000
Size:	8192

Details

Name:	00000020.00000003.18204542255.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000020.00000002.19676051609.00007FF4FEB21000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEB21000
Size:	4096

Details

Name:	00000020.00000003.18251599633.00000296E41B7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B7000
Size:	12288

Details

Name:	00000026.00000003.18339021040.00000138BE6AF000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6AF000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000001.00000002.14721893974.00007FF4F8469000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8469000
Size:	4096

Details

Name:	00000020.00000002.19661827790.000000B135FFC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B135FFC000
Size:	16384

Details

Name:	00000001.00000002.14718816427.000002DE9F750000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F750000
Size:	32768

Details

Name:	0000002A.00000003.18537847999.0000022796F49000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F49000
Size:	147456

Details

Name:	0000002D.00000002.19664429388.00007DF5B99F0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99F0000
Size:	12288

Details

Name:	0000000D.00000002.19675506575.000000007F750000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F750000
Size:	4096

Details

Name:	00000001.00000003.14640007961.000002DEA1C3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3E000
Size:	36864

Details

Name:	00000020.00000003.18139225306.00000296E3EBB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EBB000
Size:	4096

Details

Name:	00000001.00000003.14623441778.000002DEA1E35000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E35000
Size:	53248

Details

Name:	00000020.00000003.18138020216.00000296E3E65000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E65000
Size:	4096

Details

Name:	00000020.00000003.18244745401.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	122880

Details

Name:	00000001.00000000.14610695136.00007FF4E0F3B000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4E0F3B000
Size:	4096

Details

Name:	0000002C.00000003.18654574865.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	49152

Details

Name:	00000001.00000003.14630843950.000002DEA17BE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17BE000
Size:	4096

Details

Name:	00000001.00000003.14716087103.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	77824

Details

Name:	0000002C.00000003.18641654620.0000016FFD22B000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22B000
Size:	61440

Details

Name:	00000001.00000003.14630071688.000002DEA15AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AF000
Size:	24576

Details

Name:	00000025.00000003.18229362198.0000021B53ABF000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53ABF000
Size:	8192

Details

Name:	00000020.00000003.18175583041.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	4096

Details

Name:	00000026.00000003.18432036544.00000138BD146000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD146000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
May infect USB drives	Spreading	Replication Through Removable Media
May initialize a security null descriptor	Lowering of HIPS / PFW / Operating System Security Settings
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14643635964.000002DEA200C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200C000
Size:	4096

Details

Name:	00000020.00000002.19670267304.00000296DF830000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF830000
Size:	65536

Details

Name:	00000026.00000003.18347318804.00000138BDD66000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD66000
Size:	4096

Details

Name:	00000001.00000002.14720130194.000002DEA158D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA158D000
Size:	53248

Details

Name:	00000025.00000002.18579974451.00007FF56966F000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56966F000
Size:	20480

Details

Name:	00000026.00000003.18337194064.00000138BDCA0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCA0000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002C.00000003.18643423883.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	61440

Details

Name:	00000026.00000003.18344406474.00000138BD988000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD988000
Size:	4096

Details

Name:	0000002D.00000002.19666219595.00007FF7B57C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B57C0000
Size:	4096

Details

Name:	00000026.00000003.18335246820.00000138BE942000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE942000
Size:	86016

Details

Name:	00000020.00000003.18203221977.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000020.00000003.18175648673.00000296E443F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E443F000
Size:	122880

Details

Name:	0000002D.00000000.18669530237.00007FF5AFB1F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFB1F000
Size:	20480

Details

Name:	00000026.00000003.18310398562.00000138BE656000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE656000
Size:	86016

Details

Name:	00000026.00000003.18347642517.00000138BEAE4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEAE4000
Size:	4096

Details

Name:	00000028.00000003.18522095515.00000215F838E000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F838E000
Size:	4096

Details

Name:	0000000D.00000002.19663509684.00000000029E3000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29E3000
Size:	4096

Details

Name:	0000001D.00000002.19660997259.0000019F0BD80000.00000004.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	19F0BD80000
Size:	4096

Details

Name:	00000020.00000002.19673021194.00000296E416B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E416B000
Size:	32768

Details

Name:	00000020.00000003.18216207648.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	16384

Details

Name:	00000001.00000003.14711649722.000002DEA159B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159B000
Size:	126976

Details

Name:	00000020.00000002.19669235978.00000296DEBC5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBC5000
Size:	86016

Details

Name:	00000001.00000003.14629169443.000002DEA1762000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1762000
Size:	77824

Details

Name:	00000026.00000003.18307485369.00000138BEA1E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEA1E000
Size:	266240

Details

Name:	00000020.00000003.18188526985.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000001.00000003.14613178366.000002DEA1481000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1481000
Size:	32768

Details

Name:	00000001.00000003.14644933845.000002DEA1BD4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BD4000
Size:	12288

Details

Name:	00000020.00000002.19676852619.00007FF4FEC40000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC40000
Size:	20480

Details

Name:	00000026.00000003.18348332135.00000138BE958000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE958000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000012.00000002.19667010609.000001CCB156F000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB156F000
Size:	16384

Details

Name:	0000000D.00000002.19661517658.0000000000B90000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	B90000
Size:	4096

Details

Name:	00000020.00000002.19669692675.00000296DEBED000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBED000
Size:	45056

Details

Name:	0000001D.00000003.18434368460.0000019F0C0B9000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C0B9000
Size:	4096

Details

Name:	00000001.00000003.14645859103.000002DEA1FA9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FA9000
Size:	16384

Details

Name:	0000000D.00000000.14857524646.0000000000930000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	930000
Size:	118784

Details

Name:	00000025.00000003.18223224659.0000021B53AB7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AB7000
Size:	40960

Details

Name:	00000020.00000002.19672848696.00000296E4154000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4154000
Size:	4096

Details

Name:	00000026.00000003.18353014898.00000138BD7B9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD7B9000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.14721169227.00007FF4F7B67000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7B67000
Size:	8192

Details

Name:	00000020.00000003.18139201995.00000296E3EB9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EB9000
Size:	4096

Details

Name:	00000026.00000003.18254345479.00000138ADCBC000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCBC000
Size:	135168

Details

Name:	00000012.00000002.19666722298.000001CCB1554000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1554000
Size:	40960

Details

Name:	00000012.00000002.19668478653.00007FF5676A6000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676A6000
Size:	8192

Details

Name:	00000020.00000003.18189763329.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000025.00000000.18201420572.00007FF54FD5B000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF54FD5B000
Size:	4096

Details

Name:	00000028.00000002.18523864085.00000215F7CD0000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	215F7CD0000
Size:	8192

Details

Name:	0000002C.00000002.19660848866.0000016FFD140000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD140000
Size:	4096

Details

Name:	00000005.00000002.15126680097.0000000002230000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2230000
Size:	16384

Details

Name:	00000028.00000003.18517653885.00000215F83BA000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83BA000
Size:	405504

Details

Name:	00000020.00000002.19661412955.000000B135BFE000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B135BFE000
Size:	8192

Details

Name:	00000020.00000003.18172732449.00000296E41C2000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41C2000
Size:	24576

Details

Name:	00000026.00000003.18409950162.00000138BCA48000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA48000
Size:	8192

Details

Name:	0000001D.00000002.19668302335.00007FF5EC276000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC276000
Size:	20480

Details

Name:	00000001.00000003.14644567826.000002DEA1BD7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BD7000
Size:	4096

Details

Name:	00000005.00000002.15127056623.00000000022D0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	22D0000
Size:	8192

Details

Name:	00000012.00000002.19668062013.00007FF567670000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567670000
Size:	12288

Details

Name:	00000012.00000002.19668329758.00007FF56768B000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56768B000
Size:	8192

Details

Name:	00000020.00000002.19677473885.00007FF4FECC0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FECC0000
Size:	24576

Details

Name:	00000026.00000003.18298692792.00000138BDFE8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFE8000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000001D.00000002.19665059358.0000019F0C580000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0C580000
Size:	4096

Details

Name:	0000002D.00000000.18670817103.00007FF7B587C000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B587C000
Size:	28672

Details

Name:	00000001.00000003.14645713766.000002DEA1B98000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B98000
Size:	65536

Details

Name:	00000026.00000003.18318585819.00000138BE41B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE41B000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary or sample is protected by dotNetProtector	Data Obfuscation
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18320722145.00000138BD946000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD946000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18160219311.00000296E4403000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4403000
Size:	233472

Details

Name:	00000020.00000002.19671321086.00000296E3ED0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3ED0000
Size:	4096

Details

Name:	0000002A.00000002.18541687891.0000022796720000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	22796720000
Size:	81920

Details

Name:	00000020.00000003.18215444926.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000026.00000003.18346289631.00000138BD146000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD146000
Size:	151552

Details

Name:	00000026.00000003.18335030768.00000138BE917000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE917000
Size:	172032

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000003.18658473597.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	53248

Details

Name:	00000005.00000002.15125937168.00000000005F0000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5F0000
Size:	32768

Details

Name:	00000020.00000003.18203750380.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	0000001D.00000002.19660609623.00000048D17CB000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	48D17CB000
Size:	20480

Details

Name:	00000026.00000003.18346989399.00000138BE186000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE186000
Size:	4096

Details

Name:	00000001.00000003.14625736085.000002DEA1F06000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F06000
Size:	4096

Details

Name:	00000020.00000002.19671615944.00000296E3FA0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3FA0000
Size:	12288

Details

Name:	00000020.00000003.18173892124.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	0000001D.00000002.19668859311.00007FF5EC2A9000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2A9000
Size:	32768

Details

Name:	00000001.00000003.14714384382.000002DEA1411000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1411000
Size:	73728

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	0000000D.00000002.19675195246.000000001E99E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E99E000
Size:	8192

Details

Name:	00000001.00000002.14722250558.00007FF4F84DF000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84DF000
Size:	20480

Details

Name:	00000026.00000003.18305972562.00000138BCED3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCED3000
Size:	81920

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000001.00000003.14642185442.000002DEA15BA000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BA000
Size:	28672

Details

Name:	0000002D.00000003.18691756552.000001A8F8CD6000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CD6000
Size:	65536

Details

Name:	00000001.00000003.14715032740.000002DE9F5D4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D4000
Size:	32768

Details

Name:	00000028.00000003.18522630575.00000215F8382000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8382000
Size:	4096

Details

Name:	00000025.00000000.18201269112.00007DF573522000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573522000
Size:	4096

Details

Name:	00000028.00000003.18520226669.00000215F83B3000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B3000
Size:	16384

Details

Name:	00000020.00000003.18188600180.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000020.00000003.18173540273.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	20480

Details

Name:	00000026.00000003.18340613099.00000138BCC0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCC0C000
Size:	266240

Details

Name:	00000001.00000003.14647611539.000002DEA1BD4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BD4000
Size:	12288

Details

Name:	00000020.00000003.18219546931.00000296E41CC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41CC000
Size:	32768

Details

Name:	0000001D.00000002.19667411894.00007FF5EC199000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC199000
Size:	8192

Details

Name:	0000002D.00000002.19665424478.00007FF5AFA9B000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA9B000
Size:	8192

Details

Name:	0000002C.00000002.19664750666.00007FF6A36FF000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A36FF000
Size:	61440

Details

Name:	00000026.00000003.18340576327.00000138BCB88000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB88000
Size:	4096

Details

Name:	00000025.00000002.18579692954.00007FF5695EB000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5695EB000
Size:	4096

Details

Name:	0000002D.00000003.18692564077.000001A8F8CBA000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBA000
Size:	8192

Details

Name:	00000026.00000003.18319394553.00000138BE656000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE656000
Size:	86016

Details

Name:	00000020.00000002.19673496014.00000296E41B9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B9000
Size:	4096

Details

Name:	00000001.00000002.14720862317.000002DEA1F92000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F92000
Size:	24576

Details

Name:	0000002A.00000003.18539595458.0000022796F1C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F1C000
Size:	16384

Details

Name:	0000002C.00000003.18650305113.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	00000026.00000003.18284438329.00000138AA797000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA797000
Size:	65536

Details

Name:	00000001.00000003.14626960880.000002DEA1E78000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E78000
Size:	69632

Details

Name:	00000020.00000002.19671360984.00000296E3EF0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EF0000
Size:	24576

Details

Name:	00000028.00000002.18523084723.0000007FC359E000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7FC359E000
Size:	8192

Details

Name:	00000001.00000003.14638808421.000002DEA16B2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B2000
Size:	4096

Details

Name:	00000020.00000003.18138619872.00000296E3E8C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E8C000
Size:	4096

Details

Name:	00000020.00000003.18172817145.00000296E41CC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41CC000
Size:	4096

Details

Name:	00000020.00000003.18145555328.00000296DEBAD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBAD000
Size:	233472

Details

Name:	00000012.00000002.19665725614.000001CCB1290000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1290000
Size:	4096

Details

Name:	0000000D.00000000.14856748014.000000007F740000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F740000
Size:	4096

Details

Name:	0000002D.00000003.18681799392.000001A8F8CBF000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBF000
Size:	262144

Details

Name:	0000002A.00000002.18542704556.00007FF5C7E0F000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E0F000
Size:	8192

Details

Name:	00000020.00000003.18137503450.00000296E3E20000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E20000
Size:	253952

Details

Name:	00000026.00000003.18296011101.00000138AA7AE000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7AE000
Size:	20480

Details

Name:	0000002C.00000003.18654999954.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	0000000D.00000002.19667209989.0000000003209000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3209000
Size:	4096

Details

Name:	00000001.00000003.14715995787.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	77824

Details

Name:	0000002C.00000003.18654825889.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	00000026.00000003.18284879977.00000138AA767000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA767000
Size:	65536

Details

Name:	0000002A.00000002.18541253899.0000022796640000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	22796640000
Size:	8192

Details

Name:	0000002C.00000000.18613389698.00007DF515592000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF515592000
Size:	4096

Details

Name:	00000001.00000003.14712722355.000002DE9F5C8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5C8000
Size:	81920

Details

Name:	00000001.00000003.14644351954.000002DEA1BCF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BCF000
Size:	69632

Details

Name:	00000001.00000003.14614634433.000002DEA1437000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1437000
Size:	20480

Details

Name:	0000002C.00000003.18652015531.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	28672

Details

Name:	0000000D.00000002.19664193585.0000000002A24000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A24000
Size:	28672

Details

Name:	00000026.00000003.18310511339.00000138BDE6F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE6F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14613356988.000002DEA1465000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1465000
Size:	32768

Details

Name:	00000001.00000003.14629588448.000002DEA1601000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1601000
Size:	57344

Details

Name:	00000001.00000003.14710855083.000002DE9F51F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F51F000
Size:	491520

Details

Name:	00000020.00000003.18187171799.00000296E4460000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4460000
Size:	122880

Details

Name:	00000020.00000003.18203036112.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000026.00000003.18293246312.00000138BD881000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD881000
Size:	81920

Details

Name:	00000025.00000002.18591489491.00007FF720D11000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF720D11000
Size:	5468160

Details

Name:	0000002C.00000000.18614174385.00007FF6A370E000.00000008.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF6A370E000
Size:	4096

Details

Name:	00000001.00000003.14638168334.000002DEA1D43000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D43000
Size:	53248

Details

Name:	00000020.00000003.18174348006.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000020.00000003.18188466808.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000020.00000003.18244908735.00000296E40A6000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40A6000
Size:	53248

Details

Name:	00000020.00000002.19670875234.00000296DFD80000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DFD80000
Size:	16384

Details

Name:	00000020.00000002.19677325458.00007FF4FEC95000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC95000
Size:	20480

Details

Name:	00000028.00000002.18524308633.00007FF52EF9E000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52EF9E000
Size:	28672

Details

Name:	00000001.00000003.14625034565.000002DEA1EF4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EF4000
Size:	69632

Details

Name:	0000000D.00000000.14857670718.00000000009D0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	9D0000
Size:	16384

Details

Name:	00000020.00000002.19668709028.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	0000002C.00000003.18651889522.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	24576

Details

Name:	00000028.00000003.18519966642.00000215F83FA000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83FA000
Size:	143360

Details

Name:	00000001.00000003.14641231056.000002DEA1CAB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CAB000
Size:	507904

Details

Name:	00000020.00000003.18215937986.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000012.00000002.19668642307.00007FF5676B5000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676B5000
Size:	12288

Details

Name:	00000001.00000003.14639119931.000002DEA1702000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1702000
Size:	28672

Details

Name:	00000026.00000000.18231429361.00007FF78E89C000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF78E89C000
Size:	28672

Details

Name:	00000012.00000002.19667898478.00007FF5675E9000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5675E9000
Size:	4096

Details

Name:	00000020.00000002.19673387036.00000296E41AD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41AD000
Size:	16384

Details

Name:	0000002C.00000000.18613791294.00007FF6A36D0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A36D0000
Size:	4096

Details

Name:	00000020.00000003.18189676205.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000026.00000000.18230311087.00007DF5CF132000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5CF132000
Size:	4096

Details

Name:	0000002C.00000003.18666689007.0000016FFD21E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD21E000
Size:	151552

Details

Name:	00000026.00000003.18417485708.00000138BD45E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45E000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000012.00000002.19664210029.000001CCB0CCD000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0CCD000
Size:	208896

Details

Name:	0000002D.00000002.19664186667.00007DF5B99D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99D0000
Size:	4096

Details

Name:	00000001.00000003.14623736249.000002DEA1EA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA2000
Size:	102400

Details

Name:	00000020.00000003.18176193308.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000026.00000003.18327447936.00000138BDB56000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB56000
Size:	4096

Details

Name:	0000002C.00000002.19661517102.0000016FFD1F0000.00000004.00000020.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16FFD1F0000
Size:	45056

Details

Name:	00000025.00000003.18222136431.0000021B53AC4000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AC4000
Size:	262144

Details

Name:	0000001D.00000002.19668773175.00007FF5EC2A6000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2A6000
Size:	8192

Details

Name:	0000002D.00000002.19665872249.00007FF5AFAE5000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAE5000
Size:	20480

Details

Name:	0000002A.00000003.18539635243.0000022796F17000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F17000
Size:	20480

Details

Name:	00000025.00000002.18578350019.0000006DF80FE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6DF80FE000
Size:	8192

Details

Name:	00000026.00000000.18230286431.00007DF5CF130000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5CF130000
Size:	4096

Details

Name:	00000025.00000002.18579604664.00007FF5695D0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5695D0000
Size:	12288

Details

Name:	0000002A.00000003.18536611348.0000022796EEE000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EEE000
Size:	49152

Details

Name:	0000002A.00000003.18538730802.0000022796F4A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F4A000
Size:	135168

Details

Name:	0000000D.00000002.19661330398.0000000000A0B000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	A0B000
Size:	8192

Details

Name:	00000026.00000003.18344037814.00000138BE03C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE03C000
Size:	4096

Details

Name:	00000020.00000002.19666114709.00000296DE6D0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE6D0000
Size:	16384

Details

Name:	00000020.00000002.19676602535.00007FF4FEC27000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC27000
Size:	12288

Details

Name:	00000025.00000002.18579647170.00007FF5695E0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5695E0000
Size:	20480

Details

Name:	00000025.00000002.18579325003.00007DF573532000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573532000
Size:	4096

Details

Name:	00000020.00000002.19671195927.00000296E3E10000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E10000
Size:	4096

Details

Name:	0000000D.00000002.19661753275.0000000000BC0000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	BC0000
Size:	16384

Details

Name:	00000020.00000003.18231537586.00000296E444E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E444E000
Size:	237568

Details

Name:	00000020.00000003.18138349188.00000296E3E71000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E71000
Size:	16384

Details

Name:	00000026.00000003.18254315202.00000138ADCB6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCB6000
Size:	8192

Details

Name:	00000020.00000003.18245906874.00000296E40A6000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40A6000
Size:	53248

Details

Name:	00000020.00000002.19676513007.00007FF4FEC18000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC18000
Size:	12288

Details

Name:	00000001.00000003.14614599405.000002DEA142F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA142F000
Size:	20480

Details

Name:	00000020.00000003.18138944969.00000296E3EA5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EA5000
Size:	12288

Details

Name:	0000000D.00000002.19661971205.0000000002832000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2832000
Size:	20480

Details

Name:	00000028.00000002.18525052024.00007FF52FB1D000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB1D000
Size:	8192

Details

Name:	00000012.00000002.19662426665.000001CCB0C2A000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C2A000
Size:	86016

Details

Name:	00000001.00000003.14644311547.000002DEA159D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159D000
Size:	20480

Details

Name:	0000002C.00000003.18666422155.0000016FFD215000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD215000
Size:	188416

Details

Name:	00000020.00000003.18174285477.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000025.00000003.18577838131.0000021B53ABD000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53ABD000
Size:	12288

Details

Name:	00000020.00000003.18146118115.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	0000002A.00000003.18539943072.0000022796E6B000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E6B000
Size:	16384

Details

Name:	00000026.00000003.18321608196.00000138BE186000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE186000
Size:	4096

Details

Name:	0000002A.00000003.18539713561.0000022796F0E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F0E000
Size:	8192

Details

Name:	00000026.00000003.18354806789.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19666551044.00000296DEA00000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEA00000
Size:	4096

Details

Name:	0000002C.00000003.18644727991.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	73728

Details

Name:	0000002A.00000003.18538421688.0000022796EF9000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EF9000
Size:	4096

Details

Name:	00000020.00000003.18139174269.00000296E3EB7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EB7000
Size:	4096

Details

Name:	00000028.00000003.18517053715.00000215F83AA000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83AA000
Size:	471040

Details

Name:	00000020.00000003.18186544918.00000296E4445000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4445000
Size:	233472

Details

Name:	00000001.00000003.14638238548.000002DEA1BEE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BEE000
Size:	57344

Details

Name:	00000001.00000003.14641819343.000002DEA1D4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D4E000
Size:	8192

Details

Name:	00000001.00000002.14720397727.000002DEA1763000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1763000
Size:	4096

Details

Name:	00000001.00000003.14643833158.000002DEA1BAF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BAF000
Size:	24576

Details

Name:	00000020.00000002.19667444178.00000296DEB3F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB3F000
Size:	20480

Details

Name:	00000020.00000002.19661334716.000000B135AFE000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B135AFE000
Size:	8192

Details

Name:	00000020.00000003.18161103208.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000026.00000003.18336277246.00000138BD3DA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD3DA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19674155084.00007DF508B82000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B82000
Size:	4096

Details

Name:	00000012.00000002.19660497789.0000007848CFB000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7848CFB000
Size:	20480

Details

Name:	0000002D.00000002.19664892425.00007FF5AFA1F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA1F000
Size:	4096

Details

Name:	00000001.00000003.14632708477.000002DEA1BC7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BC7000
Size:	98304

Details

Name:	00000001.00000003.14614521943.000002DEA1445000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1445000
Size:	16384

Details

Name:	00000020.00000003.18187971919.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000026.00000003.18294586651.00000138AA78B000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA78B000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14640391975.000002DEA1C64000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C64000
Size:	69632

Details

Name:	00000020.00000003.18221408925.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	0000001D.00000002.19662932150.0000019F0C040000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C040000
Size:	12288

Details

Name:	0000002A.00000000.18526298305.00007DF5D1D30000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D30000
Size:	4096

Details

Name:	0000002D.00000003.18687023973.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	36864

Details

Name:	00000012.00000002.19667373912.00007DF5715D0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715D0000
Size:	4096

Details

Name:	00000001.00000003.14637789119.000002DEA1C3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3E000
Size:	49152

Details

Name:	0000000D.00000002.19663829584.00000000029F5000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29F5000
Size:	53248

Details

Name:	0000000D.00000002.19665110442.0000000002A63000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A63000
Size:	12288

Details

Name:	00000020.00000002.19675534905.00007FF4FE9B7000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE9B7000
Size:	4096

Details

Name:	00000026.00000003.18292462058.00000138BDF8A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF8A000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking

Details

Name:	0000002A.00000003.18539552931.0000022796EEF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EEF000
Size:	20480

Details

Name:	00000025.00000003.18222775422.0000021B53AC4000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AC4000
Size:	258048

Details

Name:	00000001.00000003.14709692210.000002DEA1BC9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BC9000
Size:	57344

Details

Name:	00000001.00000002.14720685946.000002DEA1BBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BBC000
Size:	53248

Details

Name:	00000026.00000003.18308668531.00000138BDFB8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFB8000
Size:	4096

Details

Name:	0000002C.00000003.18649408261.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	57344

Details

Name:	00000001.00000002.14718450668.000002DE9F5A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A8000
Size:	4096

Details

Name:	00000001.00000003.14639796610.000002DEA1C64000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C64000
Size:	69632

Details

Name:	0000001D.00000002.19662382280.0000019F0C013000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C013000
Size:	90112

Details

Name:	00000026.00000000.18230455424.00007FF5C527F000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C527F000
Size:	20480

Details

Name:	00000020.00000003.18218237966.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000003.14612780939.000002DEA14B9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14B9000
Size:	32768

Details

Name:	0000002C.00000003.18653724052.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	00000020.00000003.18218826114.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000028.00000003.18521556115.00000215F83C7000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83C7000
Size:	20480

Details

Name:	00000020.00000002.19673754794.00000296E41E9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41E9000
Size:	24576

Details

Name:	00000001.00000003.14642765095.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	8192

Details

Name:	00000020.00000003.18138849730.00000296E3E9C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E9C000
Size:	4096

Details

Name:	0000002D.00000002.19661523358.000001A8F8BF0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8BF0000
Size:	4096

Details

Name:	00000001.00000003.14710609974.000002DEA16B2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B2000
Size:	4096

Details

Name:	00000001.00000002.14717920363.000002DE9F4F2000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2DE9F4F2000
Size:	102400

Details

Name:	00000001.00000003.14642483912.000002DEA15A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A8000
Size:	16384

Details

Name:	00000020.00000002.19677587901.00007FF4FECCE000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FECCE000
Size:	24576

Details

Name:	00000026.00000003.18284727937.00000138AA777000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA777000
Size:	73728

Details

Name:	00000001.00000002.14717768687.000002DE9F4E0000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2DE9F4E0000
Size:	32768

Details

Name:	00000026.00000003.18268554440.00000138AEB16000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AEB16000
Size:	405504

Details

Name:	0000002A.00000003.18540170955.0000022796E70000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796E70000
Size:	8192

Details

Name:	00000001.00000003.14625617303.000002DEA1EA8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA8000
Size:	12288

Details

Name:	00000001.00000003.14715654572.000002DEA1F9A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F9A000
Size:	61440

Details

Name:	0000002C.00000000.18613727645.00007FF50B6DF000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B6DF000
Size:	20480

Details

Name:	00000001.00000003.14644865484.000002DEA160C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160C000
Size:	12288

Details

Name:	0000002C.00000003.18650527911.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	49152

Details

Name:	00000001.00000003.14632043220.000002DEA1806000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1806000
Size:	12288

Details

Name:	00000012.00000002.19667607812.00007FF566A81000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF566A81000
Size:	4096

Details

Name:	00000028.00000003.18521912152.00000215F83A0000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A0000
Size:	8192

Details

Name:	0000002A.00000002.18541897992.00000227969A5000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	227969A5000
Size:	8192

Details

Name:	00000026.00000003.18350786721.00000138BD66E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD66E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000002.18542286380.00007FF5C7C82000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7C82000
Size:	12288

Details

Name:	0000000D.00000002.19675014805.000000001E8DF000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E8DF000
Size:	4096

Details

Name:	00000026.00000003.18424386712.00000138BD891000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD891000
Size:	65536

Details

Name:	00000020.00000002.19671239533.00000296E3E40000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E40000
Size:	4096

Details

Name:	00000001.00000003.14711367041.000002DE9F5B7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5B7000
Size:	163840

Details

Name:	00000001.00000002.14722485894.00007FF4F851A000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F851A000
Size:	12288

Details

Name:	00000001.00000003.14712406194.000002DE9F5B8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5B8000
Size:	159744

Details

Name:	00000020.00000002.19662626468.00000296DE170000.00000004.00000020.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	296DE170000
Size:	20480

Details

Name:	00000026.00000003.18292004206.00000138BCE85000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE85000
Size:	8192

Details

Name:	00000026.00000003.18318003902.00000138BD399000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD399000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18172874228.00000296E41EB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41EB000
Size:	49152

Details

Name:	00000001.00000003.14633283780.000002DEA1BE3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE3000
Size:	110592

Details

Name:	0000000D.00000000.14857906125.000000007F752000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F752000
Size:	4096

Details

Name:	00000020.00000003.18161129878.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000001.00000003.14613757498.000002DEA1420000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1420000
Size:	32768

Details

Name:	00000026.00000003.18434862531.00000138BE6EF000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6EF000
Size:	4096

Details

Name:	0000002A.00000002.18542791990.00007FF5C7E36000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E36000
Size:	16384

Details

Name:	00000020.00000003.18146738664.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000002.14720502428.000002DEA1B20000.00000004.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	2DEA1B20000
Size:	8192

Details

Name:	00000020.00000003.18189317188.00000296E4424000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4424000
Size:	233472

Details

Name:	00000001.00000003.14645016989.000002DEA1FA4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FA4000
Size:	36864

Details

Name:	00000001.00000002.14720441473.000002DEA1810000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1810000
Size:	4096

Details

Name:	0000000D.00000002.19662304649.00000000028C0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28C0000
Size:	12288

Details

Name:	0000001D.00000002.19669312058.00007FF5EC300000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC300000
Size:	24576

Details

Name:	00000001.00000002.14721091403.00007DF502430000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502430000
Size:	12288

Details

Name:	0000002D.00000002.19663956861.000001A8F9350000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F9350000
Size:	4096

Details

Name:	00000012.00000002.19667445403.00007DF5715D2000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715D2000
Size:	4096

Details

Name:	0000002D.00000002.19661785707.000001A8F8C41000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8C41000
Size:	12288

Details

Name:	00000020.00000003.18188238736.00000296E4444000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4444000
Size:	4096

Details

Name:	00000001.00000003.14622076474.000002DEA1E35000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E35000
Size:	126976

Details

Name:	0000002C.00000003.18628096699.0000016FFD223000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD223000
Size:	262144

Details

Name:	00000020.00000003.18138647675.00000296E3E8E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E8E000
Size:	4096

Details

Name:	00000020.00000003.18138247835.00000296E3E6D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E6D000
Size:	4096

Details

Name:	00000026.00000003.18316787204.00000138BD5A8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5A8000
Size:	266240

Details

Name:	00000001.00000003.14621224094.000002DEA1DC4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DC4000
Size:	65536

Details

Name:	0000002A.00000003.18537606577.0000022796F33000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F33000
Size:	4096

Details

Name:	00000001.00000003.14614479205.000002DEA1468000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1468000
Size:	20480

Details

Name:	00000001.00000003.14648194493.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	4096

Details

Name:	00000001.00000003.14613616253.000002DEA1428000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1428000
Size:	81920

Details

Name:	0000002C.00000002.19664147953.00007FF6A36D0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A36D0000
Size:	4096

Details

Name:	0000002C.00000003.18650764867.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	00000020.00000003.18202800138.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000026.00000003.18352689082.00000138BD20C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD20C000
Size:	77824

Details

Name:	00000026.00000003.18351909718.00000138BCE0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE0C000
Size:	4096

Details

Name:	00000001.00000003.14625928593.000002DEA1F3C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F3C000
Size:	69632

Details

Name:	00000026.00000003.18310205090.00000138BE62A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE62A000
Size:	167936

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000028.00000003.18520496128.00000215F8405000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8405000
Size:	90112

Details

Name:	00000020.00000003.18215104558.00000296DEB96000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB96000
Size:	16384

Details

Name:	00000020.00000003.18203344446.00000296E4444000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4444000
Size:	237568

Details

Name:	00000001.00000003.14643812490.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	4096

Details

Name:	0000002C.00000003.18651596147.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	61440

Details

Name:	0000002C.00000002.19663704406.00007FF50B679000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B679000
Size:	4096

Details

Name:	00000020.00000003.18246076306.00000296E4435000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4435000
Size:	36864

Details

Name:	00000020.00000003.18232075097.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	65536

Details

Name:	00000001.00000003.14634313177.000002DEA1C87000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C87000
Size:	69632

Details

Name:	00000001.00000003.14629821432.000002DEA17E2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17E2000
Size:	90112

Details

Name:	00000005.00000002.15125067094.0000000000020000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20000
Size:	4096

Details

Name:	00000026.00000003.18340288495.00000138BCB46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB46000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected RemCom RemoteAdmin tool	Remote Access Functionality
Yara signature match	System Summary

Details

Name:	0000001D.00000000.18133695305.00007DF5F61D0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61D0000
Size:	4096

Details

Name:	00000020.00000003.18191094178.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000001.00000003.14640479893.000002DEA1C76000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C76000
Size:	69632

Details

Name:	00000001.00000003.14646841666.000002DEA15B5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15B5000
Size:	20480

Details

Name:	0000002D.00000003.18689903813.000001A8F8CCE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCE000
Size:	163840

Details

Name:	00000020.00000003.18144894036.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	36864

Details

Name:	0000002C.00000003.18659719482.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	61440

Details

Name:	00000026.00000003.18351149084.00000138BD6B0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD6B0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000002.19666935933.00000296DEB13000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB13000
Size:	176128

Details

Name:	00000001.00000002.14722811968.00007FF4F8557000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8557000
Size:	12288

Details

Name:	0000002C.00000003.18624147331.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	262144

Details

Name:	00000025.00000002.18579531743.00007FF569549000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569549000
Size:	4096

Details

Name:	0000002A.00000003.18538450544.0000022796F01000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F01000
Size:	4096

Details

Name:	0000002D.00000002.19660493022.000000938A9DC000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	938A9DC000
Size:	16384

Details

Name:	00000001.00000002.14721338765.00007FF4F80D7000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F80D7000
Size:	12288

Details

Name:	0000002C.00000002.19661445723.0000016FFD1B0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD1B0000
Size:	4096

Details

Name:	0000001D.00000002.19662652787.0000019F0C02A000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C02A000
Size:	86016

Details

Name:	0000002C.00000002.19660761658.0000016FFD130000.00000004.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	16FFD130000
Size:	4096

Details

Name:	0000000D.00000002.19664750898.0000000002A50000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A50000
Size:	32768

Details

Name:	0000001D.00000002.19664428751.0000019F0C0D6000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C0D6000
Size:	8192

Details

Name:	00000020.00000003.18176108597.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000020.00000003.18188048250.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000026.00000003.18325799879.00000138BCB89000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCB89000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14627619593.000002DEA1F91000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F91000
Size:	65536

Details

Name:	00000020.00000002.19670151106.00000296DF820000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF820000
Size:	65536

Details

Name:	00000020.00000003.18144790481.00000296E405E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E405E000
Size:	12288

Details

Name:	0000002C.00000003.18635533873.0000016FFD226000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD226000
Size:	262144

Details

Name:	0000002D.00000003.18692389989.000001A8F8CBF000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBF000
Size:	8192

Details

Name:	00000020.00000003.18233481639.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	28672

Details

Name:	00000001.00000003.14626248730.000002DEA1F06000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F06000
Size:	4096

Details

Name:	00000026.00000003.18257506680.00000138ADFAF000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADFAF000
Size:	8192

Details

Name:	00000020.00000003.18139248307.00000296E3EBD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EBD000
Size:	4096

Details

Name:	0000002D.00000003.18684002709.000001A8F8CC0000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC0000
Size:	65536

Details

Name:	00000026.00000003.18357503095.00000138BE2D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE2D0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000001.00000003.14712293585.000002DE9F50F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F50F000
Size:	28672

Details

Name:	00000020.00000003.18161906399.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	00000001.00000003.14611716955.000002DEA1445000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1445000
Size:	430080

Details

Name:	0000000D.00000002.19675252928.000000001E9DF000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E9DF000
Size:	4096

Details

Name:	0000002A.00000003.18536946467.0000022796F02000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F02000
Size:	20480

Details

Name:	0000000D.00000002.19666460242.00000000031C9000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	31C9000
Size:	57344

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000020.00000003.18162096609.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	0000002D.00000003.18685550858.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	65536

Details

Name:	0000001D.00000002.19665988628.00007DF5F61E0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61E0000
Size:	12288

Details

Name:	00000001.00000002.14720101577.000002DEA157C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA157C000
Size:	12288

Details

Name:	00000020.00000003.18245001243.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	65536

Details

Name:	0000001D.00000002.19665131599.0000019F0C591000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0C591000
Size:	114688

Details

Name:	00000020.00000003.18191266716.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000001.00000003.14716405392.000002DE9F599000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F599000
Size:	4096

Details

Name:	0000001D.00000002.19667211069.00007FF5EC126000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC126000
Size:	4096

Details

Name:	00000020.00000002.19668816845.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000001.00000002.14720531589.000002DEA1B90000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B90000
Size:	4096

Details

Name:	00000001.00000003.14714532201.000002DEA1444000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1444000
Size:	4096

Details

Name:	0000000D.00000002.19665751228.0000000003120000.00000004.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	3120000
Size:	16384

Details

Name:	0000002C.00000003.18654213427.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	36864

Details

Name:	00000020.00000003.18190722033.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000026.00000003.18353666038.00000138BCD88000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD88000
Size:	4096

Details

Name:	00000012.00000002.19665856303.000001CCB1500000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1500000
Size:	4096

Details

Name:	0000002A.00000003.18539343587.0000022796F0E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F0E000
Size:	24576

Details

Name:	00000005.00000002.15125354166.00000000001A0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A0000
Size:	16384

Details

Name:	0000000D.00000002.19661183724.00000000009D0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	9D0000
Size:	16384

Details

Name:	00000001.00000003.14644487790.000002DEA1F91000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F91000
Size:	24576

Details

Name:	0000002C.00000002.19663824126.00007FF50B6A6000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B6A6000
Size:	16384

Details

Name:	0000002D.00000003.18691532536.000001A8F8CE6000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CE6000
Size:	81920

Details

Name:	00000028.00000003.18522469738.00000215F8390000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8390000
Size:	28672

Details

Name:	00000020.00000003.18191629061.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000020.00000003.18173290597.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	61440

Details

Name:	0000002C.00000002.19663270533.00007FF50B63C000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B63C000
Size:	12288

Details

Name:	00000020.00000002.19668107088.00000296DEB72000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB72000
Size:	16384

Details

Name:	00000025.00000002.18579022736.0000021B53ABE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53ABE000
Size:	24576

Details

Name:	00000026.00000003.18277572836.00000138AA777000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA777000
Size:	65536

Details

Name:	00000028.00000002.18523176238.00000215F7A60000.00000004.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	215F7A60000
Size:	4096

Details

Name:	00000028.00000003.18519721997.00000215F83D0000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83D0000
Size:	16384

Details

Name:	00000026.00000003.18354424693.00000138BE564000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE564000
Size:	4096

Details

Name:	00000001.00000003.14619453965.000002DEA1445000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1445000
Size:	491520

Details

Name:	0000002A.00000000.18526271190.00007DF5D1D22000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D22000
Size:	4096

Details

Name:	0000002A.00000003.18537406121.0000022796F42000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F42000
Size:	176128

Details

Name:	00000026.00000003.18297877287.00000138BE565000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE565000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000001D.00000002.19666498826.00007FF5EBB53000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBB53000
Size:	4096

Details

Name:	00000020.00000003.18146886828.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000026.00000003.18338638016.00000138BCE88000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE88000
Size:	28672

Details

Name:	0000002A.00000003.18538252859.000002279671B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2279671B000
Size:	102400

Details

Name:	00000020.00000002.19674615618.00007FF4FE127000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE127000
Size:	4096

Details

Name:	00000026.00000003.18270314540.00000138AECAD000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AECAD000
Size:	8192

Details

Name:	00000001.00000003.14716346941.000002DEA159B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159B000
Size:	36864

Details

Name:	0000002D.00000003.18687987683.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	65536

Details

Name:	00000020.00000002.19671909404.00000296E4037000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4037000
Size:	32768

Details

Name:	00000025.00000003.18577747530.0000021B53AAD000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AAD000
Size:	4096

Details

Name:	00000020.00000003.18216851897.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000001.00000003.14625300447.000002DEA1F18000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F18000
Size:	69632

Details

Name:	00000001.00000002.14718775968.000002DE9F74A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74A000
Size:	20480

Details

Name:	00000001.00000003.14630137296.000002DEA15B8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15B8000
Size:	12288

Details

Name:	00000028.00000003.18521454065.00000215F83C7000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83C7000
Size:	36864

Details

Name:	0000001D.00000002.19664571010.0000019F0C102000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C102000
Size:	32768

Details

Name:	00000020.00000003.18191575943.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000001.00000003.14641754690.000002DEA1D4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D4E000
Size:	8192

Details

Name:	00000020.00000002.19671148489.00000296E3E00000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E00000
Size:	4096

Details

Name:	00000001.00000003.14628998533.000002DEA15C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C4000
Size:	20480

Details

Name:	00000026.00000003.18305674667.00000138BD356000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD356000
Size:	69632

Details

Name:	00000020.00000003.18216953462.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	0000002D.00000002.19664825621.00007FF5AF9DF000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AF9DF000
Size:	12288

Details

Name:	00000026.00000003.18298182398.00000138BE5A6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5A6000
Size:	204800

Details

Name:	00000001.00000003.14620838215.000002DEA1DBB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DBB000
Size:	102400

Details

Name:	00000020.00000000.18136345995.00007DF508B80000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B80000
Size:	4096

Details

Name:	00000001.00000000.14610593820.00007DF502410000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502410000
Size:	4096

Details

Name:	0000001D.00000002.19667146911.00007FF5EC101000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC101000
Size:	16384

Details

Name:	00000025.00000000.18201763876.00007FF7202FF000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7202FF000
Size:	61440

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14634505710.000002DEA1BE4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE4000
Size:	40960

Details

Name:	00000001.00000003.14626107841.000002DEA1EA8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA8000
Size:	12288

Details

Name:	0000002D.00000000.18669434279.00007DF5B99F0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99F0000
Size:	12288

Details

Name:	00000001.00000003.14641953278.000002DEA15CC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15CC000
Size:	20480

Details

Name:	00000020.00000002.19671983507.00000296E4043000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4043000
Size:	12288

Details

Name:	00000026.00000003.18237680944.00000138AA763000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA763000
Size:	262144

Details

Name:	00000026.00000003.18408528352.00000138BD45E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45E000
Size:	4096

Details

Name:	00000026.00000003.18408347682.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	131072

Details

Name:	00000020.00000002.19674817762.00007FF4FE550000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE550000
Size:	8192

Details

Name:	0000001D.00000000.18133489159.0000019F0BDA0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BDA0000
Size:	118784

Details

Name:	00000026.00000003.18334118643.00000138BDCA0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCA0000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000020.00000003.18161269783.00000296E41C8000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41C8000
Size:	94208

Details

Name:	00000026.00000003.18326026778.00000138BCBB8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCBB8000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14613861924.000002DEA14C8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14C8000
Size:	73728

Details

Name:	00000001.00000003.14615536336.000002DE9F5B7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5B7000
Size:	20480

Details

Name:	00000020.00000003.18160696279.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000026.00000003.18328231309.00000138BDCB4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCB4000
Size:	184320

Details

Name:	00000001.00000003.14627699886.000002DEA1FA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FA2000
Size:	69632

Details

Name:	00000005.00000001.14652911648.0000000000400000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000020.00000003.18203653209.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	0000000D.00000002.19662963318.0000000002990000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2990000
Size:	8192

Details

Name:	00000020.00000002.19675669056.00007FF4FE9E4000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE9E4000
Size:	4096

Details

Name:	00000020.00000003.18138191044.00000296E3E6B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E6B000
Size:	4096

Details

Name:	00000025.00000002.18579430490.00007FF569374000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569374000
Size:	8192

Details

Name:	00000020.00000002.19675189416.00007FF4FE5B3000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE5B3000
Size:	16384

Details

Name:	00000020.00000002.19676256709.00007FF4FEBEE000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBEE000
Size:	4096

Details

Name:	00000001.00000003.14714968382.000002DE9F5CA000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5CA000
Size:	20480

Details

Name:	00000020.00000003.18173451269.00000296DEBA7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA7000
Size:	16384

Details

Name:	00000020.00000003.18232316765.00000296E444E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E444E000
Size:	237568

Details

Name:	00000001.00000003.14633599722.000002DEA1C3F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3F000
Size:	69632

Details

Name:	0000001D.00000002.19663632725.0000019F0C06E000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C06E000
Size:	106496

Details

Name:	00000001.00000003.14639703831.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	73728

Details

Name:	00000001.00000002.14720766412.000002DEA1BD4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BD4000
Size:	12288

Details

Name:	00000028.00000003.18522744562.00000215F838A000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F838A000
Size:	4096

Details

Name:	00000026.00000003.18322633924.00000138BD5EA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5EA000
Size:	4096

Details

Name:	00000001.00000003.14715084055.000002DEA1B9A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B9A000
Size:	77824

Details

Name:	0000002C.00000002.19662907619.00007DF5155B0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155B0000
Size:	12288

Details

Name:	0000002D.00000002.19662323057.000001A8F8C71000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8C71000
Size:	245760

Details

Name:	00000001.00000003.14712962572.000002DE9F5CF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5CF000
Size:	12288

Details

Name:	00000020.00000003.18161203782.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	0000000D.00000000.14856846655.000000007F750000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F750000
Size:	4096

Details

Name:	0000002A.00000002.18541420109.00000227966C0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	227966C0000
Size:	4096

Details

Name:	00000020.00000003.18172415551.00000296E41EA000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41EA000
Size:	53248

Details

Name:	00000026.00000003.18355904893.00000138AA786000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA786000
Size:	20480

Details

Name:	00000001.00000003.14644628917.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	4096

Details

Name:	0000002D.00000003.18688776306.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	69632

Details

Name:	00000001.00000002.14721393558.00007FF4F8282000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8282000
Size:	20480

Details

Name:	0000002C.00000003.18647182760.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	53248

Details

Name:	0000002A.00000002.18540835296.00000227965D0000.00000004.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	227965D0000
Size:	4096

Details

Name:	0000002C.00000003.18649817993.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	00000001.00000003.14627195104.000002DEA170E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170E000
Size:	282624

Details

Name:	00000026.00000003.18353360373.00000138BCD46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD46000
Size:	266240

Details

Name:	0000002C.00000003.18657644671.0000016FFD23C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23C000
Size:	53248

Details

Name:	00000001.00000002.14721259348.00007FF4F7E22000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7E22000
Size:	4096

Details

Name:	0000002D.00000002.19663499227.000001A8F8E20000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8E20000
Size:	8192

Details

Name:	00000026.00000003.18349219133.00000138BD1CA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD1CA000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000001.00000003.14643893807.000002DEA1FAD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FAD000
Size:	32768

Details

Name:	00000020.00000003.18216582368.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	0000000D.00000000.14856889350.000000007F752000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F752000
Size:	4096

Details

Name:	00000020.00000002.19676202245.00007FF4FEBEA000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBEA000
Size:	8192

Details

Name:	0000000D.00000002.19664987517.0000000002A5E000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A5E000
Size:	16384

Details

Name:	00000001.00000003.14637851212.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	73728

Details

Name:	00000020.00000003.18185836243.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000026.00000003.18296056460.00000138BE07F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE07F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.14721666449.00007FF4F841F000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F841F000
Size:	12288

Details

Name:	00000012.00000002.19662183987.000001CCB0C13000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C13000
Size:	90112

Details

Name:	00000028.00000003.18521945781.00000215F83A3000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A3000
Size:	4096

Details

Name:	00000005.00000002.15125089906.0000000000030000.00000004.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	30000
Size:	4096

Details

Name:	0000002C.00000003.18639309978.0000016FFD226000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD226000
Size:	262144

Details

Name:	0000002C.00000003.18662591964.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000020.00000003.18139149213.00000296E3EB5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EB5000
Size:	4096

Details

Name:	00000020.00000003.18195746230.00000296E41FC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41FC000
Size:	4096

Details

Name:	00000001.00000002.14720350683.000002DEA160E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160E000
Size:	4096

Details

Name:	00000001.00000003.14628490976.000002DEA1775000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1775000
Size:	139264

Details

Name:	00000020.00000002.19677536339.00007FF4FECC7000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FECC7000
Size:	12288

Details

Name:	00000001.00000002.14722148062.00007FF4F84CC000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84CC000
Size:	8192

Details

Name:	00000020.00000003.18216102423.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000026.00000001.18231531529.00007FF78E7E0000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF78E7E0000
Size:	4096

Details

Name:	0000002C.00000003.18653393959.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	00000020.00000002.19675312696.00007FF4FE82E000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE82E000
Size:	4096

Details

Name:	0000002D.00000003.18685742393.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	53248

Details

Name:	00000001.00000003.14630292244.000002DEA15CC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15CC000
Size:	20480

Details

Name:	00000026.00000003.18301813906.00000138BCBCB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCBCB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000005.00000002.15127175509.0000000002300000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2300000
Size:	8192

Details

Name:	0000001D.00000002.19666983431.00007FF5EC0A3000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC0A3000
Size:	4096

Details

Name:	00000026.00000003.18332386315.00000138BD293000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD293000
Size:	20480

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000005.00000002.15125877405.00000000005E0000.00000020.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute read
Base address:	5E0000
Size:	40960

Details

Name:	00000020.00000003.18215725783.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000025.00000003.18223058708.0000021B53AAE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AAE000
Size:	32768

Details

Name:	0000001D.00000002.19665502667.0000019F0C802000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C802000
Size:	4096

Details

Name:	0000002A.00000002.18542367707.00007FF5C7DCC000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DCC000
Size:	12288

Details

Name:	00000020.00000002.19668619656.00000296DEB97000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB97000
Size:	12288

Details

Name:	00000026.00000003.18357837626.00000138BE354000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE354000
Size:	4096

Details

Name:	00000001.00000003.14642818457.000002DEA15A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A8000
Size:	16384

Details

Name:	00000026.00000003.18418050481.00000138BD8A1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8A1000
Size:	65536

Details

Name:	00000026.00000003.18257538901.00000138ADFB2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADFB2000
Size:	401408

Details

Name:	00000001.00000003.14625755969.000002DEA1F18000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F18000
Size:	69632

Details

Name:	0000002D.00000003.18687496903.000001A8F8CC9000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC9000
Size:	40960

Details

Name:	00000001.00000002.14722036491.00007FF4F84BC000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84BC000
Size:	12288

Details

Name:	0000002C.00000003.18661945348.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	24576

Details

Name:	00000001.00000003.14622300393.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	237568

Details

Name:	00000025.00000002.18578856410.0000021B53A9B000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	21B53A9B000
Size:	8192

Details

Name:	00000020.00000003.18216477232.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000001.00000003.14637946177.000002DEA1C2D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C2D000
Size:	65536

Details

Name:	00000020.00000003.18172285904.00000296E4175000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4175000
Size:	53248

Details

Name:	00000020.00000002.19676909234.00007FF4FEC4B000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC4B000
Size:	8192

Details

Name:	00000001.00000002.14721462593.00007FF4F82F3000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F82F3000
Size:	4096

Details

Name:	00000001.00000003.14647670725.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	0000000D.00000002.19660766024.0000000000930000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	930000
Size:	118784

Details

Name:	0000002C.00000003.18659598104.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	0000002C.00000002.19663153401.00007FF50B4F8000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B4F8000
Size:	4096

Details

Name:	00000020.00000003.18215316564.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000020.00000003.18215254250.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	0000001D.00000002.19667876304.00007FF5EC1FB000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC1FB000
Size:	49152

Details

Name:	00000001.00000002.14721914464.00007FF4F847E000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F847E000
Size:	4096

Details

Name:	00000028.00000003.18522421965.00000215F7DD0000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F7DD0000
Size:	8192

Details

Name:	00000001.00000003.14621818631.000002DEA1DFB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DFB000
Size:	77824

Details

Name:	0000002A.00000003.18538690539.0000022796F3F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F3F000
Size:	12288

Details

Name:	0000002C.00000003.18655182268.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	24576

Details

Name:	0000002C.00000003.18661763957.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	53248

Details

Name:	0000000D.00000002.19664669758.0000000002A4C000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A4C000
Size:	8192

Details

Name:	00000005.00000000.14652671447.000000007FFB0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB0000
Size:	4096

Details

Name:	0000002A.00000003.18538089986.0000022796F25000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F25000
Size:	57344

Details

Name:	00000001.00000003.14648259729.000002DEA1D09000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D09000
Size:	122880

Details

Name:	00000001.00000002.14719064352.000002DEA1320000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DEA1320000
Size:	925696

Details

Name:	0000002D.00000002.19663371706.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	45056

Details

Name:	00000020.00000002.19661207561.000000B1357FF000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1357FF000
Size:	4096

Details

Name:	0000002C.00000002.19662424032.0000016FFD430000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD430000
Size:	8192

Details

Name:	00000001.00000003.14631644542.000002DEA1B91000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B91000
Size:	65536

Details

Name:	00000020.00000002.19675258894.00007FF4FE7E2000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE7E2000
Size:	8192

Details

Name:	00000001.00000003.14714554292.000002DE9F748000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F748000
Size:	4096

Details

Name:	0000002D.00000003.18671289417.000001A8F8C30000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8C30000
Size:	65536

Details

Name:	0000002D.00000002.19665317045.00007FF5AFA90000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA90000
Size:	20480

Details

Name:	0000002D.00000002.19663658463.000001A8F8FC0000.00000004.00000040.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1A8F8FC0000
Size:	12288

Details

Name:	00000020.00000002.19677383514.00007FF4FEC9D000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC9D000
Size:	8192

Details

Name:	00000020.00000003.18174161996.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	4096

Details

Name:	00000020.00000003.18160611988.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000026.00000003.18313475870.00000138BEA1E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEA1E000
Size:	266240

Details

Name:	00000005.00000002.15126574292.00000000021E0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	21E0000
Size:	4096

Details

Name:	00000012.00000002.19668960056.00007FF5676E0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676E0000
Size:	4096

Details

Name:	00000026.00000003.18335360002.00000138BE958000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE958000
Size:	266240

Details

Name:	00000001.00000003.14713002307.000002DEA1611000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1611000
Size:	430080

Details

Name:	00000012.00000002.19665947108.000001CCB1502000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1502000
Size:	323584

Details

Name:	00000001.00000003.14640880135.000002DEA170E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170E000
Size:	286720

Details

Name:	00000020.00000002.19664629132.00000296DE288000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE288000
Size:	4096

Details

Name:	00000020.00000003.18174969275.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000026.00000003.18311122933.00000138BC9C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BC9C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000005.00000002.15126281972.00000000008EF000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	8EF000
Size:	4096

Details

Name:	00000020.00000003.18202003550.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000026.00000003.18252515965.00000138ADB0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADB0C000
Size:	1716224

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002A.00000002.18541855094.00000227969A0000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	227969A0000
Size:	12288

Details

Name:	00000012.00000002.19661831623.000001CCB0BE1000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0BE1000
Size:	12288

Details

Name:	00000001.00000003.14639554029.000002DEA1C19000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C19000
Size:	81920

Details

Name:	00000001.00000003.14624610319.000002DEA1EF4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EF4000
Size:	69632

Details

Name:	00000020.00000003.18205390768.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000003.14624947618.000002DEA1EE2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EE2000
Size:	69632

Details

Name:	00000020.00000003.18219889085.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	24576

Details

Name:	00000020.00000003.18139125706.00000296E3EB3000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EB3000
Size:	4096

Details

Name:	0000002C.00000003.18644142839.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	53248

Details

Name:	00000020.00000003.18189859699.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	0000002A.00000002.18542541136.00007FF5C7DF0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DF0000
Size:	4096

Details

Name:	00000001.00000002.14722389024.00007FF4F84F9000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84F9000
Size:	32768

Details

Name:	0000002C.00000003.18640600064.0000016FFD229000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD229000
Size:	28672

Details

Name:	00000020.00000000.18136516157.00007DF508B92000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B92000
Size:	4096

Details

Name:	0000002A.00000003.18539679590.0000022796F1E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F1E000
Size:	8192

Details

Name:	00000026.00000003.18254509260.00000138ADCE6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCE6000
Size:	4096

Details

Name:	0000000D.00000002.19675151785.000000001E95F000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E95F000
Size:	4096

Details

Name:	0000001D.00000002.19665831129.00007DF5F61D0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61D0000
Size:	4096

Details

Name:	0000002C.00000003.18660664913.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000001.00000003.14714647716.000002DEA157C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA157C000
Size:	12288

Details

Name:	00000025.00000002.18579914182.00007FF56963D000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56963D000
Size:	8192

Details

Name:	00000005.00000002.15125756736.00000000004A1000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	4A1000
Size:	12288

Details

Name:	00000005.00000000.14652755704.000000007FFC2000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC2000
Size:	4096

Details

Name:	00000028.00000002.18523255039.00000215F7A80000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7A80000
Size:	118784

Details

Name:	00000026.00000003.18313447631.00000138BE9DC000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE9DC000
Size:	4096

Details

Name:	00000001.00000002.14722320165.00007FF4F84EB000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84EB000
Size:	20480

Details

Name:	0000002A.00000002.18542409028.00007FF5C7DD0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DD0000
Size:	12288

Details

Name:	00000020.00000003.18146251093.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000020.00000002.19668040537.00000296DEB70000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB70000
Size:	4096

Details

Name:	00000026.00000003.18417342866.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	40960

Details

Name:	00000001.00000003.14716428356.000002DE9F59C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F59C000
Size:	24576

Details

Name:	00000001.00000002.14721428170.00007FF4F829B000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F829B000
Size:	12288

Details

Name:	0000000D.00000002.19662886983.000000000298B000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	298B000
Size:	8192

Details

Name:	00000026.00000003.18270980354.00000138AED51000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AED51000
Size:	8192

Details

Name:	00000026.00000003.18321955018.00000138BDDEA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDDEA000
Size:	4096

Details

Name:	00000020.00000002.19670534299.00000296DF850000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF850000
Size:	65536

Details

Name:	00000020.00000002.19674654187.00007FF4FE22E000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE22E000
Size:	4096

Details

Name:	00000026.00000003.18429655870.00000138BE6F0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6F0000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000000D.00000002.19665672182.00000000030C0000.00000004.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	30C0000
Size:	4096

Details

Name:	00000001.00000002.14722767410.00007FF4F8550000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8550000
Size:	24576

Details

Name:	0000002A.00000002.18541077154.0000022796610000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	22796610000
Size:	12288

Details

Name:	00000001.00000003.14627492181.000002DEA175A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA175A000
Size:	28672

Details

Name:	00000020.00000003.18160040474.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000026.00000003.18352645990.00000138BD188000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD188000
Size:	4096

Details

Name:	00000026.00000003.18342802049.00000138BE49E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE49E000
Size:	4096

Details

Name:	00000020.00000002.19677263303.00007FF4FEC8C000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC8C000
Size:	20480

Details

Name:	00000020.00000003.18190792913.00000296E4424000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4424000
Size:	233472

Details

Name:	0000000D.00000002.19664895627.0000000002A59000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A59000
Size:	4096

Details

Name:	00000012.00000002.19662702101.000001CCB0C40000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C40000
Size:	94208

Details

Name:	00000001.00000003.14638363513.000002DEA1608000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1608000
Size:	28672

Details

Name:	0000002A.00000003.18537633721.0000022796F3E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F3E000
Size:	16384

Details

Name:	00000001.00000003.14709765788.000002DE9F597000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F597000
Size:	12288

Details

Name:	00000020.00000003.18146763738.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000001.00000002.14720201379.000002DEA15A1000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A1000
Size:	12288

Details

Name:	00000026.00000003.18333202472.00000138BCD05000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD05000
Size:	196608

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000028.00000002.18524144340.00007DF539A02000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A02000
Size:	4096

Details

Name:	00000001.00000003.14624865857.000002DEA1ED0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1ED0000
Size:	69632

Details

Name:	00000026.00000003.18335959582.00000138BD20C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD20C000
Size:	77824

Details

Name:	00000026.00000003.18326149339.00000138BCC0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCC0C000
Size:	266240

Details

Name:	00000001.00000003.14624226484.000002DEA1EA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA2000
Size:	102400

Details

Name:	00000005.00000002.15125647868.0000000000413000.00000004.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	413000
Size:	12288

Details

Name:	0000002C.00000003.18656831294.0000016FFD23A000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23A000
Size:	28672

Details

Name:	00000028.00000002.18523434677.00000215F7AA0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7AA0000
Size:	12288

Details

Name:	0000002D.00000002.19664747847.00007FF5AF938000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AF938000
Size:	4096

Details

Name:	0000002D.00000002.19663595827.000001A8F8E90000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8E90000
Size:	4096

Details

Name:	00000026.00000003.18423451488.00000138BD45E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45E000
Size:	4096

Details

Name:	00000025.00000002.18579496697.00007FF56952F000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56952F000
Size:	12288

Details

Name:	0000001D.00000002.19663488480.0000019F0C068000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C068000
Size:	20480

Details

Name:	00000020.00000003.18215978812.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000026.00000003.18292032651.00000138BCE88000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE88000
Size:	28672

Details

Name:	00000026.00000003.18332439507.00000138BD299000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD299000
Size:	8192

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000012.00000002.19661936487.000001CCB0C00000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C00000
Size:	73728

Details

Name:	00000026.00000003.18345142336.00000138BCDE5000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCDE5000
Size:	155648

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18307265419.00000138BE9EC000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE9EC000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000012.00000002.19660943011.000001CCB0A70000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0A70000
Size:	4096

Details

Name:	0000001D.00000002.19668623690.00007FF5EC290000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC290000
Size:	4096

Details

Name:	00000020.00000003.18216321027.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	0000002A.00000000.18526334128.00007DF5D1D32000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D32000
Size:	4096

Details

Name:	00000026.00000003.18333419968.00000138BCD37000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD37000
Size:	57344

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14642967534.000002DEA1BBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BBC000
Size:	20480

Details

Name:	0000002C.00000003.18634288336.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	61440

Details

Name:	00000001.00000003.14640057528.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	73728

Details

Name:	00000020.00000003.18147195248.00000296E4360000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4360000
Size:	4096

Details

Name:	0000000D.00000002.19662808642.0000000002987000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2987000
Size:	8192

Details

Name:	00000020.00000003.18191791407.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	0000002D.00000002.19665248941.00007FF5AFA8C000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA8C000
Size:	8192

Details

Name:	00000001.00000003.14625841209.000002DEA1F2A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F2A000
Size:	69632

Details

Name:	0000002A.00000003.18536993712.0000022796F24000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F24000
Size:	102400

Details

Name:	0000002D.00000002.19662045532.000001A8F8C5C000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8C5C000
Size:	32768

Details

Name:	0000000D.00000002.19675314794.000000007F5E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F5E0000
Size:	20480

Details

Name:	0000002D.00000003.18692610419.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	4096

Details

Name:	0000002A.00000002.18542501581.00007FF5C7DEB000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7DEB000
Size:	8192

Details

Name:	0000002C.00000003.18663793413.0000016FFD240000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD240000
Size:	49152

Details

Name:	00000020.00000003.18217162152.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000026.00000003.18274064439.00000138AF017000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AF017000
Size:	397312

Details

Name:	00000020.00000003.18215775925.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000001.00000003.14646422573.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	0000000D.00000002.19661673438.0000000000BB0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	BB0000
Size:	4096

Details

Name:	00000026.00000003.18343140074.00000138BE0C0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE0C0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	0000002D.00000003.18686458178.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	61440

Details

Name:	00000012.00000002.19666941333.000001CCB1567000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB1567000
Size:	4096

Details

Name:	00000028.00000003.18521879591.00000215F83A2000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83A2000
Size:	8192

Details

Name:	00000026.00000003.18303628807.00000138BE85F000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE85F000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	0000002D.00000003.18691952287.000001A8F8CC1000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC1000
Size:	86016

Details

Name:	00000026.00000003.18331438770.00000138BD6F2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD6F2000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000001D.00000002.19665921948.00007DF5F61D2000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61D2000
Size:	4096

Details

Name:	0000000D.00000002.19668777561.0000000004A79000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	4A79000
Size:	24576

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000005.00000002.15125531159.0000000000400000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000026.00000003.18337502514.00000138BD081000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD081000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000028.00000003.18521346901.00000215F83DE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83DE000
Size:	20480

Details

Name:	00000020.00000003.18217056286.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000001.00000003.14623936829.000002DEA1E1E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E1E000
Size:	24576

Details

Name:	00000026.00000003.18347020004.00000138BDD25000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD25000
Size:	16384

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000020.00000002.19674204950.00007DF508B90000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B90000
Size:	4096

Details

Name:	00000025.00000000.18201541237.00007FF7202D1000.00000020.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF7202D1000
Size:	188416

Details

Name:	00000001.00000003.14715824774.000002DEA15BD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BD000
Size:	16384

Details

Name:	00000020.00000003.18139068334.00000296E3EAF000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EAF000
Size:	4096

Details

Name:	0000000D.00000002.19674589578.000000001E140000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E140000
Size:	53248

Details

Name:	00000020.00000003.18190124580.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000020.00000002.19676646775.00007FF4FEC2C000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC2C000
Size:	12288

Details

Name:	00000005.00000000.14652698639.000000007FFB2000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB2000
Size:	4096

Details

Name:	00000001.00000002.14717065125.000000EDDBCFE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDBCFE000
Size:	8192

Details

Name:	00000026.00000003.18231972104.00000138AA9D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA9D0000
Size:	184320

Details

Name:	00000020.00000003.18146429976.00000296DEBC8000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBC8000
Size:	122880

Details

Name:	00000020.00000003.18175192375.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000020.00000003.18137901164.00000296E3E5F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E5F000
Size:	8192

Details

Name:	0000002A.00000002.18542140030.00007DF5D1D40000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D40000
Size:	12288

Details

Name:	0000002D.00000000.18670747485.00007FF7B5879000.00000008.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF7B5879000
Size:	8192

Details

Name:	00000026.00000003.18434126759.00000138BD891000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD891000
Size:	65536

Details

Name:	00000020.00000003.18172091807.00000296E4182000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4182000
Size:	20480

Details

Name:	00000020.00000003.18160189572.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000012.00000002.19664965907.000001CCB0E00000.00000004.00000040.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1CCB0E00000
Size:	4096

Details

Name:	00000020.00000002.19665183104.00000296DE2A5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE2A5000
Size:	4096

Details

Name:	0000002C.00000003.18645177895.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	57344

Details

Name:	00000026.00000003.18326758768.00000138BE41A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE41A000
Size:	4096

Details

Name:	00000026.00000003.18275710993.00000138AA767000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA767000
Size:	262144

Details

Name:	0000002C.00000002.19663654754.00007FF50B676000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B676000
Size:	8192

Details

Name:	00000020.00000003.18201949805.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000001.00000002.14721367945.00007FF4F80DB000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F80DB000
Size:	4096

Details

Name:	00000020.00000003.18245982178.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	65536

Details

Name:	00000001.00000002.14721051208.00007DF502420000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502420000
Size:	4096

Details

Name:	00000001.00000002.14720905351.000002DEA1FA0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FA0000
Size:	36864

Details

Name:	0000002C.00000003.18651114774.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	28672

Details

Name:	0000002C.00000003.18653892288.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	0000000D.00000002.19666645419.00000000031DA000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	31DA000
Size:	8192

Details

Name:	0000002C.00000003.18655833344.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	61440

Details

Name:	00000001.00000003.14615489723.000002DE9F5B4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5B4000
Size:	32768

Details

Name:	0000002C.00000003.18652157728.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	65536

Details

Name:	00000001.00000003.14631285369.000002DEA17E5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17E5000
Size:	77824

Details

Name:	00000020.00000002.19669479733.00000296DEBDD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBDD000
Size:	40960

Details

Name:	0000002D.00000002.19666073328.00007FF5AFAF0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAF0000
Size:	4096

Details

Name:	0000002D.00000003.18683551606.000001A8F8CC0000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC0000
Size:	65536

Details

Name:	0000002C.00000003.18647047530.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	57344

Details

Name:	0000000D.00000002.19664404531.0000000002A32000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A32000
Size:	32768

Details

Name:	00000028.00000003.18522590669.00000215F8380000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8380000
Size:	4096

Details

Name:	00000025.00000002.18578442764.0000021B53A10000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A10000
Size:	4096

Details

Name:	00000028.00000002.18525128603.00007FF52FB40000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB40000
Size:	24576

Details

Name:	0000000D.00000002.19675627029.000000007F760000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F760000
Size:	12288

Details

Name:	00000025.00000002.18579081319.0000021B53C60000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53C60000
Size:	8192

Details

Name:	00000001.00000003.14712339553.000002DE9F50B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F50B000
Size:	16384

Details

Name:	00000020.00000003.18138878846.00000296E3E9E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E9E000
Size:	4096

Details

Name:	00000026.00000003.18309284780.00000138BD4E2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4E2000
Size:	4096

Details

Name:	00000028.00000002.18524816520.00007FF52FAE6000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAE6000
Size:	8192

Details

Name:	0000000D.00000002.19667070174.00000000031FF000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	31FF000
Size:	36864

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	0000002C.00000003.18658928609.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000020.00000003.18220348953.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000001.00000003.14625398019.000002DEA1DEB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DEB000
Size:	12288

Details

Name:	0000000D.00000002.19662249990.000000000288B000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	288B000
Size:	16384

Details

Name:	00000012.00000002.19661492570.000001CCB0AB0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0AB0000
Size:	4096

Details

Name:	00000020.00000003.18216145705.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	0000001D.00000002.19668228582.00007FF5EC270000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC270000
Size:	12288

Details

Name:	00000020.00000002.19675012353.00007FF4FE58F000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE58F000
Size:	8192

Details

Name:	00000020.00000003.18218917876.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000001.00000002.14718977177.000002DE9FAD0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9FAD0000
Size:	4096

Details

Name:	0000002D.00000003.18684875174.000001A8F8CC2000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC2000
Size:	110592

Details

Name:	00000020.00000002.19666205395.00000296DE850000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE850000
Size:	4096

Details

Name:	00000026.00000003.18339794865.00000138BD272000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD272000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000003.14715491185.000002DE9F510000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F510000
Size:	24576

Details

Name:	0000000D.00000002.19674840348.000000001E77F000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E77F000
Size:	4096

Details

Name:	00000020.00000002.19662121073.00000296DE110000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE110000
Size:	4096

Details

Name:	00000005.00000002.15125257972.0000000000097000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	97000
Size:	36864

Details

Name:	00000001.00000003.14644439803.000002DEA1BD8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BD8000
Size:	32768

Details

Name:	00000001.00000003.14646509590.000002DEA200C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200C000
Size:	4096

Details

Name:	00000001.00000003.14620417395.000002DEA1D61000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D61000
Size:	69632

Details

Name:	00000020.00000003.18204687054.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	0000002C.00000003.18641434311.0000016FFD229000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD229000
Size:	28672

Details

Name:	00000026.00000003.18299675099.00000138BE03D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE03D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18138736881.00000296E3E94000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E94000
Size:	4096

Details

Name:	00000001.00000003.14638569710.000002DEA1BB7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB7000
Size:	8192

Details

Name:	00000028.00000003.18522015416.00000215F8383000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	215F8383000
Size:	8192

Details

Name:	0000001D.00000003.18434396874.0000019F0C0BB000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C0BB000
Size:	8192

Details

Name:	00000020.00000003.18138305438.00000296E3E6F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E6F000
Size:	4096

Details

Name:	0000002D.00000002.19666137117.00007FF5AFB1F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFB1F000
Size:	20480

Details

Name:	00000001.00000003.14627173701.000002DEA1F60000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F60000
Size:	4096

Details

Name:	00000020.00000003.18172173506.00000296E4188000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4188000
Size:	4096

Details

Name:	00000020.00000002.19664670368.00000296DE28C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE28C000
Size:	4096

Details

Name:	0000002C.00000003.18644952949.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	57344

Details

Name:	00000028.00000002.18523214651.00000215F7A70000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7A70000
Size:	4096

Details

Name:	00000001.00000002.14718869602.000002DE9F950000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F950000
Size:	69632

Details

Name:	00000020.00000003.18145907765.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	0000002A.00000002.18542883415.00007FF5C7E40000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E40000
Size:	4096

Details

Name:	00000026.00000003.18437035378.00000138BDFFA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFFA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18418444957.00000138BD891000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD891000
Size:	65536

Details

Name:	00000001.00000003.14613577648.000002DEA1443000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1443000
Size:	24576

Details

Name:	0000002C.00000003.18641898884.0000016FFD22E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22E000
Size:	28672

Details

Name:	00000001.00000002.14718743325.000002DE9F745000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2DE9F745000
Size:	12288

Details

Name:	00000026.00000003.18319809510.00000138BD356000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD356000
Size:	69632

Details

Name:	00000020.00000003.18146584947.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000025.00000002.18580059722.00007FF7202D1000.00000020.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF7202D1000
Size:	188416

Details

Name:	0000001D.00000000.18133667314.00007DF5F61C2000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61C2000
Size:	4096

Details

Name:	00000028.00000002.18523551966.00000215F7BB0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	215F7BB0000
Size:	4096

Details

Name:	0000002C.00000000.18613480392.00007DF5155A0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155A0000
Size:	4096

Details

Name:	0000001D.00000002.19661976293.0000019F0BF41000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BF41000
Size:	12288

Details

Name:	00000005.00000002.15127395602.0000000002C00000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2C00000
Size:	925696

Details

Name:	00000020.00000002.19673099335.00000296E4174000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4174000
Size:	86016

Details

Name:	0000002A.00000003.18538523154.0000022796E65000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E65000
Size:	12288

Details

Name:	00000028.00000003.18519764977.00000215F83D5000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83D5000
Size:	57344

Details

Name:	0000000D.00000002.19674877459.000000001E89C000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E89C000
Size:	16384

Details

Name:	00000001.00000002.14717259431.000002DE9F3D0000.00000004.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	2DE9F3D0000
Size:	4096

Details

Name:	00000001.00000002.14722006475.00007FF4F84B7000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84B7000
Size:	12288

Details

Name:	00000001.00000003.14715347429.000002DE9F5D0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D0000
Size:	8192

Details

Name:	0000002C.00000003.18646641997.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	28672

Details

Name:	00000026.00000003.18355114171.00000138BD45E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45E000
Size:	4096

Details

Name:	00000001.00000003.14620671201.000002DEA1D97000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D97000
Size:	69632

Details

Name:	00000005.00000002.15128409009.0000000002D00000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2D00000
Size:	12288

Details

Name:	00000001.00000003.14622842103.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	237568

Details

Name:	0000002C.00000003.18642633856.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	61440

Details

Name:	0000001D.00000002.19661828199.0000019F0BF00000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BF00000
Size:	4096

Details

Name:	0000002C.00000002.19663990273.00007FF50B6B0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B6B0000
Size:	4096

Details

Name:	00000001.00000002.14722592425.00007FF4F852D000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F852D000
Size:	8192

Details

Name:	0000002D.00000003.18688147204.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	57344

Details

Name:	0000002A.00000003.18539881335.0000022796EF0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EF0000
Size:	8192

Details

Name:	00000020.00000003.18202627445.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000026.00000003.18434541709.00000138BCA49000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA49000
Size:	4096

Details

Name:	0000000D.00000000.14856797320.000000007F742000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F742000
Size:	4096

Details

Name:	00000012.00000002.19660868565.000001CCB0A60000.00000004.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1CCB0A60000
Size:	4096

Details

Name:	00000001.00000003.14712885872.000002DE9F5A9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A9000
Size:	57344

Details

Name:	0000001D.00000002.19662116519.0000019F0BFE0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BFE0000
Size:	8192

Details

Name:	00000001.00000003.14715420113.000002DE9F5A7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5A7000
Size:	8192

Details

Name:	00000026.00000000.18230385694.00007DF5CF150000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5CF150000
Size:	12288

Details

Name:	00000020.00000003.18234101631.00000296E40A6000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40A6000
Size:	53248

Details

Name:	00000026.00000000.18230500250.00007FF78E7E0000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF78E7E0000
Size:	4096

Details

Name:	00000020.00000002.19674952776.00007FF4FE576000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE576000
Size:	4096

Details

Name:	0000002D.00000002.19665677031.00007FF5AFAC5000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAC5000
Size:	12288

Details

Name:	00000026.00000003.18356753862.00000138BDCA0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCA0000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000025.00000003.18229277066.0000021B53AAE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AAE000
Size:	65536

Details

Name:	0000000D.00000002.19662596869.00000000028DA000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28DA000
Size:	12288

Details

Name:	00000026.00000003.18302098451.00000138BCC0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCC0C000
Size:	266240

Details

Name:	00000020.00000003.18146843256.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000020.00000003.18137963115.00000296E3E62000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E62000
Size:	4096

Details

Name:	0000002C.00000003.18631035113.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	262144

Details

Name:	00000026.00000003.18432327757.00000138BCA46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA46000
Size:	8192

Details

Name:	0000002C.00000003.18643916682.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	69632

Details

Name:	00000028.00000003.18521631656.00000215F83B8000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B8000
Size:	8192

Details

Name:	00000020.00000003.18244542811.00000296E4467000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4467000
Size:	4096

Details

Name:	0000002A.00000002.18542919633.00007FF5C7E60000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E60000
Size:	24576

Details

Name:	00000001.00000003.14642736312.000002DEA200D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200D000
Size:	12288

Details

Name:	00000020.00000003.18204007131.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000026.00000003.18332517389.00000138BD29C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD29C000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000026.00000003.18338078941.00000138BD104000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD104000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18325990385.00000138BCBB2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCBB2000
Size:	12288

Details

Name:	00000001.00000003.14645668298.000002DEA200C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200C000
Size:	4096

Details

Name:	00000020.00000002.19664750464.00000296DE290000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE290000
Size:	32768

Details

Name:	0000001D.00000002.19669038764.00007FF5EC2CC000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2CC000
Size:	20480

Details

Name:	00000020.00000003.18205220736.00000296E402C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402C000
Size:	40960

Details

Name:	00000005.00000002.15125389461.00000000001C0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1C0000
Size:	4096

Details

Name:	00000001.00000002.14722360717.00007FF4F84F6000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84F6000
Size:	8192

Details

Name:	00000020.00000002.19671510922.00000296E3F50000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F50000
Size:	20480

Details

Name:	00000026.00000003.18338608248.00000138BCE85000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE85000
Size:	8192

Details

Name:	0000002A.00000000.18526235705.00007DF5D1D20000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D20000
Size:	4096

Details

Name:	00000001.00000003.14623083821.000002DEA1EA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA2000
Size:	102400

Details

Name:	00000001.00000003.14621751787.000002DEA1DE7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DE7000
Size:	53248

Details

Name:	00000020.00000003.18172232583.00000296E418A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E418A000
Size:	4096

Details

Name:	00000001.00000003.14632006569.000002DEA17E2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17E2000
Size:	12288

Details

Name:	00000020.00000003.18172607097.00000296E41B5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B5000
Size:	49152

Details

Name:	00000001.00000003.14625462021.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	139264

Details

Name:	00000001.00000002.14721536403.00007FF4F8378000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8378000
Size:	4096

Details

Name:	00000001.00000002.14722445135.00007FF4F8503000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8503000
Size:	24576

Details

Name:	00000020.00000003.18189956915.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	4096

Details

Name:	0000001D.00000002.19666915280.00007FF5EC07D000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC07D000
Size:	4096

Details

Name:	0000001D.00000002.19663934620.0000019F0C089000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C089000
Size:	28672

Details

Name:	00000001.00000003.14614144109.000002DE9F748000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F748000
Size:	16384

Details

Name:	00000020.00000003.18186956183.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000026.00000003.18311996338.00000138BDE2C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDE2C000
Size:	184320

Details

Name:	0000000D.00000002.19665216837.0000000002A67000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A67000
Size:	24576

Details

Name:	00000028.00000002.18524773562.00007FF52FAD5000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAD5000
Size:	8192

Details

Name:	00000012.00000002.19667942448.00007FF567652000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567652000
Size:	4096

Details

Name:	0000002C.00000003.18644540529.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	28672

Details

Name:	0000002D.00000002.19666302185.00007FF7B57C1000.00000020.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF7B57C1000
Size:	614400

Details

Name:	00000020.00000003.18217587525.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000026.00000003.18321011551.00000138BD988000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD988000
Size:	4096

Details

Name:	00000020.00000003.18138708930.00000296E3E92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E92000
Size:	4096

Details

Name:	00000001.00000003.14714933178.000002DE9F5C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5C4000
Size:	16384

Details

Name:	00000001.00000003.14634715243.000002DEA1C99000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C99000
Size:	69632

Details

Name:	00000026.00000003.18424772773.00000138BCA48000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA48000
Size:	8192

Details

Name:	0000000D.00000002.19667257591.000000000320D000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	320D000
Size:	20480

Details

Name:	00000025.00000002.18580408167.00007FF72030E000.00000004.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF72030E000
Size:	12288

Details

Name:	00000001.00000002.14717598880.000002DE9F440000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F440000
Size:	12288

Details

Name:	00000012.00000002.19665148242.000001CCB1030000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB1030000
Size:	16384

Details

Name:	0000002D.00000003.18688905816.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	53248

Details

Name:	00000026.00000003.18320110016.00000138BD398000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD398000
Size:	4096

Details

Name:	0000000D.00000002.19674952257.000000001E8D5000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E8D5000
Size:	12288

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery

Details

Name:	00000028.00000003.18521410744.00000215F83C0000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83C0000
Size:	16384

Details

Name:	0000001D.00000002.19667722343.00007FF5EC1F0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC1F0000
Size:	32768

Details

Name:	00000020.00000003.18173704644.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	4096

Details

Name:	0000002D.00000002.19660961539.000001A8F8BA0000.00000004.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1A8F8BA0000
Size:	4096

Details

Name:	00000025.00000002.18579796086.00007FF569609000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569609000
Size:	4096

Details

Name:	0000002A.00000002.18541343972.00000227966B0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	227966B0000
Size:	4096

Details

Name:	0000002A.00000003.18535544580.0000022796EFA000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EFA000
Size:	471040

Details

Name:	00000020.00000003.18219213072.00000296E41B9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B9000
Size:	61440

Details

Name:	00000026.00000003.18334212352.00000138BDCB4000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCB4000
Size:	184320

Details

Name:	00000001.00000003.14715182105.000002DEA1BAE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BAE000
Size:	28672

Details

Name:	00000001.00000003.14628125204.000002DEA1FB4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB4000
Size:	4096

Details

Name:	00000001.00000003.14640853046.000002DEA170A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170A000
Size:	8192

Details

Name:	00000026.00000003.18291478941.00000138BCE0D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE0D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000002.19660641920.0000006AB437E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6AB437E000
Size:	8192

Details

Name:	0000001D.00000002.19668392554.00007FF5EC27C000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC27C000
Size:	8192

Details

Name:	0000002C.00000003.18665955375.0000016FFD243000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD243000
Size:	262144

Details

Name:	00000012.00000002.19665042928.000001CCB0E30000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0E30000
Size:	8192

Details

Name:	0000002A.00000003.18540307507.0000022796E60000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E60000
Size:	4096

Details

Name:	00000001.00000003.14614108960.000002DEA14BC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14BC000
Size:	20480

Details

Name:	00000001.00000003.14614563361.000002DEA1423000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1423000
Size:	20480

Details

Name:	00000020.00000002.19664488169.00000296DE27F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE27F000
Size:	8192

Details

Name:	0000000D.00000000.14856485559.0000000000930000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	930000
Size:	118784

Details

Name:	00000001.00000003.14642848315.000002DEA15AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AF000
Size:	45056

Details

Name:	00000026.00000003.18294896300.00000138AA7A3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7A3000
Size:	65536

Details

Name:	0000002C.00000003.18643082706.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	28672

Details

Name:	00000012.00000002.19661760275.000001CCB0BD0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0BD0000
Size:	4096

Details

Name:	00000020.00000002.19669114476.00000296DEBBC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBBC000
Size:	32768

Details

Name:	00000001.00000003.14638022437.000002DEA1C3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3E000
Size:	49152

Details

Name:	0000002C.00000002.19661723639.0000016FFD1FC000.00000004.00000020.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16FFD1FC000
Size:	69632

Details

Name:	00000001.00000003.14634919346.000002DEA1CC6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CC6000
Size:	65536

Details

Name:	00000001.00000003.14628957823.000002DEA15BB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BB000
Size:	24576

Details

Name:	00000012.00000000.18108217529.00007DF5715C0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715C0000
Size:	4096

Details

Name:	0000001D.00000002.19665673254.00007DF5F61C0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61C0000
Size:	4096

Details

Name:	00000001.00000003.14631594008.000002DEA17E2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17E2000
Size:	12288

Details

Name:	00000012.00000002.19668395931.00007FF567695000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567695000
Size:	8192

Details

Name:	00000001.00000003.14614175474.000002DE9F74E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74E000
Size:	4096

Details

Name:	00000005.00000002.15125987432.00000000005FA000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	5FA000
Size:	8192

Details

Name:	00000001.00000003.14642227636.000002DEA1BB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB8000
Size:	4096

Details

Name:	00000005.00000000.14652528708.0000000000401000.00000020.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	73728

Details

Name:	0000002D.00000003.18692754260.000001A8F8CCA000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCA000
Size:	49152

Details

Name:	00000020.00000003.18176240255.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000001.00000003.14612407351.000002DEA14C8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14C8000
Size:	73728

Details

Name:	00000020.00000003.18218398969.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000003.18230041311.00000296E41B5000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41B5000
Size:	16384

Details

Name:	0000002C.00000002.19663914497.00007FF50B6AD000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B6AD000
Size:	8192

Details

Name:	00000001.00000003.14642579815.000002DEA1BC1000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BC1000
Size:	139264

Details

Name:	00000020.00000002.19671784693.00000296E4013000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4013000
Size:	77824

Details

Name:	00000020.00000002.19672509123.00000296E4115000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4115000
Size:	139264

Details

Name:	00000001.00000002.14721194909.00007FF4F7C3A000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7C3A000
Size:	8192

Details

Name:	00000026.00000003.18355154038.00000138BCFDB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCFDB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000003.18187039848.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000026.00000003.18354767535.00000138BD7B8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD7B8000
Size:	4096

Details

Name:	0000002D.00000002.19661633816.000001A8F8C10000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8C10000
Size:	4096

Details

Name:	00000020.00000003.18219063030.00000296E4472000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4472000
Size:	122880

Details

Name:	00000001.00000003.14643771099.000002DEA1BAF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BAF000
Size:	24576

Details

Name:	0000002A.00000003.18539392684.0000022796F17000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F17000
Size:	36864

Details

Name:	00000026.00000003.18277278835.00000138AA797000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA797000
Size:	65536

Details

Name:	00000020.00000003.18221223854.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	0000002A.00000003.18539452827.0000022796F10000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F10000
Size:	16384

Details

Name:	0000001D.00000002.19664719522.0000019F0C113000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C113000
Size:	20480

Details

Name:	00000005.00000003.14856970485.000000001C401000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1C401000
Size:	49152

Details

Name:	0000002D.00000003.18692290677.000001A8F8CBE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBE000
Size:	12288

Details

Name:	00000020.00000003.18174194837.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	00000020.00000003.18205577643.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000003.18215547963.00000296DEBA7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA7000
Size:	16384

Details

Name:	00000020.00000002.19662803796.00000296DE1B0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE1B0000
Size:	4096

Details

Name:	00000005.00000002.15127266632.0000000002B50000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2B50000
Size:	4096

Details

Name:	00000020.00000003.18219645787.00000296E402C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402C000
Size:	40960

Details

Name:	00000001.00000002.14721696011.00007FF4F8425000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8425000
Size:	8192

Details

Name:	00000026.00000003.18358541384.00000138BD24E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD24E000
Size:	4096

Details

Name:	00000028.00000003.18518085526.00000215F839E000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F839E000
Size:	49152

Details

Name:	00000001.00000003.14646898934.000002DEA1C76000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C76000
Size:	69632

Details

Name:	00000020.00000002.19670036480.00000296DF810000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF810000
Size:	65536

Details

Name:	00000026.00000003.18317693069.00000138BDA4E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA4E000
Size:	4096

Details

Name:	00000005.00000002.15126355628.0000000000A30000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	A30000
Size:	32768

Details

Name:	00000020.00000002.19674250350.00007DF508B92000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B92000
Size:	4096

Details

Name:	00000001.00000002.14717296976.000002DE9F3E0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F3E0000
Size:	4096

Details

Name:	00000026.00000003.18345996082.00000138BD104000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD104000
Size:	266240

Details

Name:	00000025.00000002.18578286939.0000006DF807C000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6DF807C000
Size:	16384

Details

Name:	00000020.00000002.19661091861.000000B1356FE000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1356FE000
Size:	8192

Details

Name:	00000001.00000003.14713457690.000002DEA16B0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B0000
Size:	8192

Details

Name:	0000002A.00000002.18542330954.00007FF5C7D49000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7D49000
Size:	4096

Details

Name:	00000001.00000003.14710835140.000002DEA1763000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1763000
Size:	4096

Details

Name:	00000025.00000003.18577929697.0000021B53AC1000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AC1000
Size:	12288

Details

Name:	00000026.00000003.18239089160.00000138AA765000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA765000
Size:	262144

Details

Name:	00000001.00000003.14623589862.000002DEA1E35000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E35000
Size:	53248

Details

Name:	00000020.00000003.18159855221.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000020.00000003.18221333976.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	24576

Details

Name:	00000026.00000003.18352288672.00000138BE99A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE99A000
Size:	4096

Details

Name:	00000026.00000003.18294135244.00000138BC9C2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BC9C2000
Size:	266240

Details

Name:	0000002D.00000003.18681432018.000001A8F8CBE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBE000
Size:	49152

Details

Name:	0000002C.00000003.18648907988.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	28672

Details

Name:	0000002C.00000003.18623356210.0000016FFD221000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD221000
Size:	114688

Details

Name:	00000028.00000003.18522339425.00000215F8397000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8397000
Size:	28672

Details

Name:	00000001.00000003.14632161215.000002DEA1BA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BA2000
Size:	102400

Details

Name:	0000002C.00000003.18632302486.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	77824

Details

Name:	0000002A.00000002.18542099228.00007DF5D1D32000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D32000
Size:	4096

Details

Name:	00000028.00000003.18519369711.00000215F83F9000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83F9000
Size:	147456

Details

Name:	00000001.00000003.14643657952.000002DEA1B91000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B91000
Size:	94208

Details

Name:	00000001.00000003.14716316718.000002DEA160D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA160D000
Size:	8192

Details

Name:	00000001.00000003.14643004645.000002DEA1BC4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BC4000
Size:	114688

Details

Name:	00000025.00000000.18201504400.00007FF7202D0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7202D0000
Size:	4096

Details

Name:	0000002D.00000002.19661089794.000001A8F8BC0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8BC0000
Size:	118784

Details

Name:	00000026.00000003.18432358124.00000138BCA49000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCA49000
Size:	4096

Details

Name:	00000020.00000003.18138984414.00000296E3EA9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EA9000
Size:	4096

Details

Name:	00000001.00000002.14720419840.000002DEA180E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA180E000
Size:	4096

Details

Name:	00000028.00000000.18509260061.00007DF539A10000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A10000
Size:	4096

Details

Name:	00000026.00000003.18305766772.00000138BD36A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD36A000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000020.00000003.18191052080.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	0000002D.00000002.19662197577.000001A8F8C65000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1A8F8C65000
Size:	40960

Details

Name:	00000028.00000002.18524623962.00007FF52FAC0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAC0000
Size:	20480

Details

Name:	00000020.00000003.18186884664.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000001.00000002.14718683348.000002DE9F6B0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F6B0000
Size:	4096

Details

Name:	00000020.00000003.18137408196.00000296E3F80000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F80000
Size:	8192

Details

Name:	00000020.00000003.18161965950.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	12288

Details

Name:	0000002C.00000002.19662845452.00007DF5155A2000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155A2000
Size:	4096

Details

Name:	00000028.00000002.18522986667.0000007FC349B000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7FC349B000
Size:	20480

Details

Name:	00000001.00000003.14711793398.000002DEA15BD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BD000
Size:	16384

Details

Name:	00000026.00000003.18423973909.00000138BD8A1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8A1000
Size:	65536

Details

Name:	00000020.00000003.18245595263.00000296E4483000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4483000
Size:	122880

Details

Name:	00000025.00000000.18201379901.00007DF573540000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573540000
Size:	12288

Details

Name:	0000000D.00000003.14944293423.0000000000BC4000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	BC4000
Size:	4096

Details

Name:	00000020.00000003.18219438392.00000296E41BD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41BD000
Size:	45056

Details

Name:	0000002D.00000003.18686660576.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	65536

Details

Name:	00000001.00000003.14638409251.000002DEA1C47000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C47000
Size:	12288

Details

Name:	00000026.00000003.18320138514.00000138BD3DA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD3DA000
Size:	266240

Details

Name:	00000020.00000003.18219707559.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000005.00000002.15126333081.0000000000A2F000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	A2F000
Size:	4096

Details

Name:	00000001.00000003.14714626655.000002DEA157A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA157A000
Size:	4096

Details

Name:	00000028.00000002.18524571423.00007FF52FAB0000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FAB0000
Size:	12288

Details

Name:	00000020.00000002.19662490741.00000296DE140000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE140000
Size:	12288

Details

Name:	00000028.00000003.18518617109.00000215F83B2000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B2000
Size:	20480

Details

Name:	00000001.00000003.14639184623.000002DEA170E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170E000
Size:	286720

Details

Name:	00000001.00000003.14626145974.000002DEA1EF4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EF4000
Size:	69632

Details

Name:	00000028.00000000.18509205901.00007DF539A02000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A02000
Size:	4096

Details

Name:	00000001.00000003.14612532296.000002DEA14A9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA14A9000
Size:	98304

Details

Name:	0000000D.00000003.14944203132.000000001E141000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E141000
Size:	49152

Details

Name:	0000002D.00000002.19664265561.00007DF5B99D2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99D2000
Size:	4096

Details

Name:	00000020.00000003.18175933617.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	0000002A.00000002.18541170985.0000022796620000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	22796620000
Size:	4096

Details

Name:	0000002A.00000002.18540869967.00000227965E0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	227965E0000
Size:	4096

Details

Name:	00000020.00000003.18216255499.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000020.00000003.18214940430.00000296DEB96000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB96000
Size:	16384

Details

Name:	00000020.00000003.18160541981.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000020.00000003.18139271304.00000296E3EBF000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EBF000
Size:	4096

Details

Name:	0000001D.00000002.19665752221.00007DF5F61C2000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61C2000
Size:	4096

Details

Name:	00000025.00000002.18578396266.0000021B53A00000.00000004.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	21B53A00000
Size:	4096

Details

Name:	00000026.00000003.18409985803.00000138BD881000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD881000
Size:	65536

Details

Name:	00000026.00000003.18356585313.00000138BDD1A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD1A000
Size:	36864

Details

Name:	0000002A.00000003.18540258079.0000022796EE9000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EE9000
Size:	20480

Details

Name:	00000001.00000003.14709134450.000002DEA175B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA175B000
Size:	28672

Details

Name:	00000026.00000003.18328741644.00000138BD66E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD66E000
Size:	266240

Details

Name:	00000025.00000002.18580299395.00007FF7202FF000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7202FF000
Size:	61440

Details

Name:	00000001.00000003.14639159369.000002DEA170A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA170A000
Size:	8192

Details

Name:	0000000D.00000002.19661263740.00000000009E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	9E0000
Size:	8192

Details

Name:	00000020.00000002.19666254843.00000296DE861000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE861000
Size:	114688

Details

Name:	00000026.00000003.18302973741.00000138BE4E1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE4E1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000002.19661265127.000000B1359FE000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1359FE000
Size:	8192

Details

Name:	00000025.00000002.18578900503.0000021B53A9E000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	21B53A9E000
Size:	49152

Details

Name:	00000005.00000002.15134723428.000000007FFC2000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC2000
Size:	4096

Details

Name:	00000001.00000002.14722218723.00007FF4F84DB000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84DB000
Size:	8192

Details

Name:	00000001.00000003.14644841831.000002DEA1601000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1601000
Size:	4096

Details

Name:	0000002C.00000001.18622412833.00007FF6A36D0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A36D0000
Size:	4096

Details

Name:	0000002D.00000003.18692169685.000001A8F8CBC000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBC000
Size:	20480

Details

Name:	00000026.00000003.18339308984.00000138BE6F0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6F0000
Size:	4096

Details

Name:	00000005.00000002.15134462088.000000007FE50000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FE50000
Size:	20480

Details

Name:	00000001.00000002.14718385127.000002DE9F59C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F59C000
Size:	24576

Details

Name:	00000001.00000002.14721615923.00007FF4F83E9000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F83E9000
Size:	8192

Details

Name:	0000002C.00000003.18665199992.0000016FFD242000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD242000
Size:	65536

Details

Name:	00000001.00000002.14721279816.00007FF4F7E3A000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F7E3A000
Size:	4096

Details

Name:	00000001.00000002.14720476500.000002DEA18DB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA18DB000
Size:	4096

Details

Name:	00000028.00000003.18522537741.00000215F8399000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8399000
Size:	20480

Details

Name:	00000001.00000003.14716265821.000002DE9F74A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74A000
Size:	20480

Details

Name:	00000005.00000002.15125043684.0000000000010000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	10000
Size:	4096

Details

Name:	00000026.00000003.18341263339.00000138BCD46000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCD46000
Size:	266240

Details

Name:	00000020.00000003.18175871512.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	0000000D.00000002.19662667928.00000000028E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28E0000
Size:	4096

Details

Name:	00000025.00000002.18579117876.0000021B53CD0000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53CD0000
Size:	4096

Details

Name:	00000020.00000003.18202291594.00000296E4444000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4444000
Size:	237568

Details

Name:	00000025.00000000.18201895526.00007FF720311000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF720311000
Size:	10485760

Details

Name:	0000002D.00000002.19661691580.000001A8F8C20000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8C20000
Size:	4096

Details

Name:	0000002D.00000002.19660868913.000000938AEFE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	938AEFE000
Size:	8192

Details

Name:	0000002D.00000003.18687336647.000001A8F8CC9000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC9000
Size:	45056

Details

Name:	00000026.00000003.18291331075.00000138BE1EC000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE1EC000
Size:	118784

Details

Name:	00000020.00000003.18159031003.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	24576

Details

Name:	00000012.00000000.18108434358.00007DF5715E0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715E0000
Size:	12288

Details

Name:	0000002A.00000003.18538560498.0000022796E6A000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E6A000
Size:	20480

Details

Name:	00000020.00000002.19673954344.00000296E442D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E442D000
Size:	32768

Details

Name:	00000025.00000002.18579236647.00007DF573520000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573520000
Size:	4096

Details

Name:	00000001.00000003.14624039652.000002DEA1E67000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1E67000
Size:	172032

Details

Name:	00000026.00000003.18277082619.00000138AA7A7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7A7000
Size:	4096

Details

Name:	0000002D.00000002.19663846133.000001A8F91D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F91D0000
Size:	16384

Details

Name:	00000020.00000002.19674345908.00007FF4FDD3D000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FDD3D000
Size:	4096

Details

Name:	0000002A.00000003.18538894929.0000022796F03000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F03000
Size:	16384

Details

Name:	00000001.00000003.14630013386.000002DEA15A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A8000
Size:	20480

Details

Name:	00000020.00000002.19674532603.00007FF4FE11E000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE11E000
Size:	28672

Details

Name:	0000002D.00000002.19664302503.00007DF5B99E0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99E0000
Size:	4096

Details

Name:	00000028.00000003.18520870802.00000215F83FD000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83FD000
Size:	32768

Details

Name:	00000020.00000003.18160143678.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000026.00000003.18332362148.00000138BD291000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD291000
Size:	4096

Details

Name:	00000001.00000003.14639655378.000002DEA1C3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C3E000
Size:	36864

Details

Name:	00000026.00000003.18319898707.00000138BD36A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD36A000
Size:	184320

Details

Name:	00000028.00000002.18524181128.00007DF539A10000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A10000
Size:	4096

Details

Name:	0000002D.00000002.19664602517.00007FF5AF697000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AF697000
Size:	12288

Details

Name:	00000026.00000003.18353699272.00000138BCE0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE0C000
Size:	4096

Details

Name:	00000020.00000002.19661157937.000000B13577F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B13577F000
Size:	4096

Details

Name:	00000025.00000002.18579828361.00007FF569615000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569615000
Size:	12288

Details

Name:	00000001.00000002.14716929071.000000EDDB7FE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDB7FE000
Size:	8192

Details

Name:	0000002C.00000000.18613099576.0000016FFD150000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD150000
Size:	118784

Details

Name:	00000026.00000003.18299998922.00000138BE0C0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE0C0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000026.00000003.18346478440.00000138BD16D000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD16D000
Size:	106496

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000020.00000002.19675423400.00007FF4FE9A3000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE9A3000
Size:	4096

Details

Name:	0000000D.00000002.19663452678.00000000029C4000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29C4000
Size:	12288

Details

Name:	00000020.00000003.18138526758.00000296E3E83000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E83000
Size:	16384

Details

Name:	00000026.00000003.18298490713.00000138BDFB9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFB9000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002C.00000002.19663767741.00007FF50B685000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B685000
Size:	12288

Details

Name:	0000002C.00000003.18643247759.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	28672

Details

Name:	00000001.00000002.14720229795.000002DEA15AB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AB000
Size:	61440

Details

Name:	00000025.00000002.18579394372.00007FF54FD5B000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF54FD5B000
Size:	4096

Details

Name:	00000026.00000003.18318295816.00000138BD3DA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD3DA000
Size:	266240

Details

Name:	00000020.00000003.18195518749.00000296E41F4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41F4000
Size:	20480

Details

Name:	00000020.00000003.18175069047.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000001.00000003.14635940336.000002DEA1CC5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CC5000
Size:	4096

Details

Name:	0000000D.00000002.19662522937.00000000028D6000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28D6000
Size:	12288

Details

Name:	00000020.00000003.18139610482.00000296E3E6F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E6F000
Size:	4096

Details

Name:	00000001.00000003.14640664417.000002DEA1D3E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D3E000
Size:	20480

Details

Name:	0000000D.00000002.19664550720.0000000002A3C000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A3C000
Size:	28672

Details

Name:	00000026.00000003.18325199016.00000138BEA60000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEA60000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18339934702.00000138BD290000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD290000
Size:	4096

Details

Name:	0000000D.00000002.19675068477.000000001E91B000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E91B000
Size:	20480

Details

Name:	00000028.00000002.18524682534.00007FF52FACB000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FACB000
Size:	8192

Details

Name:	00000026.00000003.18408082790.00000138BD43C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD43C000
Size:	131072

Details

Name:	00000005.00000002.15126877859.00000000022B0000.00000004.00000040.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	22B0000
Size:	28672

Details

Name:	00000028.00000003.18519095389.00000215F83F2000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83F2000
Size:	176128

Details

Name:	00000028.00000002.18523586216.00000215F7BD0000.00000004.00000020.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	215F7BD0000
Size:	28672

Details

Name:	0000000D.00000002.19664020840.0000000002A08000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A08000
Size:	20480

Details

Name:	00000001.00000003.14624347276.000002DEA1EBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EBC000
Size:	77824

Details

Name:	00000001.00000003.14643142496.000002DEA1F97000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F97000
Size:	122880

Details

Name:	0000002D.00000002.19664017122.000001A8F9361000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F9361000
Size:	8192

Details

Name:	00000001.00000003.14641845390.000002DEA1603000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1603000
Size:	20480

Details

Name:	0000002C.00000003.18649622516.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	53248

Details

Name:	00000001.00000003.14635960182.000002DEA1CD7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CD7000
Size:	495616

Details

Name:	00000020.00000003.18232803198.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	65536

Details

Name:	00000001.00000003.14629962453.000002DEA15A2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A2000
Size:	12288

Details

Name:	0000002A.00000003.18539777652.0000022796EF2000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EF2000
Size:	8192

Details

Name:	00000026.00000003.18270260406.00000138AECA7000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AECA7000
Size:	8192

Details

Name:	00000001.00000003.14621389180.000002DEA1DE7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DE7000
Size:	159744

Details

Name:	00000001.00000003.14714475970.000002DEA1424000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1424000
Size:	36864

Details

Name:	00000026.00000003.18356706769.00000138BDD66000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD66000
Size:	4096

Details

Name:	00000028.00000002.18523040736.0000007FC351E000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7FC351E000
Size:	8192

Details

Name:	00000028.00000003.18521128967.00000215F83FA000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83FA000
Size:	12288

Details

Name:	00000026.00000003.18349255574.00000138BD20C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD20C000
Size:	77824

Details

Name:	00000001.00000002.14718662393.000002DE9F5DE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5DE000
Size:	4096

Details

Name:	00000020.00000003.18160986754.00000296E402F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402F000
Size:	28672

Details

Name:	00000026.00000003.18231784671.00000138AA9D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA9D0000
Size:	65536

Details

Name:	00000028.00000003.18521514321.00000215F83CC000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83CC000
Size:	16384

Details

Name:	00000001.00000003.14632319170.000002DEA1BBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BBC000
Size:	143360

Details

Name:	00000026.00000003.18254559214.00000138ADCEB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCEB000
Size:	2895872

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000005.00000002.15125809088.00000000004C0000.00000004.00000020.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	4C0000
Size:	24576

Details

Name:	0000002D.00000003.18681287949.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	49152

Details

Name:	00000001.00000003.14626657446.000002DEA1F61000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F61000
Size:	65536

Details

Name:	00000020.00000003.18173963954.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	00000020.00000003.18217817520.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000026.00000003.18308358860.00000138BDF76000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF76000
Size:	77824

Details

Name:	00000020.00000003.18144607845.00000296E4059000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4059000
Size:	32768

Details

Name:	00000001.00000003.14634626761.000002DEA1C87000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C87000
Size:	69632

Details

Name:	00000026.00000000.18230423077.00007FF5AD501000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AD501000
Size:	4096

Details

Name:	00000026.00000003.18356361607.00000138BDCE3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCE3000
Size:	196608

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18220257088.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000020.00000003.18244396795.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	28672

Details

Name:	00000020.00000003.18191830513.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000026.00000003.18345017281.00000138BCDCB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCDCB000
Size:	102400

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000026.00000003.18323255787.00000138BCAC2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCAC2000
Size:	4096

Details

Name:	00000020.00000002.19663829592.00000296DE240000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE240000
Size:	24576

Details

Name:	00000028.00000003.18521673427.00000215F83BE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83BE000
Size:	8192

Details

Name:	00000020.00000003.18245406083.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	28672

Details

Name:	00000001.00000003.14627793149.000002DEA15D8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D8000
Size:	225280

Details

Name:	00000020.00000002.19661937735.000000B1360FA000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1360FA000
Size:	24576

Details

Name:	00000026.00000003.18328143856.00000138BDCA0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDCA0000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	0000002C.00000003.18652676327.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	20480

Details

Name:	0000000D.00000002.19663041322.00000000029A3000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29A3000
Size:	4096

Details

Name:	0000002D.00000002.19664669343.00007FF5AF69B000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AF69B000
Size:	4096

Details

Name:	00000012.00000000.18108009943.000001CCB0A80000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0A80000
Size:	118784

Details

Name:	00000026.00000003.18308695730.00000138BDFFA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFFA000
Size:	266240

Details

Name:	00000020.00000003.18188786086.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	94208

Details

Name:	00000020.00000002.19669931681.00000296DF800000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF800000
Size:	65536

Details

Name:	00000028.00000003.18521180836.00000215F8406000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8406000
Size:	86016

Details

Name:	00000020.00000003.18219335171.00000296E41CC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41CC000
Size:	32768

Details

Name:	00000001.00000003.14627537134.000002DEA1762000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1762000
Size:	69632

Details

Name:	00000020.00000002.19668205879.00000296DEB79000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB79000
Size:	20480

Details

Name:	0000002C.00000002.19661308853.0000016FFD180000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD180000
Size:	4096

Details

Name:	00000001.00000003.14620232797.000002DE9F74D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74D000
Size:	8192

Details

Name:	0000001D.00000002.19668958500.00007FF5EC2B3000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2B3000
Size:	20480

Details

Name:	0000002D.00000000.18668927685.000001A8F8BC0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A8F8BC0000
Size:	118784

Details

Name:	0000002C.00000003.18661563214.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	57344

Details

Name:	00000020.00000002.19671422280.00000296E3F00000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F00000
Size:	8192

Details

Name:	00000026.00000003.18290149636.00000138BEB5A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEB5A000
Size:	53248

Details

Name:	00000026.00000000.18230336209.00007DF5CF140000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5CF140000
Size:	4096

Details

Name:	00000020.00000002.19666599024.00000296DEA02000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEA02000
Size:	4096

Details

Name:	00000020.00000003.18233692416.00000296E442D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E442D000
Size:	237568

Details

Name:	00000026.00000003.18350275311.00000138BD314000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD314000
Size:	4096

Details

Name:	00000001.00000003.14635509029.000002DEA16B6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B6000
Size:	282624

Details

Name:	00000026.00000003.18315521913.00000138BDDA8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDDA8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000020.00000003.18190767552.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000002.19675072999.00007FF4FE5AD000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE5AD000
Size:	4096

Details

Name:	00000020.00000002.19674291763.00007DF508BA0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508BA0000
Size:	12288

Details

Name:	0000002D.00000002.19664094112.00007DF4B7890000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4B7890000
Size:	20480

Details

Name:	00000020.00000003.18216753166.00000296DEB9D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9D000
Size:	16384

Details

Name:	00000020.00000002.19664892455.00000296DE299000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE299000
Size:	16384

Details

Name:	0000002D.00000000.18669391079.00007DF5B99E2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99E2000
Size:	4096

Details

Name:	0000002D.00000003.18671504232.000001A8F8F00000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8F00000
Size:	180224

Details

Name:	0000001D.00000002.19666853503.00007FF5EC04B000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC04B000
Size:	12288

Details

Name:	00000001.00000003.14644530861.000002DEA1596000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1596000
Size:	16384

Details

Name:	00000001.00000003.14629272850.000002DEA1785000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1785000
Size:	229376

Details

Name:	00000025.00000002.18578987665.0000021B53AAC000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	21B53AAC000
Size:	4096

Details

Name:	00000020.00000002.19668323667.00000296DEB7F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB7F000
Size:	94208

Details

Name:	00000001.00000003.14641987789.000002DEA15D3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15D3000
Size:	184320

Details

Name:	00000020.00000003.18187580786.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	20480

Details

Name:	0000001D.00000002.19668016127.00007FF5EC252000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC252000
Size:	4096

Details

Name:	00000020.00000003.18159565019.00000296E4402000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4402000
Size:	4096

Details

Name:	00000001.00000000.14610710282.00007FF4F855F000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F855F000
Size:	20480

Details

Name:	00000001.00000002.14722069281.00007FF4F84C0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84C0000
Size:	16384

Details

Name:	0000002C.00000003.18662494155.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000001.00000003.14635003863.000002DEA1CD7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CD7000
Size:	495616

Details

Name:	0000000D.00000002.19667514632.0000000003490000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	3490000
Size:	69632

Details

Name:	0000002D.00000002.19664968540.00007FF5AFA78000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFA78000
Size:	4096

Details

Name:	00000001.00000000.14610649805.00007DF502422000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502422000
Size:	4096

Details

Name:	00000020.00000003.18139040249.00000296E3EAD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EAD000
Size:	4096

Details

Name:	00000020.00000003.18220645735.00000296E4435000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4435000
Size:	237568

Details

Name:	00000001.00000003.14620331509.000002DEA1D50000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D50000
Size:	65536

Details

Name:	00000020.00000003.18221176495.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000003.14634119562.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	4096

Details

Name:	00000025.00000002.18579187626.00007DF4713E0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4713E0000
Size:	20480

Details

Name:	00000026.00000003.18300875514.00000138BE2D0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE2D0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	0000001D.00000002.19668690952.00007FF5EC295000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC295000
Size:	8192

Details

Name:	0000002A.00000003.18538937341.0000022796F27000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F27000
Size:	49152

Details

Name:	0000002A.00000002.18542614072.00007FF5C7E06000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E06000
Size:	8192

Details

Name:	00000026.00000003.18409414555.00000138BD891000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD891000
Size:	65536

Details

Name:	00000001.00000000.14610614567.00007DF502412000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502412000
Size:	4096

Details

Name:	0000002C.00000003.18643605663.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	53248

Details

Name:	00000005.00000002.15125433895.00000000001E0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1E0000
Size:	4096

Details

Name:	00000020.00000002.19664551732.00000296DE286000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE286000
Size:	4096

Details

Name:	0000002C.00000003.18660985304.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	65536

Details

Name:	00000001.00000003.14645985700.000002DEA1FB8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB8000
Size:	282624

Details

Name:	0000002A.00000003.18539812775.0000022796EF6000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796EF6000
Size:	12288

Details

Name:	00000020.00000003.18205303198.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000001.00000003.14620000001.000002DEA1411000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1411000
Size:	212992

Details

Name:	0000002A.00000003.18539196769.0000022796F56000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F56000
Size:	86016

Details

Name:	00000026.00000003.18254261068.00000138ADCB0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCB0000
Size:	8192

Details

Name:	00000020.00000002.19675479250.00007FF4FE9A9000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE9A9000
Size:	4096

Details

Name:	0000002C.00000003.18648319183.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	53248

Details

Name:	00000020.00000002.19677214635.00007FF4FEC75000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC75000
Size:	12288

Details

Name:	00000001.00000003.14625427914.000002DEA1DFB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DFB000
Size:	12288

Details

Name:	0000000D.00000002.19665851547.0000000003190000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3190000
Size:	24576

Details

Name:	00000005.00000002.15127202910.0000000002310000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2310000
Size:	4096

Details

Name:	00000026.00000003.18298790259.00000138BDFFA000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDFFA000
Size:	266240

Details

Name:	00000001.00000003.14646560490.000002DEA159F000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA159F000
Size:	12288

Details

Name:	00000026.00000003.18357145302.00000138BDD66000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD66000
Size:	4096

Details

Name:	0000002C.00000003.18623860574.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	12288

Details

Name:	00000020.00000003.18218266816.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	0000001D.00000002.19664893493.0000019F0C400000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0C400000
Size:	16384

Details

Name:	00000020.00000002.19673232272.00000296E418A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E418A000
Size:	4096

Details

Name:	00000001.00000003.14715854835.000002DEA1B92000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1B92000
Size:	28672

Details

Name:	0000001D.00000002.19667635665.00007FF5EC1C6000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC1C6000
Size:	4096

Details

Name:	00000020.00000003.18138398482.00000296E3E77000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E77000
Size:	4096

Details

Name:	0000002C.00000003.18623685566.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	12288

Details

Name:	00000020.00000002.19670668325.00000296DF860000.00000004.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	296DF860000
Size:	4096

Details

Name:	00000012.00000002.19667761341.00007FF566CD6000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF566CD6000
Size:	4096

Details

Name:	00000026.00000003.18303855138.00000138BE892000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE892000
Size:	266240

Details

Name:	00000026.00000003.18344433631.00000138BD98C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD98C000
Size:	249856

Details

Name:	0000002C.00000002.19662720421.00007DF515592000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF515592000
Size:	4096

Details

Name:	00000020.00000003.18139733349.00000296E3EF0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EF0000
Size:	4096

Details

Name:	00000020.00000003.18234179444.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	65536

Details

Name:	00000020.00000003.18244577175.00000296E4483000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4483000
Size:	122880

Details

Name:	00000001.00000002.14720796908.000002DEA1D4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D4E000
Size:	8192

Details

Name:	00000020.00000003.18218108546.00000296E402C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402C000
Size:	40960

Details

Name:	00000001.00000003.14630406621.000002DEA15B8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15B8000
Size:	12288

Details

Name:	0000002D.00000002.19660692782.000000938ADFF000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	938ADFF000
Size:	4096

Details

Name:	0000002C.00000003.18652391941.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	53248

Details

Name:	00000026.00000003.18346955989.00000138BE144000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE144000
Size:	4096

Details

Name:	00000020.00000002.19671281928.00000296E3E50000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E50000
Size:	4096

Details

Name:	00000026.00000003.18271009398.00000138AED54000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AED54000
Size:	2879488

Details

Name:	00000026.00000000.18230145506.00000138AA6B0000.00000002.00020000.sdmp
TargetID:	38
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	138AA6B0000
Size:	118784

Details

Name:	0000002C.00000002.19664036917.00007FF50B6DF000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B6DF000
Size:	20480

Details

Name:	0000002C.00000003.18642465685.0000016FFD22E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22E000
Size:	24576

Details

Name:	00000001.00000002.14718269987.000002DE9F587000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F587000
Size:	65536

Details

Name:	00000012.00000002.19665319995.000001CCB11C1000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB11C1000
Size:	114688

Details

Name:	00000001.00000002.14719001674.000002DEA0EF0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DEA0EF0000
Size:	16384

Details

Name:	00000020.00000003.18174240731.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	0000001D.00000002.19667485985.00007FF5EC19E000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC19E000
Size:	4096

Details

Name:	0000000D.00000002.19675453658.000000007F742000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F742000
Size:	4096

Details

Name:	0000000D.00000002.19662360193.00000000028C4000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	28C4000
Size:	8192

Details

Name:	0000002C.00000002.19661238762.0000016FFD170000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16FFD170000
Size:	12288

Details

Name:	00000028.00000003.18521974979.00000215F83B3000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B3000
Size:	16384

Details

Name:	00000020.00000003.18232176873.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	28672

Details

Name:	00000020.00000002.19672142460.00000296E4059000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4059000
Size:	24576

Details

Name:	00000026.00000003.18357474669.00000138BDA0C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDA0C000
Size:	4096

Details

Name:	0000002C.00000000.18613624618.00007DF5155B0000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155B0000
Size:	12288

Details

Name:	00000012.00000002.19668816944.00007FF5676D5000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5676D5000
Size:	20480

Details

Name:	00000005.00000002.15127311800.0000000002BE0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2BE0000
Size:	8192

Details

Name:	00000020.00000002.19675718913.00007FF4FEA84000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEA84000
Size:	4096

Details

Name:	00000001.00000003.14613228946.000002DEA1479000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1479000
Size:	32768

Details

Name:	0000002C.00000003.18659368494.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	57344

Details

Name:	00000001.00000002.14722290818.00007FF4F84E5000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84E5000
Size:	8192

Details

Name:	00000001.00000003.14625168067.000002DEA1EA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EA2000
Size:	36864

Details

Name:	00000001.00000003.14709496066.000002DEA15E8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15E8000
Size:	143360

Details

Name:	0000000D.00000002.19675562136.000000007F752000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F752000
Size:	4096

Details

Name:	00000020.00000002.19672251928.00000296E4071000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4071000
Size:	4096

Details

Name:	00000028.00000003.18519846107.00000215F83C4000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83C4000
Size:	49152

Details

Name:	00000001.00000003.14635488342.000002DEA16B2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B2000
Size:	4096

Details

Name:	00000020.00000003.18174397238.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000026.00000003.18336568452.00000138BD41C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD41C000
Size:	266240

Details

Name:	00000001.00000003.14626754911.000002DEA1F72000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F72000
Size:	8192

Details

Name:	00000020.00000002.19673540955.00000296E41BB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41BB000
Size:	24576

Details

Name:	00000001.00000002.14716886219.000000EDDB6FE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDB6FE000
Size:	8192

Details

Name:	00000026.00000003.18350554191.00000138BE7D2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE7D2000
Size:	151552

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000020.00000003.18245563584.00000296E4467000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4467000
Size:	4096

Details

Name:	00000001.00000002.14718552503.000002DE9F5C0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5C0000
Size:	16384

Details

Name:	00000026.00000003.18307760603.00000138BCC81000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCC81000
Size:	147456

Details

Name:	0000000D.00000002.19660691954.0000000000920000.00000004.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	920000
Size:	4096

Details

Name:	00000020.00000002.19669066196.00000296DEBB7000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBB7000
Size:	8192

Details

Name:	00000001.00000003.14645924083.000002DEA1FB2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FB2000
Size:	12288

Details

Name:	00000001.00000002.14721937355.00007FF4F84A2000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84A2000
Size:	4096

Details

Name:	00000001.00000002.14721746506.00007FF4F8440000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8440000
Size:	32768

Details

Name:	0000002A.00000003.18540425450.0000022796E6A000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E6A000
Size:	4096

Details

Name:	00000005.00000002.15125787108.00000000004B0000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	4B0000
Size:	4096

Details

Name:	0000002C.00000003.18651426491.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	53248

Details

Name:	00000001.00000002.14716973334.000000EDDB9FE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	EDDB9FE000
Size:	8192

Details

Name:	00000020.00000002.19664052617.00000296DE251000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE251000
Size:	81920

Details

Name:	0000000D.00000002.19663276608.00000000029B6000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29B6000
Size:	49152

Details

Name:	00000020.00000002.19660616482.000000B13507B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B13507B000
Size:	20480

Details

Name:	0000002D.00000003.18686867148.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	40960

Details

Name:	00000005.00000002.15134776284.000000007FFD0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFD0000
Size:	12288

Details

Name:	00000001.00000003.14638529433.000002DEA1602000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1602000
Size:	24576

Details

Name:	00000020.00000002.19674387824.00007FF4FDD3F000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FDD3F000
Size:	12288

Details

Name:	00000020.00000002.19670811841.00000296DFD61000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DFD61000
Size:	4096

Details

Name:	0000002C.00000003.18632870824.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	200704

Details

Name:	00000001.00000003.14647585940.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	4096

Details

Name:	0000000D.00000002.19661614065.0000000000BA0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	BA0000
Size:	4096

Details

Name:	00000001.00000003.14630186920.000002DEA15BF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15BF000
Size:	8192

Details

Name:	0000001D.00000002.19669273440.00007FF5EC2E0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC2E0000
Size:	4096

Details

Name:	0000002A.00000002.18541547103.0000022796707000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	22796707000
Size:	81920

Details

Name:	00000001.00000002.14722518401.00007FF4F851E000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F851E000
Size:	12288

Details

Name:	00000026.00000003.18340911786.00000138BCCC2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCCC2000
Size:	69632

Details

Name:	0000002A.00000003.18538171156.0000022796F14000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F14000
Size:	49152

Details

Name:	00000001.00000003.14715724739.000002DEA15A4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A4000
Size:	90112

Details

Name:	0000002C.00000000.18613565767.00007DF5155A2000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5155A2000
Size:	4096

Details

Name:	00000026.00000003.18294450078.00000138AA7B3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA7B3000
Size:	98304

Details

Name:	0000000D.00000002.19660577041.0000000000910000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	910000
Size:	4096

Details

Name:	0000002D.00000000.18669596198.00007FF7B57C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF7B57C0000
Size:	4096

Details

Name:	0000002A.00000002.18542066881.00007DF5D1D30000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D30000
Size:	4096

Details

Name:	00000001.00000003.14638080758.000002DEA1C51000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C51000
Size:	73728

Details

Name:	00000020.00000003.18219032157.00000296E4456000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4456000
Size:	4096

Details

Name:	00000012.00000002.19661580863.000001CCB0AC0000.00000004.00000020.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1CCB0AC0000
Size:	12288

Details

Name:	00000025.00000002.18579948685.00007FF569640000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569640000
Size:	4096

Details

Name:	00000001.00000003.14634566231.000002DEA1BFF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BFF000
Size:	36864

Details

Name:	0000002D.00000003.18678790528.000001A8F8CBC000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBC000
Size:	208896

Details

Name:	00000026.00000003.18408313167.00000138BD45E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD45E000
Size:	4096

Details

Name:	0000002C.00000003.18650670725.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	20480

Details

Name:	00000020.00000002.19662927783.00000296DE1F1000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE1F1000
Size:	12288

Details

Name:	0000002C.00000003.18659057347.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000026.00000003.18314653568.00000138BCAC3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCAC3000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000005.00000002.15125114620.0000000000040000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	40000
Size:	118784

Details

Name:	00000020.00000003.18187323616.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000001.00000003.14645588799.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	00000001.00000003.14615304282.000002DE9F5AD000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5AD000
Size:	94208

Details

Name:	00000028.00000000.18509126213.00007DF539A00000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A00000
Size:	4096

Details

Name:	00000012.00000002.19661674096.000001CCB0BC0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCB0BC0000
Size:	4096

Details

Name:	00000001.00000003.14714575232.000002DE9F74A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74A000
Size:	20480

Details

Name:	00000020.00000003.18145995976.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	00000001.00000002.14720553807.000002DEA1BA0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BA0000
Size:	53248

Details

Name:	00000025.00000000.18213773234.00007FF720D11000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF720D11000
Size:	5468160

Details

Name:	00000001.00000003.14648471197.000002DEA1D4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D4E000
Size:	8192

Details

Name:	0000001D.00000002.19663250829.0000019F0C054000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C054000
Size:	77824

Details

Name:	00000020.00000002.19663554793.00000296DE22A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE22A000
Size:	86016

Details

Name:	00000001.00000003.14613988807.000002DEA1411000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1411000
Size:	20480

Details

Name:	00000025.00000000.18201347495.00007DF573532000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573532000
Size:	4096

Details

Name:	00000020.00000003.18447646522.00000296E41A9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41A9000
Size:	32768

Details

Name:	00000005.00000002.15134554790.000000007FFB0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB0000
Size:	4096

Details

Name:	00000020.00000003.18144689255.00000296E405A000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E405A000
Size:	28672

Details

Name:	00000025.00000002.18578754896.0000021B53A80000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A80000
Size:	4096

Details

Name:	00000001.00000002.14721487324.00007FF4F8311000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8311000
Size:	4096

Details

Name:	00000020.00000003.18220487852.00000296E4095000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4095000
Size:	77824

Details

Name:	00000020.00000002.19676463260.00007FF4FEC12000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC12000
Size:	12288

Details

Name:	00000012.00000002.19667988287.00007FF56766C000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56766C000
Size:	12288

Details

Name:	00000025.00000002.18579562389.00007FF5695CC000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5695CC000
Size:	12288

Details

Name:	00000001.00000003.14713514306.000002DEA1811000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1811000
Size:	831488

Details

Name:	00000026.00000003.18334702875.00000138BCED2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCED2000
Size:	4096

Details

Name:	00000001.00000003.14631548171.000002DEA17CB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17CB000
Size:	8192

Details

Name:	0000000D.00000002.19665602313.00000000030A0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	30A0000
Size:	8192

Details

Name:	00000020.00000003.18161861246.00000296E4074000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4074000
Size:	20480

Details

Name:	0000002D.00000002.19663225426.000001A8F8CBD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBD000
Size:	4096

Details

Name:	00000026.00000003.18418862441.00000138BD881000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD881000
Size:	65536

Details

Name:	00000020.00000002.19677096217.00007FF4FEC66000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC66000
Size:	8192

Details

Name:	0000001D.00000002.19663037935.0000019F0C044000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C044000
Size:	61440

Details

Name:	00000001.00000003.14624772392.000002DEA1EBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EBC000
Size:	77824

Details

Name:	00000028.00000002.18524214070.00007DF539A12000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A12000
Size:	4096

Details

Name:	00000028.00000003.18519302544.00000215F83E3000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83E3000
Size:	4096

Details

Name:	00000020.00000002.19672338469.00000296E40B1000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40B1000
Size:	8192

Details

Name:	0000002A.00000000.18526363822.00007DF5D1D40000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D1D40000
Size:	12288

Details

Name:	0000002A.00000003.18540363368.0000022796E64000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E64000
Size:	4096

Details

Name:	00000026.00000003.18323852880.00000138BDB88000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDB88000
Size:	61440

Details

Name:	00000001.00000003.14626571009.000002DEA1F4E000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F4E000
Size:	69632

Details

Name:	00000026.00000003.18302383706.00000138BD5EB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD5EB000
Size:	221184

Details

Name:	00000020.00000003.18160791376.00000296E4402000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4402000
Size:	4096

Details

Name:	00000020.00000003.18205518920.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	24576

Details

Name:	0000002C.00000003.18648103816.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	61440

Details

Name:	00000026.00000003.18307929189.00000138BCCA8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCCA8000
Size:	102400

Details

Name:	0000002C.00000003.18651244737.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	65536

Details

Name:	00000020.00000003.18191717690.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000020.00000000.18136646235.00007FF4FECCF000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FECCF000
Size:	20480

Details

Name:	00000026.00000003.18254533117.00000138ADCE9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138ADCE9000
Size:	4096

Details

Name:	00000001.00000003.14716195534.000002DEA1444000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1444000
Size:	4096

Details

Name:	00000025.00000002.18579868658.00007FF569636000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569636000
Size:	16384

Details

Name:	00000005.00000002.15125681349.0000000000416000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	416000
Size:	8192

Details

Name:	00000020.00000003.18171905945.00000296DEB9F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9F000
Size:	24576

Details

Name:	00000026.00000003.18310829791.00000138BDEF2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDEF2000
Size:	266240

Details

Name:	00000028.00000002.18525240453.00007FF52FB4E000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB4E000
Size:	24576

Details

Name:	00000020.00000002.19662560061.00000296DE150000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE150000
Size:	4096

Details

Name:	0000002C.00000003.18658198541.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	65536

Details

Name:	00000020.00000003.18187148218.00000296E4444000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4444000
Size:	4096

Details

Name:	0000002C.00000003.18623760749.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	12288

Details

Name:	00000026.00000003.18305388995.00000138BD315000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD315000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000001.00000003.14715006856.000002DE9F5D0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D0000
Size:	8192

Details

Name:	00000001.00000003.14630919243.000002DEA17E2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17E2000
Size:	90112

Details

Name:	00000020.00000003.18159242330.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000020.00000003.18171758656.00000296DEB9F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB9F000
Size:	49152

Details

Name:	00000005.00000002.15126756947.0000000002250000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2250000
Size:	4096

Details

Name:	00000025.00000000.18201311849.00007DF573530000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF573530000
Size:	4096

Details

Name:	0000001D.00000002.19661911199.0000019F0BF10000.00000004.00000040.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	19F0BF10000
Size:	4096

Details

Name:	00000020.00000003.18843027264.00000296E41FB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41FB000
Size:	16384

Details

Name:	00000026.00000003.18346616034.00000138BE102000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE102000
Size:	167936

Details

Name:	0000002A.00000002.18542981758.00007FF5C7E67000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E67000
Size:	12288

Details

Name:	00000020.00000002.19665949745.00000296DE315000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE315000
Size:	8192

Details

Name:	00000001.00000003.14613272223.000002DEA1459000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1459000
Size:	81920

Details

Name:	00000020.00000003.18160951498.00000296E402B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402B000
Size:	12288

Details

Name:	00000020.00000002.19662043313.00000296DE100000.00000004.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	296DE100000
Size:	4096

Details

Name:	00000001.00000003.14629110923.000002DEA15B5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15B5000
Size:	24576

Details

Name:	00000020.00000002.19667722344.00000296DEB53000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB53000
Size:	114688

Details

Name:	00000020.00000003.18217720280.00000296E407E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407E000
Size:	61440

Details

Name:	00000020.00000003.18144953324.00000296DEB5E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB5E000
Size:	118784

Details

Name:	00000020.00000003.18219514700.00000296E41C9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41C9000
Size:	8192

Details

Name:	00000026.00000003.18345654206.00000138BE6AE000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE6AE000
Size:	4096

Details

Name:	0000001D.00000003.18434432819.0000019F0C090000.00000004.00000001.sdmp
TargetID:	29
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	19F0C090000
Size:	36864

Details

Name:	00000020.00000003.18138569188.00000296E3E88000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E88000
Size:	4096

Details

Name:	00000028.00000000.18509345108.00007DF539A20000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A20000
Size:	12288

Details

Name:	00000001.00000003.14614410589.000002DEA1454000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1454000
Size:	20480

Details

Name:	0000002D.00000003.18678089520.000001A8F8CBA000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CBA000
Size:	262144

Details

Name:	00000005.00000000.14652635304.0000000000416000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	416000
Size:	8192

Details

Name:	00000026.00000003.18302628110.00000138BD622000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD622000
Size:	36864

Details

Name:	00000026.00000003.18240770118.00000138AD076000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AD076000
Size:	10485760

Details

Name:	00000001.00000003.14714678214.000002DEA158D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA158D000
Size:	53248

Details

Name:	00000025.00000003.18229425193.0000021B53AB5000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AB5000
Size:	36864

Details

Name:	00000020.00000002.19675124619.00007FF4FE5AF000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE5AF000
Size:	8192

Details

Name:	00000020.00000003.18204913129.00000296E4423000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4423000
Size:	237568

Details

Name:	00000001.00000003.14612847075.000002DE9F74C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F74C000
Size:	12288

Details

Name:	0000002C.00000000.18614074684.00007FF6A36FF000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A36FF000
Size:	61440

Details

Name:	00000020.00000003.18215599035.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	16384

Details

Name:	00000001.00000003.14646743455.000002DEA15AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15AF000
Size:	45056

Details

Name:	00000020.00000003.18138465950.00000296E3E7D000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E7D000
Size:	4096

Details

Name:	0000002C.00000003.18625618271.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	258048

Details

Name:	00000020.00000003.18144455867.00000296E4046000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4046000
Size:	73728

Details

Name:	0000002C.00000003.18658791368.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	28672

Details

Name:	00000001.00000003.14631409188.000002DEA17F9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA17F9000
Size:	90112

Details

Name:	00000026.00000003.18358579499.00000138BD314000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD314000
Size:	4096

Details

Name:	00000020.00000003.18144256863.00000296E403F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E403F000
Size:	102400

Details

Name:	0000002A.00000002.18542839697.00007FF5C7E3D000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5C7E3D000
Size:	8192

Details

Name:	0000002D.00000003.18688350392.000001A8F8CCB000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCB000
Size:	65536

Details

Name:	00000028.00000002.18524256404.00007DF539A20000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF539A20000
Size:	12288

Details

Name:	0000001D.00000002.19661446231.0000019F0BDC0000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BDC0000
Size:	12288

Details

Name:	00000026.00000003.18308458271.00000138BDF8A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF8A000
Size:	184320

Details

Name:	0000002D.00000003.18689156309.000001A8F8CCC000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CCC000
Size:	65536

Details

Name:	00000001.00000003.14614336165.000002DEA1498000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1498000
Size:	20480

Details

Name:	00000001.00000003.14710085206.000002DE9F516000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F516000
Size:	528384

Details

Name:	00000026.00000003.18316758133.00000138BD566000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD566000
Size:	4096

Details

Name:	00000001.00000003.14613803761.000002DEA1416000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1416000
Size:	40960

Details

Name:	00000020.00000002.19677055942.00007FF4FEC5B000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC5B000
Size:	4096

Details

Name:	00000020.00000003.18146671276.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000020.00000003.18220977238.00000296E402C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E402C000
Size:	40960

Details

Name:	0000002C.00000003.18645557223.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	24576

Details

Name:	00000028.00000002.18523940945.00000215F7E50000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	215F7E50000
Size:	12288

Details

Name:	00000020.00000002.19675590727.00007FF4FE9D4000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FE9D4000
Size:	8192

Details

Name:	00000020.00000002.19675935093.00007FF4FEAE2000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEAE2000
Size:	12288

Details

Name:	00000020.00000003.18240508060.00000296E41BD000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41BD000
Size:	16384

Details

Name:	00000026.00000003.18295659876.00000138BD7FB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD7FB000
Size:	262144

Details

Name:	00000005.00000002.15125852653.00000000005DE000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5DE000
Size:	8192

Details

Name:	0000002C.00000003.18650867580.0000016FFD235000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD235000
Size:	28672

Details

Name:	00000001.00000003.14638594305.000002DEA1BBC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BBC000
Size:	204800

Details

Name:	00000005.00000003.14857046878.00000000004C4000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	4C4000
Size:	8192

Details

Name:	00000020.00000003.18190205537.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000001.00000003.14644588322.000002DEA1BDB000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BDB000
Size:	20480

Details

Name:	00000026.00000003.18297566863.00000138BD4A0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4A0000
Size:	16384

Details

Name:	00000001.00000003.14633770898.000002DEA1C63000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C63000
Size:	69632

Details

Name:	00000028.00000003.18521715939.00000215F83CE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83CE000
Size:	8192

Details

Name:	0000002C.00000002.19663371667.00007FF50B640000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B640000
Size:	12288

Details

Name:	00000020.00000002.19665623992.00000296DE302000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE302000
Size:	65536

Details

Name:	00000026.00000003.18321645205.00000138BDDA8000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDDA8000
Size:	266240

Details

Name:	00000020.00000002.19668908760.00000296DEBAC000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBAC000
Size:	40960

Details

Name:	0000002A.00000003.18537187148.0000022796F3E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F3E000
Size:	192512

Details

Name:	00000025.00000003.18220449866.0000021B53D40000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53D40000
Size:	184320

Details

Name:	00000005.00000000.14652728191.000000007FFC0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC0000
Size:	4096

Details

Name:	0000002C.00000003.18623528401.0000016FFD221000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD221000
Size:	16384

Details

Name:	0000002A.00000003.18539013962.0000022796F55000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F55000
Size:	90112

Details

Name:	0000002D.00000002.19664515630.00007FF59875F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF59875F000
Size:	4096

Details

Name:	0000002D.00000003.18685226163.000001A8F8CC8000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC8000
Size:	65536

Details

Name:	0000001D.00000002.19669555421.00007FF5EC30E000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC30E000
Size:	24576

Details

Name:	0000002C.00000003.18648512870.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	28672

Details

Name:	00000020.00000003.18172996921.00000296E440B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E440B000
Size:	12288

Details

Name:	00000001.00000002.14721872409.00007FF4F845F000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F845F000
Size:	4096

Details

Name:	00000020.00000002.19676307052.00007FF4FEBF0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEBF0000
Size:	12288

Details

Name:	0000002A.00000003.18539310294.0000022796F08000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F08000
Size:	8192

Details

Name:	00000001.00000003.14621306100.000002DEA1DD5000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1DD5000
Size:	69632

Details

Name:	00000026.00000003.18313106625.00000138BEB26000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BEB26000
Size:	4096

Details

Name:	00000001.00000003.14628039294.000002DEA1FA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1FA2000
Size:	69632

Details

Name:	00000025.00000002.18579148402.0000021B53E20000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	21B53E20000
Size:	12288

Details

Name:	0000002C.00000003.18640922991.0000016FFD229000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD229000
Size:	147456

Details

Name:	00000026.00000003.18358177577.00000138BE7B6000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE7B6000
Size:	4096

Details

Name:	0000002C.00000003.18661355414.0000016FFD23D000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23D000
Size:	65536

Details

Name:	0000001D.00000000.18133794886.00007FF5EC30F000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC30F000
Size:	20480

Details

Name:	0000001D.00000002.19667074928.00007FF5EC0C7000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC0C7000
Size:	8192

Details

Name:	00000026.00000003.18270347906.00000138AECB3000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AECB3000
Size:	602112

Details

Name:	00000020.00000003.18176004886.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000001.00000002.14717561604.000002DE9F420000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F420000
Size:	4096

Details

Name:	00000028.00000003.18520186098.00000215F83B1000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83B1000
Size:	4096

Details

Name:	00000020.00000003.18138494459.00000296E3E7F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E7F000
Size:	8192

Details

Name:	00000028.00000002.18524476945.00007FF52FA29000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FA29000
Size:	4096

Details

Name:	00000020.00000003.18190272849.00000296E4094000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4094000
Size:	4096

Details

Name:	00000001.00000002.14718610351.000002DE9F5D4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5D4000
Size:	32768

Details

Name:	0000002C.00000003.18642298299.0000016FFD22E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22E000
Size:	28672

Details

Name:	00000001.00000003.14641186881.000002DEA175B000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA175B000
Size:	28672

Details

Name:	00000020.00000002.19674109230.00007DF508B80000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B80000
Size:	4096

Details

Name:	00000001.00000003.14643874416.000002DEA1BB6000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BB6000
Size:	4096

Details

Name:	00000020.00000003.18205427210.00000296E409C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E409C000
Size:	49152

Details

Name:	00000020.00000002.19676415153.00007FF4FEC08000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC08000
Size:	8192

Details

Name:	00000026.00000003.18356659425.00000138BDD24000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDD24000
Size:	4096

Details

Name:	00000026.00000003.18355975073.00000138BCF56000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCF56000
Size:	266240

Details

Name:	0000002C.00000003.18654053383.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	20480

Details

Name:	00000025.00000003.18223113191.0000021B53AB7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	21B53AB7000
Size:	53248

Details

Name:	0000002C.00000003.18647693312.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	24576

Details

Name:	00000026.00000003.18334089619.00000138BDC5E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDC5E000
Size:	4096

Details

Name:	00000025.00000000.18201859503.00007FF72030E000.00000008.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF72030E000
Size:	4096

Details

Name:	00000001.00000003.14643590639.000002DEA2004000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA2004000
Size:	28672

Details

Name:	0000000D.00000002.19675402200.000000007F740000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F740000
Size:	4096

Details

Name:	00000020.00000003.18188267381.00000296E4460000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4460000
Size:	122880

Details

Name:	0000000D.00000000.14856677042.0000000002A68000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A68000
Size:	20480

Details

Name:	0000002D.00000003.18677015256.000001A8F8CB2000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CB2000
Size:	262144

Details

Name:	00000026.00000003.18314589887.00000138BD054000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD054000
Size:	36864

Details

Name:	00000026.00000003.18298412418.00000138BE5D9000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE5D9000
Size:	53248

Details

Name:	0000000D.00000002.19662046972.000000000283B000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	283B000
Size:	12288

Details

Name:	0000000D.00000000.14857872001.000000007F750000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F750000
Size:	4096

Details

Name:	00000020.00000002.19676951280.00007FF4FEC4F000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC4F000
Size:	20480

Details

Name:	00000020.00000003.18216790990.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000001.00000003.14644290827.000002DEA200C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA200C000
Size:	4096

Details

Name:	00000026.00000003.18424803610.00000138BD881000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD881000
Size:	65536

Details

Name:	0000000D.00000002.19663735555.00000000029F0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	29F0000
Size:	16384

Details

Name:	00000026.00000003.18304446450.00000138BE24C000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE24C000
Size:	4096

Details

Name:	00000020.00000003.18231985652.00000296E40A6000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E40A6000
Size:	53248

Details

Name:	00000012.00000002.19663337203.000001CCB0C78000.00000004.00000001.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCB0C78000
Size:	323584

Details

Name:	0000002A.00000003.18539985759.0000022796E63000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E63000
Size:	8192

Details

Name:	00000020.00000003.18231146944.00000296DEB92000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB92000
Size:	32768

Details

Name:	00000026.00000003.18295972278.00000138AA79E000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AA79E000
Size:	20480

Details

Name:	0000002C.00000002.19662991722.00007FF4EFE9B000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4EFE9B000
Size:	4096

Details

Name:	0000002A.00000002.18540796209.0000002A4ADEE000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A4ADEE000
Size:	8192

Details

Name:	00000026.00000003.18308989313.00000138BD4A0000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD4A0000
Size:	16384

Details

Name:	0000002C.00000002.19662558094.00007DF413450000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF413450000
Size:	20480

Details

Name:	00000028.00000002.18523130576.0000007FC387E000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7FC387E000
Size:	8192

Details

Name:	00000020.00000003.18218344000.00000296E4026000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4026000
Size:	24576

Details

Name:	00000020.00000002.19664364826.00000296DE279000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE279000
Size:	4096

Details

Name:	00000020.00000003.18853645134.00000296E4402000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4402000
Size:	131072

Details

Name:	00000001.00000003.14710630275.000002DEA16B4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA16B4000
Size:	143360

Details

Name:	00000001.00000003.14613950696.000002DEA1443000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1443000
Size:	24576

Details

Name:	00000001.00000003.14620585021.000002DEA1D85000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1D85000
Size:	69632

Details

Name:	00000020.00000000.18136402078.00007DF508B82000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF508B82000
Size:	4096

Details

Name:	0000002C.00000003.18646123862.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	49152

Details

Name:	00000026.00000003.18351947591.00000138BE958000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE958000
Size:	266240

Details

Name:	0000002D.00000002.19663271505.000001A8F8CC7000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1A8F8CC7000
Size:	12288

Details

Name:	00000020.00000002.19677430962.00007FF4FECA0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FECA0000
Size:	4096

Details

Name:	00000012.00000002.19667255658.00007DF5715C0000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5715C0000
Size:	4096

Details

Name:	00000001.00000003.14628733346.000002DEA15A8000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A8000
Size:	20480

Details

Name:	0000002C.00000002.19662648512.00007DF515590000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF515590000
Size:	4096

Details

Name:	00000020.00000002.19672035397.00000296E4048000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4048000
Size:	65536

Details

Name:	00000026.00000003.18319198617.00000138BE62A000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BE62A000
Size:	167936

Details

Name:	00000020.00000003.18161245352.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000026.00000003.18316116124.00000138BDF34000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BDF34000
Size:	4096

Details

Name:	00000001.00000003.14712690723.000002DE9F5DC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5DC000
Size:	12288

Details

Name:	0000002C.00000003.18646502366.0000016FFD232000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD232000
Size:	65536

Details

Name:	00000005.00000002.15126519650.0000000000DB0000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	DB0000
Size:	4096

Details

Name:	00000001.00000002.14721509325.00007FF4F8317000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8317000
Size:	8192

Details

Name:	00000001.00000002.14722619508.00007FF4F8530000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F8530000
Size:	4096

Details

Name:	00000001.00000003.14613400880.000002DEA1451000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1451000
Size:	32768

Details

Name:	0000002C.00000003.18656561715.0000016FFD23A000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23A000
Size:	28672

Details

Name:	00000001.00000003.14626272750.000002DEA1F18000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1F18000
Size:	69632

Details

Name:	00000020.00000003.18231377989.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	28672

Details

Name:	00000001.00000000.14610450933.000002DE9F3F0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	2DE9F3F0000
Size:	118784

Details

Name:	00000020.00000003.18216365572.00000296DEBA4000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBA4000
Size:	28672

Details

Name:	00000001.00000003.14709269916.000002DEA15C2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15C2000
Size:	143360

Details

Name:	0000002C.00000002.19663203463.00007FF50B59F000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF50B59F000
Size:	12288

Details

Name:	00000028.00000002.18523995378.00000215F7E55000.00000004.00000040.sdmp
TargetID:	40
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	215F7E55000
Size:	8192

Details

Name:	00000001.00000002.14721070430.00007DF502422000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF502422000
Size:	4096

Details

Name:	00000020.00000003.18187622685.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000001.00000002.14722108303.00007FF4F84C6000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4F84C6000
Size:	20480

Details

Name:	00000001.00000003.14614443598.000002DEA1460000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1460000
Size:	20480

Details

Name:	00000001.00000003.14634007293.000002DEA1C08000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C08000
Size:	8192

Details

Name:	00000001.00000003.14632077684.000002DEA180C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA180C000
Size:	12288

Details

Name:	0000002C.00000003.18623603613.0000016FFD222000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD222000
Size:	12288

Details

Name:	00000012.00000002.19668211299.00007FF567680000.00000002.00020000.sdmp
TargetID:	18
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF567680000
Size:	20480

Details

Name:	00000001.00000003.14631763223.000002DEA1BA2000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BA2000
Size:	102400

Details

Name:	00000026.00000003.18334422463.00000138BCE91000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCE91000
Size:	258048

Details

Name:	0000001D.00000002.19666432802.00007FF5EBB4F000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EBB4F000
Size:	12288

Details

Name:	0000002C.00000002.19662006755.0000016FFD220000.00000004.00000020.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16FFD220000
Size:	143360

Details

Name:	00000001.00000002.14718085673.000002DE9F50C000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2DE9F50C000
Size:	12288

Details

Name:	00000020.00000002.19676750570.00007FF4FEC36000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FEC36000
Size:	20480

Details

Name:	0000001D.00000002.19661065414.0000019F0BD90000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	19F0BD90000
Size:	4096

Details

Name:	00000020.00000003.18160813450.00000296E441E000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E441E000
Size:	122880

Details

Name:	0000000D.00000000.14856925589.000000007F760000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F760000
Size:	12288

Details

Name:	00000025.00000002.18578488113.0000021B53A20000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	21B53A20000
Size:	118784

Details

Name:	00000001.00000003.14613444487.000002DEA1449000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1449000
Size:	32768

Details

Name:	0000002C.00000003.18657424932.0000016FFD23C000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23C000
Size:	61440

Details

Name:	00000020.00000003.18202936821.00000296E4035000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4035000
Size:	4096

Details

Name:	00000020.00000002.19660814767.000000B1352FB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B1352FB000
Size:	20480

Details

Name:	0000002C.00000002.19665113663.00007FF6A3711000.00000002.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6A3711000
Size:	7516160

Details

Name:	00000020.00000002.19670402646.00000296DF840000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DF840000
Size:	65536

Details

Name:	00000001.00000003.14632516986.000002DEA1BE0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BE0000
Size:	122880

Details

Name:	00000026.00000003.18308051702.00000138BCCC2000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BCCC2000
Size:	69632

Details

Name:	0000002A.00000003.18540391895.0000022796E67000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	22796E67000
Size:	8192

Details

Name:	00000001.00000003.14615034388.000002DE9F5C4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DE9F5C4000
Size:	90112

Details

Name:	0000001D.00000002.19667556196.00007FF5EC1C2000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5EC1C2000
Size:	12288

Details

Name:	00000020.00000003.18161727123.00000296DEB7C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB7C000
Size:	8192

Details

Name:	0000001D.00000002.19665565456.00007DF4F4080000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4F4080000
Size:	20480

Details

Name:	0000002D.00000002.19665481084.00007FF5AFAA5000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5AFAA5000
Size:	8192

Details

Name:	00000020.00000003.18218172583.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000001.00000003.14636439052.000002DEA1CD7000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1CD7000
Size:	495616

Details

Name:	0000002A.00000002.18541474907.0000022796700000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	22796700000
Size:	24576

Details

Name:	00000020.00000003.18218753732.00000296E407B000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E407B000
Size:	45056

Details

Name:	0000002C.00000003.18654391748.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	36864

Details

Name:	00000025.00000002.18579759920.00007FF569606000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF569606000
Size:	8192

Details

Name:	00000001.00000002.14719042108.000002DEA0FD0000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2DEA0FD0000
Size:	4096

Details

Name:	0000002C.00000003.18653557140.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	28672

Details

Name:	00000001.00000003.14637514187.000002DEA1BFC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BFC000
Size:	266240

Details

Name:	0000002C.00000003.18633570282.0000016FFD224000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD224000
Size:	262144

Details

Name:	0000002D.00000000.18669208478.00007DF5B99D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99D0000
Size:	4096

Details

Name:	00000001.00000003.14711835554.000002DEA1511000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1511000
Size:	434176

Details

Name:	00000001.00000003.14625651074.000002DEA1EF4000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1EF4000
Size:	69632

Details

Name:	00000001.00000003.14614197814.000002DEA1474000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1474000
Size:	20480

Details

Name:	0000002C.00000003.18655684940.0000016FFD238000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD238000
Size:	24576

Details

Name:	00000028.00000003.18520985611.00000215F8406000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F8406000
Size:	86016

Details

Name:	00000028.00000003.18518864869.00000215F83EE000.00000004.00000001.sdmp
TargetID:	40
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215F83EE000
Size:	192512

Details

Name:	0000000D.00000002.19674726733.000000001E580000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E580000
Size:	4096

Details

Name:	00000005.00000000.14652281830.0000000000040000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	40000
Size:	118784

Details

Name:	00000001.00000003.14639522574.000002DEA1BF9000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BF9000
Size:	12288

Details

Name:	00000001.00000003.14633516832.000002DEA1C2D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C2D000
Size:	69632

Details

Name:	00000020.00000002.19671094130.00000296E3DA0000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3DA0000
Size:	4096

Details

Name:	0000002D.00000002.19664366167.00007DF5B99E2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B99E2000
Size:	4096

Details

Name:	00000020.00000003.18144747498.00000296E405C000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E405C000
Size:	20480

Details

Name:	00000020.00000003.18144833330.00000296E400F000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E400F000
Size:	12288

Details

Name:	0000002A.00000003.18538382125.0000022796F3E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	22796F3E000
Size:	16384

Details

Name:	00000005.00000002.15126304799.000000000092E000.00000004.00000001.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	92E000
Size:	8192

Details

Name:	00000026.00000003.18434216727.00000138BD8C1000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138BD8C1000
Size:	270336

Details

Name:	00000001.00000003.14646623137.000002DEA15A3000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15A3000
Size:	8192

Details

Name:	0000000D.00000002.19665992440.0000000003198000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	3198000
Size:	196608

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000020.00000002.19670739568.00000296DF940000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DF940000
Size:	4096

Details

Name:	00000026.00000003.18270289536.00000138AECAB000.00000004.00000001.sdmp
TargetID:	38
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	138AECAB000
Size:	4096

Details

Name:	00000028.00000000.18509391001.00007FF52FB4F000.00000002.00020000.sdmp
TargetID:	40
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FB4F000
Size:	20480

Details

Name:	00000001.00000003.14633046134.000002DEA1C0A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1C0A000
Size:	65536

Details

Name:	00000020.00000003.18139010319.00000296E3EAB000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3EAB000
Size:	4096

Details

Name:	0000002C.00000003.18641795054.0000016FFD22E000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD22E000
Size:	24576

Details

Name:	0000001D.00000000.18133724991.00007DF5F61D2000.00000002.00020000.sdmp
TargetID:	29
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F61D2000
Size:	4096

Details

Name:	00000001.00000003.14630530200.000002DEA15CC000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA15CC000
Size:	20480

Details

Name:	0000000D.00000002.19664136417.0000000002A1E000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A1E000
Size:	8192

Details

Name:	0000000D.00000002.19664322301.0000000002A2D000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2A2D000
Size:	8192

Details

Name:	00000001.00000003.14633858518.000002DEA1BEE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA1BEE000
Size:	65536

Details

Name:	00000020.00000002.19674490882.00007FF4FDD4A000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FDD4A000
Size:	4096

Details

Name:	0000000D.00000002.19674781267.000000001E73E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E73E000
Size:	8192

Details

Name:	0000002C.00000003.18647531490.0000016FFD233000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD233000
Size:	28672

Details

Name:	00000020.00000002.19669635190.00000296DEBE8000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEBE8000
Size:	8192

Details

Name:	0000002C.00000003.18650983351.0000016FFD237000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD237000
Size:	61440

Details

Name:	0000002A.00000002.18541937634.00007DF4CFBE0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4CFBE0000
Size:	20480

Details

Name:	00000020.00000002.19665318991.00000296DE2ED000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE2ED000
Size:	45056

Details

Name:	0000002C.00000003.18663185149.0000016FFD23F000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD23F000
Size:	61440

Details

Name:	00000020.00000002.19663277719.00000296DE213000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296DE213000
Size:	90112

Details

Name:	00000020.00000003.18187413544.00000296E4073000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E4073000
Size:	45056

Details

Name:	00000005.00000002.15126813162.0000000002290000.00000002.00020000.sdmp
TargetID:	5
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2290000
Size:	8192

Details

Name:	00000020.00000003.18161619963.00000296DEB66000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296DEB66000
Size:	73728

Details

Name:	00000020.00000003.18138767463.00000296E3E96000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E96000
Size:	4096

Details

Name:	0000002C.00000003.18644347152.0000016FFD230000.00000004.00000001.sdmp
TargetID:	44
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16FFD230000
Size:	53248

Details

Name:	0000002C.00000002.19664202064.00007FF6A36D1000.00000020.00020000.sdmp
TargetID:	44
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF6A36D1000
Size:	188416

Details

Name:	00000020.00000002.19662740759.00000296DE1A0000.00000002.00020000.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	296DE1A0000
Size:	4096

Details

Name:	00000020.00000002.19671569219.00000296E3F60000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3F60000
Size:	12288

Details

Name:	00000020.00000003.18138680786.00000296E3E90000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E3E90000
Size:	4096

Details

Name:	00000020.00000003.18161758477.00000296E41A9000.00000004.00000001.sdmp
TargetID:	32
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	296E41A9000
Size:	36864

Details

Name:	00000001.00000003.14614232154.000002DEA147C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2DEA147C000
Size:	20480

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps