Automated Malware Analysis IOC Report for

Details

Name:	00000023.00000003.18341814408.0000015B1C2D4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C2D4000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18402123411.0000015B1B2B1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18324547737.0000015B1B0B1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B0B1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18340752801.0000015B1B72C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B72C000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18319967809.0000015B1BE5C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE5C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18345035369.0000015B1B176000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B176000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Binary or sample is protected by dotNetProtector	Data Obfuscation
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18320598062.0000015B1B598000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B598000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May modify the system service descriptor table (often done to hook functions)	Hooking and other Techniques for Hiding and Protection	Credential API Hooking
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18350843348.0000015B1B3CA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B3CA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18299696915.0000015B1AF24000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF24000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18283887577.0000015B1A84E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A84E000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18424566697.0000015B1C41E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C41E000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Imminent RAT	Remote Access Functionality	Remote Access Software
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara detected Credential Stealer	Stealing of Sensitive Information
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18433124639.0000015B1B6E2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6E2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18336077687.0000015B1BE5C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE5C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18339192227.0000015B1C094000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C094000
Size:	102400

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18324883471.0000015B1B176000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B176000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18318671001.0000015B1C4A2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C4A2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18349339011.0000015B1A999000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A999000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18314163408.0000015B1BB45000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB45000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18309645507.0000015B1A404000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A404000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18315106599.0000015B1B858000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B858000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18289622866.0000015B1BD96000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD96000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18334520035.0000015B1A6C6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A6C6000
Size:	249856

Signature Hits	Behavior Group	Mitre Attack
Yara detected AllatoriJARObfuscator	Data Obfuscation
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18345359888.0000015B1A789000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A789000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara detected Winexe tool	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18289945062.0000015B1AE5F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected UACMe UAC Bypass tool	Exploits
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18431115827.0000015B1AFEA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFEA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clop Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cute Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Public key (encryption) found	Cryptography	Archive Collected Data
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18323536692.0000015B1B176000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B176000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18426889733.0000015B1BBC7000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BBC7000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Wannacry ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18285899877.0000015B1B2C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18339366931.0000015B1C174000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C174000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18297885321.0000015B1B490000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B490000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18322243559.0000015B1A504000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A504000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18320270470.0000015B1B515000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B515000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18425885690.0000015B1BCD0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BCD0000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected HawkEye Rat	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Artemon Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected ByteLocker Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected LazParking Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18299514362.0000015B1AF02000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF02000
Size:	94208

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary

Details

Name:	00000023.00000003.18423368163.0000015B1C1B6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C1B6000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Nanocore Rat	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18424989390.0000015B1C5AA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C5AA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected HiddenTear ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18304386604.0000015B1A404000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A404000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18335134155.0000015B1A914000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A914000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18346670516.0000015B1AC31000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC31000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18300906087.0000015B1A6C6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A6C6000
Size:	249856

Signature Hits	Behavior Group	Mitre Attack
Yara detected AllatoriJARObfuscator	Data Obfuscation

Details

Name:	00000023.00000003.18411185064.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18432136853.0000015B1BFE7000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFE7000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected NoCry Ransomware	Spam, unwanted Advertisements and Ransom Demands
Found Tor onion address	Networking	Proxy
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18330301023.0000015B1B598000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B598000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000023.00000003.18322924550.0000015B1B0F3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B0F3000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18352105294.0000015B1AC31000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC31000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18290355074.0000015B1AEB4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEB4000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18312369918.0000015B1C094000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C094000
Size:	102400

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18307753022.0000015B1B767000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B767000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18434111043.0000015B1AF23000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF23000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18281872533.0000015B1C527000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C527000
Size:	196608

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18337818328.0000015B1BB10000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB10000
Size:	208896

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18431805767.0000015B1BFA6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFA6000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found potential ransomware demand text	Spam, unwanted Advertisements and Ransom Demands
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18299055991.0000015B1A914000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A914000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000023.00000003.18347582446.0000015B1B490000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B490000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18305343223.0000015B1C4E5000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C4E5000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18433465792.0000015B1B723000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B723000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Found potential ransomware demand text	Spam, unwanted Advertisements and Ransom Demands
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18430078945.0000015B1C0AE000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0AE000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected GoGoogle ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Wannacry ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18342870635.0000015B1AB89000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB89000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Contains strings related to BOT control commands	Remote Access Functionality
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18341085023.0000015B1C4A2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C4A2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18409201535.0000015B1B281000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B281000
Size:	532480

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18429220503.0000015B1A3C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A3C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Mock Ransomware	Spam, unwanted Advertisements and Ransom Demands
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18299634028.0000015B1AF1A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF1A000
Size:	36864

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18403655888.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18283369164.0000015B1BBD8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BBD8000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18299377795.0000015B1AEE3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEE3000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18410667523.0000015B1B2B1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18311556427.0000015B1BE5C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE5C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18324208366.0000015B1BE5C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE5C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18329511287.0000015B1AC31000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC31000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18298772777.0000015B1A8DA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A8DA000
Size:	233472

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18417425467.0000015B1B2B1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2B1000
Size:	335872

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18313187984.0000015B1B305000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B305000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18427841372.0000015B1B933000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B933000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18329049691.0000015B1ABCB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ABCB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara detected Costura Assembly Loader	Data Obfuscation
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18307459590.0000015B1A504000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A504000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18337113449.0000015B1BB10000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB10000
Size:	208896

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18332888598.0000015B1C174000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C174000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000023.00000003.18418460951.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18430467796.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Yara detected LimeRAT	Key, Mouse, Clipboard, Microphone and Screen Capturing, Boot Survival, Malware Analysis System Evasion, Lowering of HIPS / PFW / Operating System Security Settings
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18325191461.0000015B1BE9F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE9F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18402637724.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18302210268.0000015B1AF24000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF24000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary

Details

Name:	00000023.00000003.18430797596.0000015B1AE5D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5D000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Yara detected Costura Assembly Loader	Data Obfuscation
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18328153087.0000015B1A914000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A914000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000023.00000003.18426595439.0000015B1BB86000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB86000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18348306594.0000015B1B176000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B176000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18293985930.0000015B1C0F1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0F1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18425422653.0000015B1C5EB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C5EB000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Niros Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.17634386230.0000000002220000.00000040.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	2220000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
Yara detected GuLoader	Data Obfuscation

Details

Name:	00000023.00000003.18286213062.0000015B1A381000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A381000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found string related to ransomware	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18293334552.0000015B1BC8E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BC8E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Found strings related to Crypto-Mining	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18315964598.0000015B1A481000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A481000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18418037701.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18331238413.0000015B1AAC2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AAC2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18336414128.0000015B1BF22000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF22000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18285687047.0000015B1B29A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B29A000
Size:	159744

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AllatoriJARObfuscator	Data Obfuscation
Yara detected MSILLoadEncryptedAssembly	Data Obfuscation
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18323230598.0000015B1B134000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B134000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18320914162.0000015B1B65F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B65F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18418909373.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18332249196.0000015B1A914000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A914000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000023.00000003.18340382300.0000015B1BB10000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB10000
Size:	208896

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18426294063.0000015B1BD11000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD11000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected GhostRat	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found strings related to Crypto-Mining	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18309001390.0000015B1AF24000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF24000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara signature match	System Summary

Details

Name:	00000008.00000002.21904007601.000000001E471000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E471000
Size:	303104

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Credential Stealer	Stealing of Sensitive Information
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18347963996.0000015B1BF22000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF22000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18428517155.0000015B1C06B000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C06B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Buran Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Gocoder ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18327176542.0000015B1B61C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B61C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18428865493.0000015B1A381000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A381000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Linux EvilGnome RC5 key	Key, Mouse, Clipboard, Microphone and Screen Capturing, Remote Access Functionality	Remote Access Software
Yara detected Metasploit Payload	Remote Access Functionality
Yara detected Meterpreter	Networking, Remote Access Functionality
Yara detected RevengeRAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18306567757.0000015B1C2D4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C2D4000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18343611807.0000015B1BD13000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD13000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18343459823.0000015B1AC31000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC31000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18411594732.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18351572125.0000015B1C174000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C174000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000023.00000003.18282376211.0000015B1C133000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C133000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18293045113.0000015B1BC4D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BC4D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18317647190.0000015B1B61C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B61C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18304719860.0000015B1B7EB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B7EB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Growtopia	Stealing of Sensitive Information, Remote Access Functionality
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18316997643.0000015B1B598000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B598000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000023.00000003.18310002934.0000015B1B40D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B40D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18282718286.0000015B1C174000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C174000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000023.00000003.18305228496.0000015B1B858000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B858000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18296064516.0000015B1BF22000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF22000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18403089371.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18294299849.0000015B1C174000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C174000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Costura Assembly Loader	Data Obfuscation
Yara signature match	System Summary

Details

Name:	00000023.00000003.18291855169.0000015B1B8B1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8B1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected UACMe UAC Bypass tool	Exploits
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18323868678.0000015B1BD96000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD96000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Voidcrypt Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara signature match	System Summary

Details

Name:	00000023.00000003.18287592963.0000015B1BBD8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BBD8000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner

Details

Name:	00000023.00000003.18325517837.0000015B1BF22000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF22000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected BitCoin Miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18427547415.0000015B1B8F2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8F2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18432805737.0000015B1BA3B000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BA3B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Clop Ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Nemty Ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18316329497.0000015B1A504000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A504000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18338385554.0000015B1B3CA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B3CA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Conti ransomware	Spam, unwanted Advertisements and Ransom Demands

Details

Name:	00000023.00000003.18428156417.0000015B1C02A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C02A000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Cerber ransomware	Spam, unwanted Advertisements and Ransom Demands
Yara detected Cryptolocker ransomware	Spam, unwanted Advertisements and Ransom Demands
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
Found Tor onion address	Networking	Proxy
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18305659214.0000015B1C39B000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C39B000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara detected AllatoriJARObfuscator	Data Obfuscation
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18284892419.0000015B1AF67000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF67000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18310362275.0000015B1B490000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B490000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18319632958.0000015B1BDD9000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BDD9000
Size:	151552

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18301965811.0000015B1AEB4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEB4000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18431461093.0000015B1B02B000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B02B000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara detected LimeRAT	Key, Mouse, Clipboard, Microphone and Screen Capturing, Boot Survival, Malware Analysis System Evasion, Lowering of HIPS / PFW / Operating System Security Settings
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18411989385.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner
Yara signature match	System Summary

Details

Name:	00000023.00000003.18331852304.0000015B1A84E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A84E000
Size:	184320

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000003.18335934182.0000015B1B858000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B858000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Yara detected Coinhive miner	Bitcoin Miner

Details

Name:	00000023.00000000.18220463386.0000015B08070000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	15B08070000
Size:	118784

Details

Name:	00000025.00000002.18521203770.0000020726EB0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726EB0000
Size:	12288

Details

Name:	00000019.00000003.18200773164.000001CCFDE2D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE2D000
Size:	16384

Details

Name:	00000023.00000003.18298177384.0000015B1AD15000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD15000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17619580331.0000000020778000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20778000
Size:	16384

Details

Name:	00000008.00000003.18503695657.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	36864

Details

Name:	00000019.00000003.18199480080.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.18518468501.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	65536

Details

Name:	00000008.00000003.17695876086.0000000001340000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1340000
Size:	12288

Details

Name:	00000008.00000003.18561327197.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18023481362.00000000031C3000.00000040.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	31C3000
Size:	4096

Details

Name:	0000002A.00000003.18687088213.00000265030F3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F3000
Size:	200704

Details

Name:	00000019.00000003.18138781743.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	0000002A.00000003.18689665494.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	57344

Details

Name:	00000019.00000003.18133658665.000001CCFD787000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD787000
Size:	4096

Details

Name:	00000023.00000003.18347542810.0000015B1A80C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A80C000
Size:	4096

Details

Name:	00000023.00000003.18311861284.0000015B1C02A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C02A000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000002.21913011856.00000000207F0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	207F0000
Size:	8192

Details

Name:	00000008.00000003.18557893037.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18288248948.0000015B1B1FB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B1FB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Installs a raw input device (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000000D.00000002.17942208438.000000000240E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	240E000
Size:	8192

Details

Name:	0000000D.00000002.17942643043.000000007FD80000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FD80000
Size:	20480

Details

Name:	00000008.00000003.17716358473.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21899137378.00007FF5D980B000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D980B000
Size:	12288

Details

Name:	00000008.00000003.18511047497.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000023.00000003.18319937476.0000015B1BE1A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE1A000
Size:	4096

Details

Name:	0000002A.00000003.19924065483.000002650311F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650311F000
Size:	69632

Details

Name:	00000019.00000003.18196825946.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000029.00000003.18657053159.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	69632

Details

Name:	0000002A.00000003.18690498407.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	57344

Details

Name:	00000025.00000003.18513291531.00000207277DA000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277DA000
Size:	471040

Details

Name:	00000008.00000003.18514825701.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.21753769869.000001681950A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950A000
Size:	32768

Details

Name:	00000008.00000003.18560781459.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18318011100.0000015B1C41E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C41E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000018.00000002.21893743436.00007FF5BD29C000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD29C000
Size:	4096

Details

Name:	00000008.00000003.17695792669.0000000001340000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1340000
Size:	16384

Details

Name:	00000008.00000003.18560180033.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19907878675.00000265030FA000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030FA000
Size:	20480

Details

Name:	00000008.00000003.17613410679.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18552263947.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000027.00000003.18540035910.0000016EE038E000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE038E000
Size:	8192

Details

Name:	00000008.00000003.18517842324.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000001.00000002.17632774863.0000000000289000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	289000
Size:	4096

Details

Name:	00000008.00000002.21886274748.0000000000FF0000.00000004.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	FF0000
Size:	4096

Details

Name:	0000002E.00000003.21753357297.0000016819545000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819545000
Size:	12288

Details

Name:	0000002A.00000002.19960723769.00007FF5797B7000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797B7000
Size:	4096

Details

Name:	0000002A.00000003.18678124533.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	262144

Details

Name:	00000023.00000003.18346075474.0000015B1C39A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C39A000
Size:	4096

Details

Name:	0000000F.00000002.18023300865.0000000001D00000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D00000
Size:	4096

Details

Name:	00000008.00000003.17691523333.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21122302889.000000B8D63FE000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B8D63FE000
Size:	8192

Details

Name:	0000002A.00000002.19962483459.00007FF5798A4000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798A4000
Size:	8192

Details

Name:	00000023.00000003.18276770875.0000015B08189000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08189000
Size:	65536

Details

Name:	00000018.00000002.21889673850.00000205EE313000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE313000
Size:	20480

Details

Name:	00000008.00000002.21902347461.000000001E250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E250000
Size:	4096

Details

Name:	00000008.00000003.18574688363.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18576295538.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18513634286.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000023.00000003.18332185003.0000015B1A88D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A88D000
Size:	4096

Details

Name:	00000019.00000003.18167901225.000001CCF85B7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B7000
Size:	45056

Details

Name:	00000019.00000003.18169480731.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000027.00000002.18541664729.0000016EDFA50000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFA50000
Size:	4096

Details

Name:	0000002A.00000000.18667116681.00007FF56A195000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56A195000
Size:	4096

Details

Name:	0000002A.00000002.19961421148.00007FF57982F000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57982F000
Size:	4096

Details

Name:	00000008.00000002.21902228615.000000001E246000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E246000
Size:	8192

Details

Name:	00000019.00000002.21891872875.000001CCF8415000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8415000
Size:	8192

Details

Name:	00000019.00000002.21899980945.00007FF5DA071000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA071000
Size:	16384

Details

Name:	00000001.00000000.16839990124.000000007FFB2000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB2000
Size:	4096

Details

Name:	00000019.00000002.21889308288.000001CCF7C51000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C51000
Size:	28672

Details

Name:	0000000D.00000002.17940754261.00000000005F0000.00000004.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	5F0000
Size:	8192

Details

Name:	0000002A.00000002.19954921923.000000BD2637E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD2637E000
Size:	8192

Details

Name:	00000019.00000003.18199061762.000001CCFDE2D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE2D000
Size:	237568

Details

Name:	00000023.00000003.18345716245.0000015B1A80C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A80C000
Size:	4096

Details

Name:	00000008.00000003.17616023627.000000001E316000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E316000
Size:	16384

Details

Name:	00000008.00000003.17696666943.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18311262453.0000015B1BE1B000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE1B000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary or sample is protected by dotNetProtector	Data Obfuscation
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000029.00000002.19967918629.00007DF5780E2000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780E2000
Size:	4096

Details

Name:	00000008.00000002.21891536238.00000000017C6000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	17C6000
Size:	12288

Details

Name:	00000008.00000002.21887866584.0000000001490000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1490000
Size:	16384

Details

Name:	00000008.00000003.18543691916.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000029.00000003.18653402242.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	65536

Details

Name:	00000022.00000000.18190578944.00007FF524811000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF524811000
Size:	4096

Details

Name:	0000002E.00000002.21762977433.00007FF5A2ADA000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ADA000
Size:	4096

Details

Name:	00000019.00000002.21895685882.000001CCFD720000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD720000
Size:	4096

Details

Name:	00000025.00000002.18521717196.000002072702B000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2072702B000
Size:	4096

Details

Name:	00000023.00000000.18220716400.00007DF5B95F0000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B95F0000
Size:	12288

Details

Name:	00000025.00000002.18520859028.0000020726E70000.00000004.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	20726E70000
Size:	4096

Details

Name:	00000019.00000003.18165958456.000001CCF85B7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B7000
Size:	45056

Details

Name:	00000023.00000003.18337033084.0000015B1BB02000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB02000
Size:	53248

Details

Name:	00000008.00000003.18527580752.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	0000002E.00000002.21756968600.0000016818BA0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818BA0000
Size:	4096

Details

Name:	00000008.00000003.18511243176.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000002.21912408579.0000000020731000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20731000
Size:	16384

Details

Name:	00000008.00000003.18543899168.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	16384

Details

Name:	00000008.00000003.17695291686.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000002A.00000002.19959427291.00007FF578D72000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578D72000
Size:	4096

Details

Name:	00000019.00000003.18167029439.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000023.00000003.18295774211.0000015B1BEE1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BEE1000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found Tor onion address	Networking	Proxy
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000000.18221737104.00007FF791D0C000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF791D0C000
Size:	28672

Details

Name:	00000019.00000003.18198023156.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000019.00000003.18234843560.000001CCFDE3A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE3A000
Size:	12288

Details

Name:	00000008.00000002.21903469747.000000001E430000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E430000
Size:	65536

Details

Name:	00000025.00000003.18517432583.000002072781E000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072781E000
Size:	16384

Details

Name:	00000023.00000003.18347891110.0000015B1B4D2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B4D2000
Size:	4096

Details

Name:	00000025.00000003.18515996882.000002072781E000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072781E000
Size:	16384

Details

Name:	00000022.00000002.18581544484.00007FF52FD6E000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD6E000
Size:	16384

Details

Name:	00000008.00000003.18559175181.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18154309528.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000018.00000002.21892742823.00007FF5BD1F7000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD1F7000
Size:	4096

Details

Name:	00000008.00000003.18528769508.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.18577163092.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18575744669.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21123042826.000002779C320000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C320000
Size:	4096

Details

Name:	0000002A.00000002.19961270908.00007FF57981E000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57981E000
Size:	4096

Details

Name:	00000008.00000003.18545184772.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18505782137.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17689662103.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	0000002A.00000000.18667059105.00007DF590D50000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D50000
Size:	12288

Details

Name:	00000023.00000003.18289300479.0000015B1BD55000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD55000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18656631210.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000008.00000003.18511769174.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.18504423386.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000008.00000003.18556047685.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	20480

Details

Name:	00000008.00000003.17618537416.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	45056

Details

Name:	00000019.00000002.21889478330.000001CCF7C61000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C61000
Size:	20480

Details

Name:	00000023.00000003.18287888120.0000015B1BC0A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BC0A000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17684839185.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19960684164.00007FF5797B3000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797B3000
Size:	4096

Details

Name:	00000018.00000002.21889378064.00000205EE2D7000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE2D7000
Size:	16384

Details

Name:	00000008.00000003.18527241523.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	20480

Details

Name:	00000023.00000003.18288576507.0000015B08190000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08190000
Size:	20480

Details

Name:	0000002E.00000003.19928664854.000001681952D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952D000
Size:	4096

Details

Name:	00000019.00000003.18186095264.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.17690319485.0000000001280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1280000
Size:	16384

Details

Name:	00000027.00000002.18542700576.00007FF57F222000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57F222000
Size:	28672

Details

Name:	00000008.00000002.21900791559.000000001DBDE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DBDE000
Size:	8192

Details

Name:	00000008.00000003.18552634692.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19960135249.00007FF5795B9000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5795B9000
Size:	4096

Details

Name:	00000008.00000003.18505376296.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18539358316.0000016EE03C5000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03C5000
Size:	90112

Details

Name:	00000022.00000002.18580350398.0000017534290000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	17534290000
Size:	4096

Details

Name:	00000019.00000003.18179948379.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000023.00000003.18301552816.0000015B1B9FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9FA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000000D.00000002.17942461461.00000000025C0000.00000004.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	25C0000
Size:	4096

Details

Name:	00000029.00000003.18647468676.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	32768

Details

Name:	00000019.00000003.18155094883.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	0000002E.00000002.21757500443.0000016818C40000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C40000
Size:	28672

Details

Name:	00000019.00000003.18154372337.000001CCFDE02000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE02000
Size:	94208

Details

Name:	00000025.00000002.18522975169.00007FF5592A4000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592A4000
Size:	8192

Details

Name:	00000019.00000002.21895600202.000001CCFD6E0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD6E0000
Size:	4096

Details

Name:	0000002A.00000003.18692921910.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	57344

Details

Name:	00000023.00000003.18325488726.0000015B1BEE0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BEE0000
Size:	4096

Details

Name:	00000025.00000002.18522105332.00007DF570740000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570740000
Size:	4096

Details

Name:	00000008.00000003.18018064854.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17642308246.000000007FFC2000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC2000
Size:	4096

Details

Name:	0000002D.00000003.19911080038.000002779C702000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C702000
Size:	16384

Details

Name:	00000008.00000003.18553078590.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757110258.0000016818C00000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C00000
Size:	73728

Details

Name:	00000019.00000002.21900474347.00007FF5DA41C000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA41C000
Size:	4096

Details

Name:	00000023.00000003.18402988322.0000015B1B291000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B291000
Size:	65536

Details

Name:	00000029.00000002.19968419222.00007FF560C47000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C47000
Size:	4096

Details

Name:	0000002D.00000002.21125000326.00007FF4FCFFA000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFFA000
Size:	12288

Details

Name:	00000008.00000003.18561444958.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000000.17935910640.000000000010E000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	10E000
Size:	4096

Details

Name:	00000025.00000003.18517369003.00000207277D4000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D4000
Size:	20480

Details

Name:	0000002A.00000003.18689014908.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	106496

Details

Name:	00000023.00000003.18303772420.0000015B1B8F2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8F2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000002.21910518504.000000001F499000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1F499000
Size:	139264

Details

Name:	00000008.00000003.18624808021.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	28672

Details

Name:	00000008.00000002.21902728553.000000001E2DC000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E2DC000
Size:	16384

Details

Name:	00000023.00000003.18350289745.0000015B1B712000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B712000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18506959548.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18018750834.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21753662430.0000016819518000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819518000
Size:	65536

Details

Name:	00000008.00000002.21905599123.000000001E593000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E593000
Size:	4096

Details

Name:	00000008.00000003.17712957787.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21887657722.0000000001360000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1360000
Size:	16384

Details

Name:	00000025.00000002.18520747096.000000BFF397E000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BFF397E000
Size:	8192

Details

Name:	00000008.00000003.18516426878.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.17689581989.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000019.00000003.18239264054.000001CCFDA5D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA5D000
Size:	8192

Details

Name:	00000008.00000003.17612752896.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	36864

Details

Name:	00000019.00000002.21890122767.000001CCF7C9D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C9D000
Size:	12288

Details

Name:	00000029.00000003.18653930859.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	32768

Details

Name:	00000023.00000003.18302181106.0000015B1AEE2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEE2000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000003.18156439597.000001CCFDBF3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF3000
Size:	4096

Details

Name:	00000008.00000002.21914922086.000000007F910000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F910000
Size:	20480

Details

Name:	0000002E.00000003.19929714640.0000016819574000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819574000
Size:	4096

Details

Name:	00000008.00000003.18521438061.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	32768

Details

Name:	00000008.00000003.18544569829.000000001D251000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D251000
Size:	61440

Details

Name:	0000002E.00000003.21754340038.000001681951A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951A000
Size:	8192

Details

Name:	00000008.00000003.18560946163.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18334190857.0000015B1A60C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A60C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18543641820.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18508067512.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18837249876.000001CCFDBDB000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBDB000
Size:	16384

Details

Name:	00000008.00000000.17218407262.0000000001360000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1360000
Size:	16384

Details

Name:	00000019.00000002.21901239932.00007FF5DA6B8000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6B8000
Size:	8192

Details

Name:	00000008.00000003.17689882548.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000008.00000003.18515938645.000000001D1B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1B0000
Size:	65536

Details

Name:	00000008.00000002.21902609107.000000001E25B000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E25B000
Size:	4096

Details

Name:	00000008.00000003.18529237628.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	0000002A.00000003.18685255293.00000265030F2000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F2000
Size:	32768

Details

Name:	00000008.00000003.17697012516.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21915115656.000000007FA80000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA80000
Size:	4096

Details

Name:	0000002E.00000003.19940683054.0000016819CAD000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819CAD000
Size:	12288

Details

Name:	00000008.00000003.17717122400.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000000.18667934542.00007FF650D77000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650D77000
Size:	139264

Details

Name:	00000008.00000003.18573839575.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18575530927.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18511551311.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.17689497340.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	20480

Details

Name:	00000008.00000003.18553146151.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21889984110.00000205EE640000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE640000
Size:	16384

Details

Name:	0000002D.00000003.19912694345.000002779C713000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C713000
Size:	16384

Details

Name:	00000023.00000003.18332215420.0000015B1A890000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A890000
Size:	4096

Details

Name:	00000029.00000002.19968121100.00007FF560BDE000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560BDE000
Size:	12288

Details

Name:	00000008.00000003.18548928647.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	61440

Details

Name:	0000002A.00000003.19954162768.00000265030BE000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030BE000
Size:	32768

Details

Name:	00000019.00000003.18213633200.000001CCFDE23000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE23000
Size:	57344

Details

Name:	0000002E.00000003.21755656852.0000016819579000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819579000
Size:	4096

Details

Name:	0000000F.00000003.18019961091.00000000058E3000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	58E3000
Size:	53248

Details

Name:	00000019.00000002.21891804877.000001CCF8402000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8402000
Size:	4096

Details

Name:	0000002E.00000003.21755149416.000001681952C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952C000
Size:	24576

Details

Name:	0000002D.00000002.21125048924.00007FF4FD001000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD001000
Size:	4096

Details

Name:	00000001.00000003.17217915799.0000000000554000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	554000
Size:	4096

Details

Name:	00000025.00000003.18515742542.0000020727822000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727822000
Size:	176128

Details

Name:	00000008.00000003.18627762843.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	8192

Details

Name:	00000008.00000003.17696707948.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000000.18610771251.00007FF6836C1000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6836C1000
Size:	7516160

Details

Name:	00000008.00000002.21901040683.000000001DDAE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DDAE000
Size:	8192

Details

Name:	0000002D.00000002.21124432724.00007FF4FCF30000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCF30000
Size:	8192

Details

Name:	00000008.00000003.18529793081.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	24576

Details

Name:	00000008.00000003.18514661100.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18501411808.00000000017A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	17A0000
Size:	65536

Details

Name:	00000019.00000003.18133220460.000001CCFD770000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD770000
Size:	12288

Details

Name:	00000023.00000003.18293662919.0000015B1BCD0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BCD0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000001.00000002.17634754051.0000000002310000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2310000
Size:	4096

Details

Name:	00000022.00000003.18218518851.00000175342F1000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F1000
Size:	262144

Details

Name:	00000008.00000003.18527142893.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	28672

Details

Name:	00000008.00000000.17217752388.000000007FA82000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA82000
Size:	4096

Details

Name:	00000023.00000003.18327477882.0000015B1B65E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B65E000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18650298787.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	20480

Details

Name:	00000023.00000003.18248049906.0000015B0B9AF000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B9AF000
Size:	8192

Details

Name:	00000025.00000003.18514733163.00000207277CE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277CE000
Size:	49152

Details

Name:	00000018.00000002.21891182790.00007FF5BC453000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC453000
Size:	28672

Details

Name:	00000008.00000003.18577218831.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17617259458.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000029.00000003.18642180334.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	32768

Details

Name:	00000023.00000003.18301236868.0000015B1B97A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B97A000
Size:	249856

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18344667874.0000015B1B06E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B06E000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18282239876.0000015B1C55A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C55A000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18665355242.000001D4525D0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D0000
Size:	155648

Details

Name:	00000008.00000003.18587187504.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17688979302.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21889885048.000001CCF7C8A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C8A000
Size:	12288

Details

Name:	00000008.00000003.17689348266.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000023.00000003.18403506958.0000015B1B281000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B281000
Size:	65536

Details

Name:	00000008.00000003.18537899187.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000019.00000003.18139559449.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000025.00000003.18518218745.00000207277D8000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D8000
Size:	4096

Details

Name:	00000029.00000002.19968552833.00007FF560C7E000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C7E000
Size:	16384

Details

Name:	00000008.00000003.17717399934.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18532767499.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	20480

Details

Name:	00000019.00000003.18166923025.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	4096

Details

Name:	00000029.00000003.18620574617.000001D4525D1000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D1000
Size:	110592

Details

Name:	00000019.00000003.18226071989.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	28672

Details

Name:	0000002A.00000003.19952188433.000002650310B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650310B000
Size:	12288

Details

Name:	00000008.00000003.17690393071.0000000001280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1280000
Size:	16384

Details

Name:	00000008.00000003.18576654991.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18541760072.000000001D2F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2F0000
Size:	24576

Details

Name:	00000022.00000002.18581274215.00007FF52FCEF000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FCEF000
Size:	8192

Details

Name:	00000023.00000003.18346441801.0000015B1AB88000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB88000
Size:	4096

Details

Name:	00000008.00000003.17683835162.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17617957349.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	57344

Details

Name:	00000019.00000003.18210941187.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000029.00000003.18643612271.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	53248

Details

Name:	00000008.00000003.18532212498.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000008.00000003.17618711134.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000023.00000003.18325820424.0000015B1AC91000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC91000
Size:	4096

Details

Name:	0000002E.00000003.19928347064.0000016818C8E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C8E000
Size:	12288

Details

Name:	00000029.00000003.18665224340.000001D4525C5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525C5000
Size:	36864

Details

Name:	0000002A.00000000.18668157792.00007FF650D9C000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650D9C000
Size:	28672

Details

Name:	0000000F.00000000.18016906875.000000007F920000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F920000
Size:	12288

Details

Name:	00000008.00000000.17217688327.000000007FA72000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA72000
Size:	4096

Details

Name:	00000008.00000003.17688851218.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17618055514.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002E.00000002.21760504012.0000016819C8B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C8B000
Size:	4096

Details

Name:	00000008.00000003.18500905689.000000001D1EA000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1EA000
Size:	24576

Details

Name:	0000002E.00000003.19927869183.0000016819556000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819556000
Size:	20480

Details

Name:	0000002E.00000002.21758325301.0000016818CB5000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB5000
Size:	12288

Details

Name:	00000029.00000002.19967173513.000001D452580000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452580000
Size:	4096

Details

Name:	00000018.00000002.21893054122.00007FF5BD25E000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD25E000
Size:	4096

Details

Name:	00000008.00000003.18554225606.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18555113392.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	65536

Details

Name:	00000008.00000003.18509618628.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000027.00000003.18540802568.0000016EDFE54000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE54000
Size:	4096

Details

Name:	0000000F.00000002.18020806941.0000000000F5E000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F5E000
Size:	4096

Details

Name:	00000008.00000003.17696750373.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17612036579.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	24576

Details

Name:	00000023.00000003.18300585182.0000015B1A681000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A681000
Size:	229376

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18513934718.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.17615121931.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17692479595.00000000012A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12A0000
Size:	53248

Details

Name:	00000023.00000003.18286537046.0000015B1A3C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A3C2000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18517015448.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000008.00000003.18547325825.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	12288

Details

Name:	00000023.00000003.18319337149.0000015B1A60C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A60C000
Size:	266240

Details

Name:	00000023.00000003.18283012261.0000015B1BB87000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB87000
Size:	245760

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000022.00000003.18218952704.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	00000027.00000003.18539488399.0000016EE03BC000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03BC000
Size:	36864

Details

Name:	0000002D.00000002.21125088929.00007FF4FD024000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD024000
Size:	8192

Details

Name:	0000002D.00000002.21122649352.000002779C1D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C1D0000
Size:	118784

Details

Name:	00000008.00000002.21914649376.00000000217DE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	217DE000
Size:	8192

Details

Name:	00000027.00000002.18542148470.0000016EDFC52000.00000004.00000020.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16EDFC52000
Size:	73728

Details

Name:	00000019.00000003.18131933652.000001CCFD73D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD73D000
Size:	4096

Details

Name:	00000029.00000003.18620980600.000001D4525D1000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D1000
Size:	16384

Details

Name:	00000008.00000003.18504364473.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000008.00000003.17614862006.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000008.00000003.18574193061.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17618435543.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	00000023.00000003.18315624417.0000015B1B02C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B02C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18342184671.0000015B1C358000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C358000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18639468667.000001D4525DB000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DB000
Size:	65536

Details

Name:	00000029.00000000.18610229155.00007DF5780F0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780F0000
Size:	12288

Details

Name:	00000008.00000002.21887743904.0000000001370000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1370000
Size:	4096

Details

Name:	00000022.00000000.18190897779.00007FF75886F000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF75886F000
Size:	61440

Details

Name:	00000029.00000002.19968658046.00007FF683681000.00000020.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF683681000
Size:	188416

Details

Name:	0000002E.00000002.21759826474.0000016819C1C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C1C000
Size:	4096

Details

Name:	00000008.00000003.17617358784.000000001E317000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E317000
Size:	16384

Details

Name:	00000008.00000002.21903750083.000000001E44B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E44B000
Size:	4096

Details

Name:	0000002D.00000002.21123341406.000002779C411000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C411000
Size:	4096

Details

Name:	00000008.00000003.17615728971.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18530287806.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	0000002A.00000002.19955826639.00000265030B5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265030B5000
Size:	8192

Details

Name:	0000002E.00000003.19928757287.0000016818C92000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C92000
Size:	4096

Details

Name:	00000023.00000003.18345686124.0000015B1A7CA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A7CA000
Size:	4096

Details

Name:	00000008.00000002.21886368404.000000000104E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	104E000
Size:	8192

Details

Name:	00000008.00000003.18577581951.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000003.18517079841.00000207277E3000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E3000
Size:	16384

Details

Name:	00000019.00000003.18166798183.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	20480

Details

Name:	00000008.00000003.17688164093.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18167163450.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	0000002E.00000003.19930031276.000001681952F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952F000
Size:	4096

Details

Name:	00000008.00000003.17616248328.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18556775229.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17691799806.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17613594716.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.17695193677.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18538391867.0000016EE0369000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0369000
Size:	4096

Details

Name:	00000022.00000000.18190540138.00007DF5471E0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471E0000
Size:	12288

Details

Name:	00000008.00000003.17619071498.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	57344

Details

Name:	00000008.00000003.18549684000.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	65536

Details

Name:	00000008.00000003.18575477506.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959230194.00007DF590D42000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D42000
Size:	4096

Details

Name:	00000001.00000002.17634917308.0000000002BD9000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2BD9000
Size:	24576

Details

Name:	0000002E.00000003.21752164581.0000016818CB1000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB1000
Size:	8192

Details

Name:	00000019.00000003.18169443326.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.18625488226.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	40960

Details

Name:	0000000D.00000000.17936333753.000000007FF00000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF00000
Size:	12288

Details

Name:	0000002A.00000003.19954237399.00000265030B7000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030B7000
Size:	28672

Details

Name:	00000008.00000002.21900474940.000000001D830000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D830000
Size:	4096

Details

Name:	00000019.00000003.18226150710.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	57344

Details

Name:	00000008.00000003.18546593374.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	65536

Details

Name:	00000008.00000003.18512224929.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	24576

Details

Name:	0000002A.00000002.19959706342.00007FF579032000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579032000
Size:	8192

Details

Name:	00000025.00000002.18522934217.00007FF559281000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF559281000
Size:	4096

Details

Name:	00000029.00000003.18628596201.000001D4525D3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D3000
Size:	262144

Details

Name:	00000029.00000002.19968903354.00007FF6836AF000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6836AF000
Size:	61440

Details

Name:	00000019.00000003.18139334249.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	0000002A.00000002.19958657989.0000026503D80000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503D80000
Size:	86016

Details

Name:	00000008.00000003.18549794358.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	16384

Details

Name:	00000019.00000003.18212352333.000001CCF8582000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8582000
Size:	24576

Details

Name:	00000022.00000003.18579565235.00000175342EE000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342EE000
Size:	12288

Details

Name:	0000000F.00000002.18022676726.00000000017E0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	17E0000
Size:	4096

Details

Name:	00000027.00000002.18542611199.00007DF5972C2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972C2000
Size:	4096

Details

Name:	00000008.00000003.17716657263.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18182142709.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000001.00000003.16921538714.0000000000554000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	554000
Size:	4096

Details

Name:	00000019.00000003.18154093931.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.18557071091.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18512904515.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.18551787992.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18334831739.0000015B1A746000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A746000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.19965882269.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	24576

Details

Name:	00000019.00000003.18196784281.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000025.00000003.18519756269.00000207272DE000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272DE000
Size:	4096

Details

Name:	00000008.00000003.17716712702.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000002.19967657020.000001D452710000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D452710000
Size:	4096

Details

Name:	00000008.00000003.18507275697.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000019.00000003.18154236840.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000029.00000002.19967097565.000001D452480000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452480000
Size:	4096

Details

Name:	00000008.00000003.17619159431.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002D.00000002.21124203529.00007DF5144C2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144C2000
Size:	4096

Details

Name:	00000025.00000003.18518931195.00000207277FC000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277FC000
Size:	16384

Details

Name:	0000002A.00000003.19942855908.0000026503C30000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503C30000
Size:	4096

Details

Name:	00000008.00000002.21915057016.000000007FA72000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA72000
Size:	4096

Details

Name:	00000023.00000003.18315587745.0000015B1AFEA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFEA000
Size:	4096

Details

Name:	00000008.00000003.17614266967.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17614931604.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000008.00000003.17684899413.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616612912.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	0000002A.00000002.19956286592.000002650310B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650310B000
Size:	12288

Details

Name:	00000029.00000003.18656400232.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	28672

Details

Name:	0000002A.00000000.18666502471.0000026502F00000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	26502F00000
Size:	118784

Details

Name:	00000008.00000003.18516747852.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002A.00000002.19962374952.00007FF57987A000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57987A000
Size:	12288

Details

Name:	00000001.00000002.17633771401.00000000007AF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7AF000
Size:	4096

Details

Name:	00000008.00000003.18519277050.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21888025585.000001CCF7A10000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7A10000
Size:	12288

Details

Name:	0000000F.00000002.18023360349.0000000003130000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3130000
Size:	4096

Details

Name:	00000022.00000002.18581371920.00007FF52FD34000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD34000
Size:	8192

Details

Name:	00000008.00000003.17717960743.0000000001340000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1340000
Size:	12288

Details

Name:	00000001.00000002.17633871078.0000000000A30000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	A30000
Size:	36864

Details

Name:	00000023.00000003.18229047593.0000015B08155000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08155000
Size:	262144

Details

Name:	0000002A.00000002.19962591710.00007FF5798B2000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798B2000
Size:	8192

Details

Name:	00000018.00000002.21886368272.000000303617D000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	303617D000
Size:	12288

Details

Name:	0000002E.00000002.21757575759.0000016818C48000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C48000
Size:	36864

Details

Name:	0000002A.00000002.19957996884.0000026503D20000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	26503D20000
Size:	12288

Details

Name:	00000023.00000003.18297596094.0000015B1B44F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B44F000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
Binary or sample is protected by dotNetProtector	Data Obfuscation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17717788291.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18136993627.000001CCFDA5C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA5C000
Size:	20480

Details

Name:	00000019.00000002.21900255649.00007FF5DA307000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA307000
Size:	4096

Details

Name:	00000008.00000003.18544312732.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000019.00000003.18155063158.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	4096

Details

Name:	00000019.00000003.18211878164.000001CCFDE03000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE03000
Size:	126976

Details

Name:	00000008.00000003.18532571177.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000019.00000003.18152407649.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000008.00000003.18503095662.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000002.21893055738.0000000002FF9000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2FF9000
Size:	24576

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000008.00000003.18545929118.000000001D2B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2B0000
Size:	57344

Details

Name:	00000025.00000003.18520076505.00000207277C9000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277C9000
Size:	16384

Details

Name:	00000019.00000002.21888460393.000001CCF7B91000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7B91000
Size:	12288

Details

Name:	00000022.00000002.18580845133.00007DF5471C0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471C0000
Size:	4096

Details

Name:	00000023.00000003.18337362619.0000015B1B9FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9FA000
Size:	266240

Details

Name:	00000027.00000002.18542495872.00007DF5972B0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972B0000
Size:	4096

Details

Name:	00000008.00000003.18574331874.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18681549536.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	0000002A.00000002.19957564240.0000026503780000.00000008.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page write copy
Base address:	26503780000
Size:	286720

Details

Name:	00000019.00000003.18165826386.000001CCF85A9000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A9000
Size:	45056

Details

Name:	00000008.00000003.18528013070.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000008.00000000.17218269119.0000000001200000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1200000
Size:	118784

Details

Name:	00000029.00000003.18651863681.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	40960

Details

Name:	00000008.00000003.17686226593.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21887254552.00000205EE0C0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE0C0000
Size:	4096

Details

Name:	00000008.00000003.18529031661.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	0000002A.00000003.19951664875.00000265037D0000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	265037D0000
Size:	8192

Details

Name:	00000008.00000003.18510169275.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18519809535.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18539163478.0000016EE0368000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0368000
Size:	4096

Details

Name:	00000019.00000003.18180495360.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000003.18587345182.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000002.18541827241.0000016EDFBC0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFBC0000
Size:	4096

Details

Name:	0000002A.00000003.18699465538.00000265030FF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030FF000
Size:	32768

Details

Name:	00000008.00000003.17612542533.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18508821579.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000018.00000002.21892100583.00007FF5BCF8B000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCF8B000
Size:	12288

Details

Name:	00000008.00000002.21912253389.0000000020722000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20722000
Size:	28672

Details

Name:	00000008.00000003.18556108798.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	8192

Details

Name:	00000025.00000003.18520174433.00000207272D2000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D2000
Size:	4096

Details

Name:	0000002E.00000002.21762509894.00007FF5A2AA6000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AA6000
Size:	8192

Details

Name:	0000002A.00000002.19955054718.000000BD2657F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD2657F000
Size:	4096

Details

Name:	00000008.00000003.18587257064.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000002.19966802066.000001D452430000.00000004.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1D452430000
Size:	4096

Details

Name:	0000002E.00000002.21760114058.0000016819C52000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C52000
Size:	36864

Details

Name:	0000002E.00000000.19926148279.00007DF5B9FB0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FB0000
Size:	4096

Details

Name:	00000019.00000000.18129981506.00007DF5F1BF2000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1BF2000
Size:	4096

Details

Name:	00000019.00000002.21901952416.00007FF5DA6FA000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6FA000
Size:	12288

Details

Name:	0000000F.00000002.18022353455.000000000160B000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	160B000
Size:	12288

Details

Name:	0000002A.00000003.19915458099.0000026503117000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503117000
Size:	16384

Details

Name:	0000000D.00000003.17939377648.0000000002570000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2570000
Size:	65536

Details

Name:	00000008.00000002.21902046678.000000001E23D000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E23D000
Size:	8192

Details

Name:	00000018.00000002.21888798162.00000205EE26D000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE26D000
Size:	106496

Details

Name:	00000023.00000003.18424133495.0000015B1C0F0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0F0000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18550117205.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18295372118.0000015B1B016000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B016000
Size:	86016

Details

Name:	00000008.00000003.17618190297.000000001E318000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E318000
Size:	24576

Details

Name:	00000008.00000002.21892156803.0000000001B90000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1B90000
Size:	4096

Details

Name:	0000000F.00000002.18024009930.0000000003270000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3270000
Size:	65536

Details

Name:	00000008.00000003.18524964855.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000019.00000003.18212590477.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000003.18543493781.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000022.00000002.18580741713.00000175344E0000.00000004.00000040.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	175344E0000
Size:	12288

Details

Name:	00000019.00000003.18134108897.000001CCFD730000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD730000
Size:	4096

Details

Name:	00000008.00000003.18574258892.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17599947344.000000001DF60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1DF60000
Size:	4096

Details

Name:	00000019.00000003.18185418089.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	0000002E.00000003.19927927082.000001681956B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681956B000
Size:	16384

Details

Name:	00000027.00000003.18539678088.0000016EE0380000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0380000
Size:	16384

Details

Name:	00000008.00000003.18552009973.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21888117624.000001CCF7A20000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7A20000
Size:	4096

Details

Name:	00000023.00000003.18325846428.0000015B1AC93000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC93000
Size:	4096

Details

Name:	00000008.00000003.18505646740.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18554332684.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17610937044.000000000161D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	161D000
Size:	16384

Details

Name:	0000002E.00000002.21756921303.0000016818B90000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818B90000
Size:	12288

Details

Name:	00000018.00000002.21886216227.000000303607B000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	303607B000
Size:	20480

Details

Name:	0000002A.00000002.19962201935.00007FF579862000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579862000
Size:	57344

Details

Name:	00000027.00000002.18543233280.00007FF57FDF4000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDF4000
Size:	20480

Details

Name:	00000027.00000003.18540836536.0000016EDFE57000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE57000
Size:	4096

Details

Name:	0000002E.00000003.21754964279.000001681950D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950D000
Size:	20480

Details

Name:	00000008.00000003.18546725215.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	53248

Details

Name:	00000008.00000003.18511193140.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000019.00000003.18155169746.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000025.00000003.18519701386.00000207272DB000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272DB000
Size:	16384

Details

Name:	00000027.00000003.18540579642.0000016EDFDA0000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EDFDA0000
Size:	8192

Details

Name:	0000002A.00000000.18666853788.00007DF590D32000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D32000
Size:	4096

Details

Name:	00000008.00000003.17716422332.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21762805023.00007FF5A2AC4000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AC4000
Size:	24576

Details

Name:	00000019.00000003.18155019543.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	00000025.00000002.18522643003.00007FF55925F000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF55925F000
Size:	8192

Details

Name:	00000008.00000003.17686552486.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21887161720.00000205EE0B0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE0B0000
Size:	12288

Details

Name:	0000002E.00000003.21752527548.0000016819537000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819537000
Size:	77824

Details

Name:	00000008.00000003.17617015630.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	0000002A.00000002.19961785382.00007FF579842000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579842000
Size:	4096

Details

Name:	0000002D.00000002.21124515070.00007FF4FCF7E000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCF7E000
Size:	8192

Details

Name:	0000002D.00000002.21122482610.000002779C1B0000.00000004.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	2779C1B0000
Size:	4096

Details

Name:	0000000F.00000002.18020987853.0000000000F90000.00000004.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	F90000
Size:	4096

Details

Name:	00000008.00000003.17809545634.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18134220648.000001CCFD73F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD73F000
Size:	4096

Details

Name:	00000018.00000002.21891057006.00007DF5D4790000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4790000
Size:	12288

Details

Name:	00000008.00000003.18523291342.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	12288

Details

Name:	00000008.00000003.18546031872.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	4096

Details

Name:	0000002A.00000002.19956698676.000002650314A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650314A000
Size:	16384

Details

Name:	00000023.00000003.18401721160.0000015B1AE3C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE3C000
Size:	131072

Details

Name:	00000008.00000003.18523777354.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	49152

Details

Name:	00000008.00000003.18574518294.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761170632.00007FF5A23D1000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A23D1000
Size:	4096

Details

Name:	00000025.00000003.18514821148.00000207277E7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E7000
Size:	12288

Details

Name:	00000019.00000003.18239030984.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	122880

Details

Name:	00000008.00000003.18510934695.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	0000002E.00000002.21763599484.00007FF5A2B54000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B54000
Size:	20480

Details

Name:	00000025.00000003.18520296818.00000207272DA000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272DA000
Size:	4096

Details

Name:	0000002A.00000002.19955165183.0000026502F00000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26502F00000
Size:	118784

Details

Name:	00000019.00000002.21889809654.000001CCF7C82000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C82000
Size:	12288

Details

Name:	0000002E.00000002.21761302603.00007FF5A26F3000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A26F3000
Size:	12288

Details

Name:	00000008.00000002.21900724158.000000001DADE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DADE000
Size:	8192

Details

Name:	00000018.00000002.21887488446.00000205EE1F0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE1F0000
Size:	4096

Details

Name:	00000029.00000003.18641499341.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	32768

Details

Name:	00000019.00000002.21887686184.000001CCF79F0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF79F0000
Size:	118784

Details

Name:	00000029.00000003.19966365538.000001D4525E1000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E1000
Size:	8192

Details

Name:	00000025.00000003.18515373994.0000020727814000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727814000
Size:	36864

Details

Name:	0000002A.00000002.19957246623.00000265032E0000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	265032E0000
Size:	16384

Details

Name:	00000008.00000003.18555735027.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	20480

Details

Name:	00000008.00000003.18549528335.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	28672

Details

Name:	00000008.00000003.17614996182.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002A.00000002.19962105722.00007FF57985C000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57985C000
Size:	4096

Details

Name:	00000008.00000003.17696814339.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19955439587.0000026503030000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26503030000
Size:	4096

Details

Name:	00000019.00000003.18184811509.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	0000002A.00000002.19960554535.00007FF579750000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579750000
Size:	4096

Details

Name:	00000008.00000003.18521357232.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000008.00000003.18587117988.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18198153860.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000008.00000003.17713539242.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18548782818.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000019.00000003.18138425505.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000008.00000003.17691739674.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17642013550.000000001CDD0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CDD0000
Size:	4096

Details

Name:	00000008.00000003.18505588457.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18224924886.000001CCFDE63000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE63000
Size:	4096

Details

Name:	00000022.00000003.18579524207.00000175342EB000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342EB000
Size:	8192

Details

Name:	00000029.00000003.18641844476.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	57344

Details

Name:	00000023.00000000.18220640040.00007DF5B95D2000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B95D2000
Size:	4096

Details

Name:	00000019.00000003.18184757924.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	0000002E.00000002.21762219341.00007FF5A2A7D000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A7D000
Size:	12288

Details

Name:	00000008.00000003.18510871555.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17682892789.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000000.18190990721.00007FF75887E000.00000008.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF75887E000
Size:	4096

Details

Name:	00000029.00000003.18649248177.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	28672

Details

Name:	00000008.00000003.17620867439.00000000207A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207A0000
Size:	40960

Details

Name:	0000002E.00000003.19929137925.000001681952D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952D000
Size:	4096

Details

Name:	00000023.00000003.18321417418.0000015B1B6C0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6C0000
Size:	135168

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000002.21903245323.00007FF5DA775000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA775000
Size:	12288

Details

Name:	0000002A.00000000.18666941846.00007DF590D40000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D40000
Size:	4096

Details

Name:	00000008.00000003.17696477744.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616893100.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000002.21886937216.00000000012A0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	12A0000
Size:	65536

Details

Name:	00000008.00000003.18543572516.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	0000000F.00000002.18021730821.00000000014B0000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	14B0000
Size:	16384

Details

Name:	00000023.00000003.18341772012.0000015B1B514000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B514000
Size:	4096

Details

Name:	00000008.00000003.18555240507.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	49152

Details

Name:	0000002D.00000002.21124302584.00007FF4FCBEB000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCBEB000
Size:	4096

Details

Name:	0000002A.00000002.19962005946.00007FF579856000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579856000
Size:	8192

Details

Name:	00000019.00000002.21899565074.00007FF5D9EF2000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9EF2000
Size:	8192

Details

Name:	0000000F.00000002.18023542156.00000000031C4000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	31C4000
Size:	4096

Details

Name:	0000000F.00000002.18024171330.000000000338F000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	338F000
Size:	4096

Details

Name:	0000000F.00000002.18022621500.00000000017DE000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	17DE000
Size:	8192

Details

Name:	00000008.00000003.18560354324.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	12288

Details

Name:	00000027.00000003.18537042017.0000016EE03A4000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03A4000
Size:	36864

Details

Name:	0000002E.00000003.21751490430.0000016818C1A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C1A000
Size:	61440

Details

Name:	00000029.00000003.18654794853.000001D4525EC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EC000
Size:	65536

Details

Name:	00000019.00000003.18152733697.000001CCFDE23000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE23000
Size:	4096

Details

Name:	00000027.00000003.18540682374.0000016EE0359000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0359000
Size:	20480

Details

Name:	00000019.00000003.18139856849.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	0000000F.00000002.18020686766.0000000000F52000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F52000
Size:	45056

Details

Name:	00000018.00000002.21891599196.00007FF5BC9EB000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC9EB000
Size:	8192

Details

Name:	00000019.00000003.18209647608.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000002.21903846291.000000001E450000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E450000
Size:	61440

Details

Name:	00000019.00000003.18213322808.000001CCFDE31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE31000
Size:	237568

Details

Name:	00000027.00000000.18524587875.00007DF5972B2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972B2000
Size:	4096

Details

Name:	00000019.00000003.18225119009.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	122880

Details

Name:	0000000D.00000002.17942688059.000000007FEE0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEE0000
Size:	4096

Details

Name:	00000008.00000003.18500271691.00000000017A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	17A0000
Size:	12288

Details

Name:	00000023.00000003.18305629133.0000015B1C526000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C526000
Size:	4096

Details

Name:	00000023.00000003.18304077981.0000015B1A3C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A3C2000
Size:	266240

Details

Name:	00000008.00000003.18559243299.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000002.18542426675.00007DF495170000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF495170000
Size:	20480

Details

Name:	00000008.00000003.17712620000.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18349680416.0000015B08178000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08178000
Size:	20480

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000000D.00000000.17935775802.0000000000102000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	102000
Size:	45056

Details

Name:	00000029.00000003.18659496138.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000008.00000003.17688605966.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21760544492.0000016819C8D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C8D000
Size:	32768

Details

Name:	00000008.00000003.17619291273.0000000020774000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20774000
Size:	12288

Details

Name:	0000000D.00000002.17942033090.0000000000F00000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F00000
Size:	4096

Details

Name:	00000019.00000003.18154496134.000001CCF858F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF858F000
Size:	73728

Details

Name:	00000023.00000003.18350602281.0000015B1B6C0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6C0000
Size:	135168

Details

Name:	00000019.00000002.21898122333.000001CCFDBCA000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBCA000
Size:	20480

Details

Name:	00000019.00000003.18152757982.000001CCFDE3F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE3F000
Size:	122880

Details

Name:	00000008.00000003.18502225998.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.18552115833.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18579208561.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18505860817.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17941001074.0000000000700000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	700000
Size:	4096

Details

Name:	00000008.00000002.21912107002.0000000020716000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20716000
Size:	8192

Details

Name:	00000023.00000003.18313952102.0000015B1B3A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B3A0000
Size:	167936

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000029.00000003.19966476050.000001D4525D0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D0000
Size:	36864

Details

Name:	00000008.00000003.18528682817.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000023.00000003.18321594486.0000015B1B02C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B02C000
Size:	266240

Details

Name:	00000022.00000002.18580915546.00007DF5471D0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471D0000
Size:	4096

Details

Name:	00000029.00000003.18621280089.000001D4525D2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D2000
Size:	262144

Details

Name:	00000019.00000003.18144749465.000001CCFDB96000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB96000
Size:	16384

Details

Name:	00000019.00000003.18180599290.000001CCFDE46000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE46000
Size:	237568

Details

Name:	00000008.00000003.18558663274.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17690174080.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000008.00000003.17620614291.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000003.18520591942.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000027.00000003.18538013879.0000016EE0390000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0390000
Size:	16384

Details

Name:	00000008.00000003.18513781908.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000019.00000003.18211548211.000001CCFDA2C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2C000
Size:	40960

Details

Name:	00000027.00000002.18543451658.00007FF57FE27000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE27000
Size:	4096

Details

Name:	00000019.00000002.21890027118.000001CCF7C94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C94000
Size:	32768

Details

Name:	0000002E.00000000.19926277666.00007DF5B9FC2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FC2000
Size:	4096

Details

Name:	00000022.00000002.18581643603.00007FF758841000.00000020.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF758841000
Size:	188416

Details

Name:	00000008.00000003.18556159979.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000008.00000003.18501998911.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000022.00000002.18581413834.00007FF52FD37000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD37000
Size:	4096

Details

Name:	00000008.00000003.17616422648.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	24576

Details

Name:	00000019.00000003.18228263908.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	122880

Details

Name:	00000008.00000003.18552878017.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17620137533.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000029.00000003.18652860745.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	28672

Details

Name:	00000019.00000003.18133427163.000001CCFD77B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD77B000
Size:	4096

Details

Name:	00000008.00000000.17217658222.000000007FA70000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA70000
Size:	4096

Details

Name:	00000008.00000003.18506484417.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18240395191.000001CCFDE4A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE4A000
Size:	94208

Details

Name:	0000000F.00000002.18023662008.00000000031D0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	31D0000
Size:	12288

Details

Name:	00000029.00000003.18646899850.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	57344

Details

Name:	00000019.00000003.18168712479.000001CCFDBCF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBCF000
Size:	49152

Details

Name:	00000023.00000003.18328752917.0000015B1C358000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C358000
Size:	266240

Details

Name:	00000008.00000003.18514539684.000000000177C000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	177C000
Size:	16384

Details

Name:	0000002E.00000003.19929546767.0000016818CBC000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CBC000
Size:	12288

Details

Name:	0000002A.00000002.19956619684.000002650313F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313F000
Size:	8192

Details

Name:	0000002A.00000003.19915317492.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	94208

Details

Name:	0000002E.00000003.21755918619.0000016818D18000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818D18000
Size:	28672

Details

Name:	00000027.00000003.18540736140.0000016EDFE50000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE50000
Size:	4096

Details

Name:	00000008.00000002.21900546404.000000001D8DC000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D8DC000
Size:	16384

Details

Name:	00000027.00000002.18542288465.0000016EDFD30000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16EDFD30000
Size:	4096

Details

Name:	00000019.00000003.18154144084.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000025.00000003.18516501638.0000020727800000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727800000
Size:	16384

Details

Name:	00000018.00000002.21887749097.00000205EE213000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE213000
Size:	81920

Details

Name:	00000008.00000003.18519990487.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000002.21759028024.0000016818D13000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818D13000
Size:	20480

Details

Name:	00000023.00000003.18245056044.0000015B0B6EB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6EB000
Size:	2895872

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000018.00000000.18127491975.00007DF5D4770000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4770000
Size:	4096

Details

Name:	00000008.00000003.18626010687.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19939909886.000001681958D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681958D000
Size:	12288

Details

Name:	00000029.00000003.18664865978.000001D4525CE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525CE000
Size:	163840

Details

Name:	0000002E.00000003.21754385072.0000016819517000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819517000
Size:	4096

Details

Name:	00000008.00000003.18546990326.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	20480

Details

Name:	00000029.00000001.18619469297.00007FF683680000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF683680000
Size:	4096

Details

Name:	00000008.00000003.18550263978.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18337732670.0000015B1BB02000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB02000
Size:	53248

Details

Name:	00000019.00000002.21888180000.000001CCF7A40000.00000004.00000020.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1CCF7A40000
Size:	24576

Details

Name:	0000002A.00000003.18691593946.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	0000002A.00000003.19953778500.0000026503142000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503142000
Size:	4096

Details

Name:	00000008.00000003.17713021636.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18132846948.000001CCFD764000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD764000
Size:	4096

Details

Name:	00000008.00000002.21914274549.0000000020D7D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20D7D000
Size:	12288

Details

Name:	00000008.00000002.21902677358.000000001E29E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E29E000
Size:	8192

Details

Name:	00000008.00000003.18551860137.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17684452913.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000003.17217832617.000000001CDD1000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CDD1000
Size:	49152

Details

Name:	00000008.00000003.18524562850.000000001D230000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D230000
Size:	65536

Details

Name:	00000019.00000003.18138074927.000001CCFDB03000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB03000
Size:	233472

Details

Name:	00000008.00000003.18504163525.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000029.00000003.18637868637.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	147456

Details

Name:	00000019.00000003.18132135146.000001CCFD747000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD747000
Size:	4096

Details

Name:	00000019.00000003.18198688595.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000029.00000003.18660820249.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	28672

Details

Name:	00000008.00000002.21886868569.0000000001290000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1290000
Size:	8192

Details

Name:	00000008.00000003.18524436033.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	0000002A.00000003.19923735018.0000026503116000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503116000
Size:	106496

Details

Name:	00000008.00000003.17688223487.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17620234407.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000003.17683712950.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18647602063.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	53248

Details

Name:	00000008.00000003.18516936109.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000019.00000003.18225292120.000001CCFDAA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAA6000
Size:	53248

Details

Name:	00000008.00000003.18576961554.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18543791340.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000018.00000002.21889041699.00000205EE29B000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE29B000
Size:	94208

Details

Name:	00000008.00000003.17619893062.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000025.00000003.18515164754.00000207277E2000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E2000
Size:	20480

Details

Name:	0000002E.00000003.21755604819.000001681956B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681956B000
Size:	16384

Details

Name:	00000019.00000003.18133745254.000001CCFD78B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD78B000
Size:	4096

Details

Name:	00000019.00000003.18180887980.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	0000000D.00000003.17939168224.0000000002570000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2570000
Size:	8192

Details

Name:	00000023.00000003.18308649452.0000015B1B934000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B934000
Size:	4096

Details

Name:	00000023.00000003.18303132305.0000015B1C02A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C02A000
Size:	200704

Details

Name:	00000023.00000003.18350085117.0000015B1B6E3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6E3000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18519535842.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000002.18521919430.0000020727335000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	20727335000
Size:	8192

Details

Name:	00000019.00000003.18182216860.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.18557650618.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761496153.00007FF5A2839000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2839000
Size:	4096

Details

Name:	0000000D.00000002.17940563488.00000000003B1000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3B1000
Size:	8192

Details

Name:	00000022.00000000.18190463518.00007DF5471C2000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471C2000
Size:	4096

Details

Name:	00000008.00000003.18553206393.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21901166597.00007FF5DA69D000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA69D000
Size:	8192

Details

Name:	00000008.00000003.17689804307.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000008.00000003.18552164543.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19928858977.0000016819576000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819576000
Size:	4096

Details

Name:	00000019.00000003.18197234254.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000019.00000003.18138958026.000001CCFDB02000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB02000
Size:	4096

Details

Name:	00000008.00000003.18523700676.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17633025455.0000000000416000.00000004.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	416000
Size:	8192

Details

Name:	00000023.00000003.18261808907.0000015B0C6AD000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C6AD000
Size:	8192

Details

Name:	00000008.00000003.17612495066.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.17615550266.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000008.00000002.21903792602.000000001E44E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E44E000
Size:	8192

Details

Name:	00000008.00000003.17716123840.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18636906420.000001D4525D7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D7000
Size:	262144

Details

Name:	00000008.00000003.17688918571.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18139255397.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000008.00000003.17615077529.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000002.21901468500.000000001E1F0000.00000004.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1E1F0000
Size:	4096

Details

Name:	00000022.00000002.18580386707.00000175342A0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	175342A0000
Size:	4096

Details

Name:	00000008.00000003.17612394578.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000019.00000002.21898415013.000001CCFDBFF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBFF000
Size:	4096

Details

Name:	00000029.00000003.18650659447.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	40960

Details

Name:	00000029.00000003.18657572958.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	0000002E.00000002.21759373151.00000168192A0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	168192A0000
Size:	4096

Details

Name:	0000002E.00000003.19928899861.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	4096

Details

Name:	00000008.00000003.18574853869.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21891994246.00007FF5BCE30000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCE30000
Size:	8192

Details

Name:	00000008.00000002.21900285020.000000001D3AE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D3AE000
Size:	8192

Details

Name:	0000000D.00000002.17940819810.0000000000620000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	620000
Size:	16384

Details

Name:	00000008.00000002.21902543065.000000001E257000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E257000
Size:	4096

Details

Name:	0000002D.00000002.21123222860.000002779C402000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C402000
Size:	53248

Details

Name:	00000008.00000003.18533416858.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.17694083310.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000023.00000003.18244998708.0000015B0B6E6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6E6000
Size:	4096

Details

Name:	0000002A.00000003.18685712768.00000265030F2000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F2000
Size:	49152

Details

Name:	0000002A.00000003.18676744722.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	225280

Details

Name:	00000019.00000003.18228525046.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	45056

Details

Name:	00000008.00000003.17686724519.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18515436401.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18552065840.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18346104641.0000015B1AB47000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB47000
Size:	16384

Details

Name:	00000008.00000003.17713410676.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18245736267.000001CCFDE2E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE2E000
Size:	45056

Details

Name:	00000018.00000002.21892458882.00007FF5BD154000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD154000
Size:	4096

Details

Name:	00000029.00000003.18651592556.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	20480

Details

Name:	0000000D.00000003.17939073549.00000000025B0000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	25B0000
Size:	24576

Details

Name:	00000019.00000003.18211695540.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000027.00000003.18540405685.0000016EDFE5E000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE5E000
Size:	4096

Details

Name:	00000008.00000003.18547653365.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	65536

Details

Name:	00000019.00000002.21891005044.000001CCF7E00000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7E00000
Size:	8192

Details

Name:	0000002E.00000002.21763372875.00007FF5A2B24000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B24000
Size:	8192

Details

Name:	00000029.00000002.19966838912.000001D452440000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452440000
Size:	4096

Details

Name:	00000019.00000003.18212495099.000001CCF859D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF859D000
Size:	16384

Details

Name:	0000000F.00000002.18024513634.000000007F900000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F900000
Size:	4096

Details

Name:	00000019.00000003.18211260542.000001CCFDE52000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE52000
Size:	237568

Details

Name:	00000008.00000003.18578771581.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18508902326.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18133097433.000001CCFD76C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD76C000
Size:	4096

Details

Name:	0000002D.00000002.21124112712.00007DF5144B2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144B2000
Size:	4096

Details

Name:	0000002E.00000002.21763274564.00007FF5A2AFA000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AFA000
Size:	12288

Details

Name:	00000029.00000003.19966014074.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	28672

Details

Name:	00000008.00000003.18527333226.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.17712080590.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757374178.0000016818C2A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C2A000
Size:	86016

Details

Name:	0000002A.00000002.19960640604.00007FF5797B0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797B0000
Size:	8192

Details

Name:	00000008.00000003.18577013501.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616527516.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000019.00000003.18131624832.000001CCFD732000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD732000
Size:	4096

Details

Name:	00000008.00000003.17691193869.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17617665029.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	53248

Details

Name:	00000027.00000003.18540305031.0000016EDFE53000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE53000
Size:	8192

Details

Name:	00000025.00000002.18520804844.000000BFF39FE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BFF39FE000
Size:	8192

Details

Name:	0000002A.00000002.19958517079.0000026503D79000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503D79000
Size:	20480

Details

Name:	0000002A.00000002.19958051539.0000026503D38000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503D38000
Size:	4096

Details

Name:	00000008.00000003.18574797327.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17694354188.00000000012D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12D0000
Size:	12288

Details

Name:	00000019.00000002.21897552168.000001CCFDB75000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB75000
Size:	8192

Details

Name:	00000019.00000003.18132328606.000001CCFD74F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD74F000
Size:	8192

Details

Name:	00000019.00000002.21895468337.000001CCFD660000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD660000
Size:	4096

Details

Name:	00000019.00000002.21889956547.000001CCF7C8E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C8E000
Size:	12288

Details

Name:	00000008.00000003.18506697996.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000003.19706101740.00000205EE2BA000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE2BA000
Size:	32768

Details

Name:	00000029.00000003.18629720769.000001D4525D4000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D4000
Size:	81920

Details

Name:	0000002A.00000002.19957949251.0000026503C50000.00000004.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	26503C50000
Size:	8192

Details

Name:	0000002A.00000000.18667004815.00007DF590D42000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D42000
Size:	4096

Details

Name:	00000023.00000003.18277000736.0000015B08169000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08169000
Size:	73728

Details

Name:	00000008.00000003.17686166814.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21900856721.000000001DC20000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DC20000
Size:	4096

Details

Name:	0000002E.00000003.19940590614.0000016819CA2000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819CA2000
Size:	40960

Details

Name:	00000008.00000003.18528287272.000000001D241000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D241000
Size:	61440

Details

Name:	00000019.00000003.18154215524.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000029.00000003.18645803919.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	53248

Details

Name:	00000029.00000000.18610398808.00007FF683681000.00000020.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF683681000
Size:	188416

Details

Name:	00000008.00000003.18510556760.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000022.00000000.18190489094.00007DF5471D0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471D0000
Size:	4096

Details

Name:	00000023.00000003.18338076360.0000015B1B388000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B388000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18427515211.0000015B1A446000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A446000
Size:	8192

Details

Name:	00000008.00000003.18626910440.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	57344

Details

Name:	00000008.00000002.21891236435.0000000001780000.00000004.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1780000
Size:	4096

Details

Name:	00000019.00000002.21899682173.00007FF5DA011000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA011000
Size:	8192

Details

Name:	00000008.00000003.17685016026.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18131562294.000001CCFD72F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD72F000
Size:	8192

Details

Name:	00000023.00000003.18334155763.0000015B1A588000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A588000
Size:	4096

Details

Name:	00000029.00000000.18610123955.00007DF5780D2000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780D2000
Size:	4096

Details

Name:	0000002A.00000003.18677232436.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	258048

Details

Name:	00000019.00000003.18166372840.000001CCFDB8B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB8B000
Size:	20480

Details

Name:	00000008.00000003.17615297366.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18524086744.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	20480

Details

Name:	00000008.00000003.17697432258.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000023.00000003.18313831133.0000015B1B388000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B388000
Size:	86016

Details

Name:	00000008.00000003.17691983039.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21890521942.00000205EE930000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE930000
Size:	8192

Details

Name:	0000000D.00000002.17941524298.000000000090E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	90E000
Size:	8192

Details

Name:	00000008.00000003.18625373339.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	65536

Details

Name:	00000019.00000003.18239295655.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	45056

Details

Name:	0000002A.00000003.18697617213.0000026503114000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503114000
Size:	69632

Details

Name:	0000002A.00000002.19959274841.00007DF590D50000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D50000
Size:	12288

Details

Name:	00000008.00000003.18558409699.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000000.18505241975.00007DF570730000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570730000
Size:	4096

Details

Name:	00000001.00000002.17642156973.000000007FFB0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB0000
Size:	4096

Details

Name:	00000008.00000003.18561733147.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18691177816.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000029.00000003.18632670759.000001D4525D6000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D6000
Size:	262144

Details

Name:	00000008.00000003.18577735998.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17693265417.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18520047602.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	0000000D.00000002.17942094852.00000000023A0000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	23A0000
Size:	4096

Details

Name:	00000008.00000003.18520957611.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18511447297.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000022.00000002.18581600974.00007FF758840000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF758840000
Size:	4096

Details

Name:	00000019.00000003.18169096396.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000003.18521609257.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.20226898814.0000016818C9C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C9C000
Size:	16384

Details

Name:	00000022.00000000.18202860347.00007FF759281000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF759281000
Size:	5541888

Details

Name:	00000008.00000003.17615941635.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18543743227.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	0000000F.00000002.18023887112.0000000003210000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3210000
Size:	4096

Details

Name:	0000002E.00000003.19928526187.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	4096

Details

Name:	00000001.00000002.17632133105.0000000000040000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	40000
Size:	118784

Details

Name:	00000023.00000003.18301198138.0000015B1B976000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B976000
Size:	12288

Details

Name:	0000002A.00000002.19955965474.00000265030CF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265030CF000
Size:	237568

Details

Name:	00000008.00000003.17620588813.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000019.00000002.21901787286.00007FF5DA6EF000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6EF000
Size:	4096

Details

Name:	00000008.00000003.18516841401.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000022.00000003.18219384491.00000175342DC000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342DC000
Size:	69632

Details

Name:	00000008.00000000.17218519563.000000007FA90000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA90000
Size:	12288

Details

Name:	00000025.00000003.18516545970.0000020727805000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727805000
Size:	61440

Details

Name:	00000001.00000002.17633838932.00000000008EF000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	8EF000
Size:	4096

Details

Name:	00000008.00000003.17694015898.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000019.00000003.18441412099.000001CCF852E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF852E000
Size:	20480

Details

Name:	0000002E.00000002.21757958139.0000016818C83000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C83000
Size:	24576

Details

Name:	00000019.00000002.21887570602.000001CCF79D0000.00000004.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1CCF79D0000
Size:	4096

Details

Name:	0000002A.00000003.18688189808.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	262144

Details

Name:	00000029.00000003.18642408087.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	77824

Details

Name:	00000008.00000003.18559435836.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18513158898.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000023.00000003.18296632340.0000015B1C28F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C28F000
Size:	8192

Details

Name:	0000000F.00000002.18020930190.0000000000F80000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F80000
Size:	4096

Details

Name:	00000008.00000003.18515712281.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17717736891.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761723124.00007FF5A2972000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2972000
Size:	20480

Details

Name:	0000002A.00000003.18678695574.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	163840

Details

Name:	00000008.00000003.17617757928.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17713157226.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18196487781.000001CCFDE4E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE4E000
Size:	237568

Details

Name:	00000008.00000003.18561269595.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000002.18522187340.00007DF570750000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570750000
Size:	12288

Details

Name:	00000008.00000003.18547135049.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	36864

Details

Name:	00000019.00000003.18172902477.000001CCFDE44000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE44000
Size:	102400

Details

Name:	00000008.00000003.18522058452.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000008.00000003.18576097651.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000003.17938993767.00000000025B0000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	25B0000
Size:	12288

Details

Name:	00000019.00000002.21896760847.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000019.00000002.21898946475.00007DF5F1C10000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C10000
Size:	12288

Details

Name:	00000008.00000002.21910718172.000000001F4CB000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1F4CB000
Size:	102400

Details

Name:	0000002D.00000000.19910386117.00007DF5144D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144D0000
Size:	12288

Details

Name:	00000008.00000003.18501706132.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000019.00000003.18133579662.000001CCFD783000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD783000
Size:	4096

Details

Name:	00000008.00000003.18531303078.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	0000002E.00000002.21761584521.00007FF5A2968000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2968000
Size:	4096

Details

Name:	00000008.00000002.21912047638.0000000020710000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20710000
Size:	20480

Details

Name:	00000019.00000002.21888541175.000001CCF7BB0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7BB0000
Size:	4096

Details

Name:	00000008.00000002.21900353820.000000001D7EE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D7EE000
Size:	8192

Details

Name:	00000019.00000002.21889413394.000001CCF7C5F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C5F000
Size:	4096

Details

Name:	00000008.00000003.18518160703.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	57344

Details

Name:	00000019.00000003.18211721008.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000008.00000003.17620795488.0000000020790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20790000
Size:	24576

Details

Name:	00000008.00000002.21904391214.000000001E4BE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E4BE000
Size:	12288

Details

Name:	00000008.00000003.17610898312.0000000001619000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1619000
Size:	12288

Details

Name:	0000002A.00000002.19957396119.00000265032F0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	265032F0000
Size:	8192

Details

Name:	00000019.00000003.18224448649.000001CCFDE64000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE64000
Size:	233472

Details

Name:	00000008.00000003.17717599796.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17695245521.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21894678348.00007FF5BD31E000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD31E000
Size:	16384

Details

Name:	00000008.00000003.18500150033.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	0000002E.00000002.21760719361.00007DF4B7E70000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4B7E70000
Size:	20480

Details

Name:	00000008.00000003.18514084293.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000008.00000003.18550469895.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18623689502.000001D4525D2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D2000
Size:	262144

Details

Name:	00000027.00000002.18543544448.00007FF57FE54000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE54000
Size:	20480

Details

Name:	00000023.00000003.18417933372.0000015B1B2A1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2A1000
Size:	65536

Details

Name:	00000008.00000003.17809617087.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18647755807.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	24576

Details

Name:	0000002E.00000003.21752799908.0000016819548000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819548000
Size:	8192

Details

Name:	00000019.00000002.21897376875.000001CCFDB55000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB55000
Size:	118784

Details

Name:	00000008.00000003.17617307252.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	24576

Details

Name:	00000019.00000003.18181159192.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000018.00000002.21892322587.00007FF5BD10A000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD10A000
Size:	4096

Details

Name:	00000008.00000003.18505528057.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18198938213.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000003.18549132139.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	12288

Details

Name:	00000008.00000003.18550843572.00000000205E8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205E8000
Size:	159744

Details

Name:	00000008.00000003.18519667429.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18410445616.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	40960

Details

Name:	0000002E.00000003.21754426221.0000016819521000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819521000
Size:	28672

Details

Name:	00000029.00000003.18656835547.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000023.00000003.18319262818.0000015B1A5C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A5C2000
Size:	12288

Details

Name:	00000019.00000003.18165383659.000001CCF8599000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8599000
Size:	32768

Details

Name:	00000019.00000003.18239641937.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	28672

Details

Name:	00000019.00000002.21903089495.00007FF5DA764000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA764000
Size:	8192

Details

Name:	00000008.00000002.21902186208.000000001E242000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E242000
Size:	4096

Details

Name:	00000019.00000003.18169197281.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	0000002E.00000002.21762703446.00007FF5A2ABE000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ABE000
Size:	12288

Details

Name:	00000023.00000003.18339327099.0000015B1C0AE000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0AE000
Size:	4096

Details

Name:	0000002E.00000003.21754180674.000001681951D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951D000
Size:	45056

Details

Name:	00000008.00000003.18552574545.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18523346879.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	32768

Details

Name:	00000008.00000003.17694148416.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000019.00000003.18137252559.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	36864

Details

Name:	0000000F.00000002.18023420717.00000000031B0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	31B0000
Size:	4096

Details

Name:	00000019.00000003.18181966122.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.18520271442.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000008.00000003.17715100796.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17697069031.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761123656.00007FF5A22B2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A22B2000
Size:	8192

Details

Name:	0000000D.00000002.17942439639.0000000002580000.00000040.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	2580000
Size:	4096

Details

Name:	00000027.00000003.18540075008.0000016EE0366000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0366000
Size:	8192

Details

Name:	00000029.00000002.19968501981.00007FF560C76000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C76000
Size:	12288

Details

Name:	00000008.00000003.18553008635.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18514772911.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000027.00000002.18542385469.0000016EDFEC5000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFEC5000
Size:	8192

Details

Name:	00000029.00000003.18646380927.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	32768

Details

Name:	00000008.00000003.18548089542.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000002.19967803157.00007DF5780D0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780D0000
Size:	4096

Details

Name:	00000008.00000003.17613468939.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	12288

Details

Name:	00000029.00000002.19967841474.00007DF5780D2000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780D2000
Size:	4096

Details

Name:	00000008.00000003.18557705073.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18502384214.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	65536

Details

Name:	00000022.00000002.18580422438.00000175342C0000.00000004.00000020.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	175342C0000
Size:	40960

Details

Name:	0000000D.00000002.17942582275.000000000476E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	476E000
Size:	8192

Details

Name:	00000008.00000003.18526573558.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000008.00000003.17695532048.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21760912631.00007DF5B9FC2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FC2000
Size:	4096

Details

Name:	00000022.00000000.18190673296.00007FF758841000.00000020.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF758841000
Size:	188416

Details

Name:	0000002E.00000002.21758488752.0000016818CCD000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CCD000
Size:	24576

Details

Name:	00000019.00000002.21902509732.00007FF5DA71C000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA71C000
Size:	4096

Details

Name:	00000022.00000002.18580788721.00007DF445080000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF445080000
Size:	20480

Details

Name:	0000002E.00000003.21752703132.000001681954F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681954F000
Size:	20480

Details

Name:	00000008.00000003.18542036657.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	65536

Details

Name:	00000019.00000003.18184401686.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.18560844434.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18169372455.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	0000002E.00000002.21758286786.0000016818CB2000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB2000
Size:	4096

Details

Name:	00000025.00000003.18519613852.00000207277E6000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E6000
Size:	4096

Details

Name:	00000008.00000002.21901603542.000000001E210000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E210000
Size:	8192

Details

Name:	00000019.00000003.18155134620.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	0000002A.00000002.19957194222.00000265031F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265031F0000
Size:	12288

Details

Name:	00000008.00000002.21900652248.000000001D9DE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D9DE000
Size:	8192

Details

Name:	00000029.00000003.18647872313.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	32768

Details

Name:	0000002E.00000003.19929797084.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	4096

Details

Name:	0000002A.00000002.19957088278.000002650317B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650317B000
Size:	16384

Details

Name:	00000029.00000003.18655563464.000001D4525EC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EC000
Size:	32768

Details

Name:	00000019.00000002.21893478035.000001CCF85A5000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A5000
Size:	16384

Details

Name:	00000029.00000003.18641058764.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	28672

Details

Name:	00000023.00000003.18298458791.0000015B1AD5A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD5A000
Size:	249856

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000027.00000002.18543362785.00007FF57FE01000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE01000
Size:	4096

Details

Name:	0000002A.00000003.19942561734.0000026503155000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503155000
Size:	53248

Details

Name:	00000008.00000003.18530973273.000000001D256000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D256000
Size:	40960

Details

Name:	00000008.00000003.18502991175.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000022.00000003.18219110476.00000175342F1000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F1000
Size:	225280

Details

Name:	0000002E.00000002.21757653252.0000016818C5A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C5A000
Size:	16384

Details

Name:	00000019.00000002.21902263168.00007FF5DA70B000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA70B000
Size:	20480

Details

Name:	00000023.00000003.18301523831.0000015B1B9B8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9B8000
Size:	4096

Details

Name:	00000019.00000002.21895195535.000001CCF9150000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9150000
Size:	65536

Details

Name:	00000008.00000003.18514437797.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	45056

Details

Name:	00000008.00000003.18553472103.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21124856129.00007FF4FCFE2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFE2000
Size:	40960

Details

Name:	0000002A.00000002.19963994243.00007FF650D99000.00000004.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF650D99000
Size:	12288

Details

Name:	00000008.00000003.17620989672.0000000020796000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20796000
Size:	40960

Details

Name:	00000019.00000003.18153767140.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	0000002A.00000003.19952432388.0000026503139000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503139000
Size:	8192

Details

Name:	00000025.00000000.18505497804.00007DF570742000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570742000
Size:	4096

Details

Name:	00000019.00000003.18167408559.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	4096

Details

Name:	0000002A.00000003.18689179884.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	61440

Details

Name:	0000002E.00000003.21755024651.0000016819502000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819502000
Size:	4096

Details

Name:	0000000D.00000002.17940398804.00000000001AC000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1AC000
Size:	16384

Details

Name:	0000002E.00000003.19928247129.000001681950E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950E000
Size:	16384

Details

Name:	0000002E.00000002.21761884200.00007FF5A2A37000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A37000
Size:	4096

Details

Name:	00000008.00000003.17693817034.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000008.00000002.21912365862.000000002072E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2072E000
Size:	4096

Details

Name:	00000001.00000002.17632737570.000000000027D000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	27D000
Size:	4096

Details

Name:	00000027.00000002.18541611735.0000016EDFA40000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFA40000
Size:	12288

Details

Name:	00000008.00000003.17697193218.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18526713791.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000023.00000003.18342143663.0000015B1C316000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C316000
Size:	4096

Details

Name:	00000025.00000003.18520206039.00000207272D4000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D4000
Size:	4096

Details

Name:	0000002D.00000002.21124608443.00007FF4FCFBA000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFBA000
Size:	12288

Details

Name:	00000008.00000002.21912466653.0000000020736000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20736000
Size:	16384

Details

Name:	00000019.00000003.18131026549.000001CCFD850000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD850000
Size:	8192

Details

Name:	00000019.00000002.21898774647.00007DF5F1BF0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1BF0000
Size:	4096

Details

Name:	00000008.00000003.18514993799.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000029.00000002.19968612814.00007FF683680000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF683680000
Size:	4096

Details

Name:	00000008.00000003.18517164341.000000001D1B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1B0000
Size:	53248

Details

Name:	0000002E.00000002.21763417205.00007FF5A2B27000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B27000
Size:	4096

Details

Name:	0000002E.00000003.21752434676.0000016819556000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819556000
Size:	8192

Details

Name:	00000023.00000003.18309335590.0000015B1AFA8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFA8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18348634221.0000015B1B1B8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B1B8000
Size:	4096

Details

Name:	00000008.00000003.18530143402.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000029.00000003.18643190596.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	28672

Details

Name:	00000008.00000003.18573220021.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	12288

Details

Name:	00000019.00000002.21898712067.00007DF4EFAB0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4EFAB0000
Size:	20480

Details

Name:	00000008.00000003.17716293130.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000023.00000003.18324847671.0000015B1B0F2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B0F2000
Size:	4096

Details

Name:	00000008.00000003.17717047426.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000019.00000002.21903139690.00007FF5DA767000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA767000
Size:	4096

Details

Name:	00000008.00000003.18533355603.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000029.00000003.18651033351.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	32768

Details

Name:	00000008.00000003.18549876511.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18573689378.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18184299573.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.18553406415.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21763218951.00007FF5A2AF4000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AF4000
Size:	20480

Details

Name:	00000008.00000003.18575062669.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17940442470.00000000001B0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1B0000
Size:	16384

Details

Name:	00000008.00000003.17620361600.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000025.00000002.18520694490.000000BFF38FF000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BFF38FF000
Size:	4096

Details

Name:	0000002E.00000002.21758807597.0000016818CFA000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CFA000
Size:	28672

Details

Name:	00000029.00000003.18640458073.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	28672

Details

Name:	00000019.00000003.18184569310.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000001.00000002.17633258483.0000000000450000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	450000
Size:	32768

Details

Name:	00000008.00000003.17712247865.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000019.00000002.21895557848.000001CCFD6D0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD6D0000
Size:	4096

Details

Name:	00000029.00000003.18642641332.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	61440

Details

Name:	00000008.00000003.18627262589.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	65536

Details

Name:	00000018.00000002.21893260622.00007FF5BD27A000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD27A000
Size:	12288

Details

Name:	00000019.00000003.18165261683.000001CCF85B7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B7000
Size:	45056

Details

Name:	00000023.00000003.18344996372.0000015B1B0B0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B0B0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000002.21903601432.00007FF5DA79E000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA79E000
Size:	16384

Details

Name:	00000008.00000003.17695377949.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18532894087.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000023.00000003.18277106007.0000015B08159000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08159000
Size:	65536

Details

Name:	00000008.00000003.18544781786.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	12288

Details

Name:	00000008.00000003.17684956319.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18335733371.0000015B1B82C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B82C000
Size:	167936

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18546448240.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	8192

Details

Name:	00000008.00000003.18554176350.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18152614242.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	0000002D.00000002.21123671153.000002779C500000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C500000
Size:	4096

Details

Name:	00000008.00000003.18505695647.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000001.18017025958.0000000000F50000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	F50000
Size:	4096

Details

Name:	00000029.00000003.18649129015.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	32768

Details

Name:	0000002A.00000003.18688736340.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	126976

Details

Name:	00000008.00000003.18527923150.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000019.00000002.21897180901.000001CCFDB33000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB33000
Size:	135168

Details

Name:	0000002A.00000002.19959524365.00007FF578F9D000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578F9D000
Size:	4096

Details

Name:	00000008.00000003.18561565745.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21755563644.0000016819553000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819553000
Size:	4096

Details

Name:	00000019.00000002.21888264752.000001CCF7B40000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7B40000
Size:	4096

Details

Name:	00000008.00000003.18523890460.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	24576

Details

Name:	0000002A.00000002.19959332448.00007FF56A195000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF56A195000
Size:	4096

Details

Name:	00000001.00000002.17633706793.0000000000630000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	630000
Size:	4096

Details

Name:	00000029.00000003.18653769961.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	32768

Details

Name:	00000029.00000002.19967570740.000001D4525EE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EE000
Size:	8192

Details

Name:	00000008.00000003.18575996540.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17692316455.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21901311004.00007FF5DA6BD000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6BD000
Size:	12288

Details

Name:	00000029.00000003.18644686820.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	28672

Details

Name:	0000002A.00000002.19960762576.00007FF5797BF000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797BF000
Size:	32768

Details

Name:	00000029.00000003.18619950657.000001D4527B0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4527B0000
Size:	188416

Details

Name:	00000019.00000003.18213719924.000001CCFDE29000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE29000
Size:	32768

Details

Name:	00000019.00000002.21894212830.000001CCF85E5000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85E5000
Size:	28672

Details

Name:	00000008.00000003.17620206668.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000025.00000002.18523118276.00007FF5592D4000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592D4000
Size:	20480

Details

Name:	00000008.00000003.18533749217.000000001D256000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D256000
Size:	40960

Details

Name:	00000029.00000000.18610304425.00007FF560C7E000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C7E000
Size:	16384

Details

Name:	00000001.00000002.17632089120.0000000000030000.00000004.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	30000
Size:	4096

Details

Name:	00000008.00000003.17692396590.00000000012A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12A0000
Size:	20480

Details

Name:	00000029.00000002.19967050848.000001D452470000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452470000
Size:	12288

Details

Name:	00000008.00000003.17697481826.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18222096397.0000015B080E0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B080E0000
Size:	65536

Details

Name:	0000002A.00000003.18697779745.0000026503126000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503126000
Size:	69632

Details

Name:	00000025.00000002.18522334870.00007FF5590FD000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5590FD000
Size:	8192

Details

Name:	00000019.00000002.21900886599.00007FF5DA5B2000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA5B2000
Size:	20480

Details

Name:	00000019.00000003.18212664544.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.17695412487.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17619653743.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	12288

Details

Name:	00000029.00000003.18644211414.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	69632

Details

Name:	0000002E.00000003.19928305993.0000016818C7E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C7E000
Size:	4096

Details

Name:	00000019.00000002.21898902627.00007DF5F1C02000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C02000
Size:	4096

Details

Name:	00000019.00000002.21891717929.000001CCF8400000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8400000
Size:	4096

Details

Name:	00000019.00000003.18210787518.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000019.00000003.18156370808.000001CCFDBF0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF0000
Size:	4096

Details

Name:	00000025.00000003.18519799891.00000207272D7000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D7000
Size:	8192

Details

Name:	0000002A.00000002.19961077195.00007FF5797FD000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797FD000
Size:	12288

Details

Name:	00000019.00000003.18167348431.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	00000023.00000003.18300879046.0000015B1A6C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A6C2000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17713992333.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18295479821.0000015B1B02C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B02C000
Size:	266240

Details

Name:	0000000F.00000002.18023602362.00000000031CD000.00000040.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	31CD000
Size:	4096

Details

Name:	00000025.00000003.18519355386.00000207277D5000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D5000
Size:	12288

Details

Name:	0000002A.00000003.18668906078.0000026503040000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503040000
Size:	192512

Details

Name:	00000019.00000002.21886934417.000000527117F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	527117F000
Size:	4096

Details

Name:	00000023.00000003.18402532326.0000015B1B2A1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2A1000
Size:	65536

Details

Name:	0000002E.00000003.21754604349.0000016819523000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819523000
Size:	20480

Details

Name:	0000002E.00000002.21759136691.0000016818EE0000.00000004.00000040.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	16818EE0000
Size:	4096

Details

Name:	00000022.00000002.18581976039.00007FF75887E000.00000004.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF75887E000
Size:	12288

Details

Name:	00000008.00000003.17685380330.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18292748067.0000015B1BAC0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BAC0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Contains functionality to query the security center for anti-virus and firewall products	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000029.00000003.18650840124.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	53248

Details

Name:	00000019.00000003.18139021483.000001CCFDB1E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB1E000
Size:	122880

Details

Name:	00000008.00000003.18501313830.000000001D1B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1B0000
Size:	65536

Details

Name:	0000002E.00000003.21752334901.000001681954A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681954A000
Size:	57344

Details

Name:	00000008.00000002.21914864518.000000007F8B0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	7F8B0000
Size:	4096

Details

Name:	0000002E.00000003.19928623442.000001681952B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952B000
Size:	4096

Details

Name:	00000019.00000003.18153217902.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000019.00000003.18154714675.000001CCF85B7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B7000
Size:	45056

Details

Name:	00000008.00000003.18504657955.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18625920602.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	53248

Details

Name:	0000002A.00000002.19957443021.00000265034F0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	265034F0000
Size:	16384

Details

Name:	00000001.00000000.16839912870.0000000000418000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	418000
Size:	40960

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary

Details

Name:	00000025.00000002.18522474691.00007FF55923E000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF55923E000
Size:	12288

Details

Name:	00000001.00000002.17634502053.0000000002240000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2240000
Size:	8192

Details

Name:	0000000D.00000002.17940159398.0000000000130000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	130000
Size:	4096

Details

Name:	00000008.00000003.18555478415.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	53248

Details

Name:	00000023.00000003.18261740844.0000015B0C6A7000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C6A7000
Size:	8192

Details

Name:	00000008.00000003.18530004514.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	20480

Details

Name:	0000002A.00000003.19923483822.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	94208

Details

Name:	0000002A.00000003.18693553109.00000265030F7000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F7000
Size:	110592

Details

Name:	00000008.00000003.17687400568.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18531127243.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000008.00000003.18545837606.000000001D2C5000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C5000
Size:	45056

Details

Name:	0000000D.00000002.17940533352.00000000001F0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1F0000
Size:	4096

Details

Name:	00000018.00000002.21887534185.00000205EE200000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE200000
Size:	73728

Details

Name:	00000019.00000002.21893665229.000001CCF85B7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B7000
Size:	45056

Details

Name:	0000000D.00000002.17941292200.000000000073C000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	73C000
Size:	12288

Details

Name:	00000023.00000003.18349004213.0000015B1A9DB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A9DB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18643758406.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	32768

Details

Name:	00000023.00000003.18244816472.0000015B0B6B6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6B6000
Size:	8192

Details

Name:	00000019.00000003.18238684035.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	28672

Details

Name:	00000008.00000003.18509932319.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17614560450.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000022.00000002.18595440685.00007FF759281000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF759281000
Size:	5541888

Details

Name:	0000000F.00000002.18024544527.000000007F902000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F902000
Size:	4096

Details

Name:	00000029.00000002.19968265067.00007FF560BFF000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560BFF000
Size:	8192

Details

Name:	00000029.00000003.18647182963.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	32768

Details

Name:	00000008.00000003.17689420254.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000008.00000003.18508573711.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18199770449.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000023.00000003.18332083979.0000015B1A87C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A87C000
Size:	65536

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000029.00000003.18643080468.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	28672

Details

Name:	0000002A.00000002.19955921960.00000265030C4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265030C4000
Size:	8192

Details

Name:	00000019.00000003.18181295440.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000019.00000003.18227661052.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	57344

Details

Name:	00000019.00000003.18210912132.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000008.00000003.18532079911.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000027.00000002.18541205009.0000002CB77EE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB77EE000
Size:	8192

Details

Name:	00000008.00000003.18527828148.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000019.00000003.18165633371.000001CCF8599000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8599000
Size:	32768

Details

Name:	00000008.00000003.18506049285.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959141788.00007DF590D32000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D32000
Size:	4096

Details

Name:	00000019.00000003.18182292650.000001CCFDE03000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE03000
Size:	126976

Details

Name:	00000008.00000003.18509843536.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18577631844.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18327508493.0000015B1B6A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6A0000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18350386619.0000015B1B724000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B724000
Size:	4096

Details

Name:	00000008.00000003.18501024684.000000001D1D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1D0000
Size:	49152

Details

Name:	00000008.00000003.18554529879.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	24576

Details

Name:	00000019.00000003.18196279099.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000025.00000003.18519477250.00000207277D2000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D2000
Size:	8192

Details

Name:	00000023.00000003.18336377296.0000015B1BE9E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE9E000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18577427053.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18166714655.000001CCF858C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF858C000
Size:	32768

Details

Name:	0000000F.00000002.18024584088.000000007F910000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F910000
Size:	4096

Details

Name:	00000008.00000003.17694555757.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	65536

Details

Name:	00000019.00000003.18167230261.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	0000002A.00000002.19960468089.00007FF579713000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579713000
Size:	8192

Details

Name:	00000008.00000003.18532409349.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	4096

Details

Name:	00000008.00000003.18573039407.000000001D2C1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C1000
Size:	57344

Details

Name:	0000002E.00000003.19927069344.000001681955B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681955B000
Size:	12288

Details

Name:	00000029.00000003.18657325169.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	61440

Details

Name:	0000002E.00000002.21758173212.0000016818CA7000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CA7000
Size:	20480

Details

Name:	00000019.00000002.21886710226.0000005270EFE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5270EFE000
Size:	8192

Details

Name:	00000023.00000003.18267584209.0000015B08156000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08156000
Size:	262144

Details

Name:	0000002E.00000003.21752884737.000001681953A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953A000
Size:	57344

Details

Name:	00000008.00000003.17690026071.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	20480

Details

Name:	0000000F.00000002.18021693435.00000000014A0000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	14A0000
Size:	4096

Details

Name:	00000023.00000003.18430430309.0000015B1C0EF000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0EF000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000002A.00000002.19958916659.00007DF48EBF0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF48EBF0000
Size:	20480

Details

Name:	00000008.00000003.18531573572.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	4096

Details

Name:	00000008.00000003.17714957174.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19962707522.00007FF5798CB000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798CB000
Size:	4096

Details

Name:	0000002E.00000002.21760955428.00007DF5B9FD0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FD0000
Size:	12288

Details

Name:	00000008.00000003.17682721647.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18521229592.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000019.00000003.18168908621.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000018.00000002.21890456569.00000205EE900000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE900000
Size:	4096

Details

Name:	0000002E.00000003.19927974269.0000016819570000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819570000
Size:	4096

Details

Name:	0000002D.00000003.19921394402.000002779C461000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C461000
Size:	12288

Details

Name:	0000000F.00000002.18021980690.00000000015E0000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15E0000
Size:	24576

Details

Name:	00000019.00000003.18133617661.000001CCFD785000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD785000
Size:	4096

Details

Name:	0000002E.00000003.21755062309.0000016819514000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819514000
Size:	4096

Details

Name:	00000008.00000003.17684713348.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18561388015.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19951739433.00000265037DB000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	265037DB000
Size:	16384

Details

Name:	00000019.00000002.21893175439.000001CCF858B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF858B000
Size:	90112

Details

Name:	00000008.00000003.18507869168.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000018.00000002.21889842381.00000205EE430000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE430000
Size:	8192

Details

Name:	00000008.00000003.18575272199.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18339984701.0000015B1AB46000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB46000
Size:	20480

Details

Name:	00000008.00000003.18625157984.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	65536

Details

Name:	00000023.00000003.18333509130.0000015B1AC90000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC90000
Size:	4096

Details

Name:	00000019.00000003.18226464192.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	122880

Details

Name:	00000008.00000003.17685260603.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18508739220.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.18527746544.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	0000002D.00000002.21125132768.00007FF4FD027000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD027000
Size:	4096

Details

Name:	00000023.00000003.18432465628.0000015B1B9FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9FA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May drop file containing decryption instructions (likely related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	Data Encrypted for Impact
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000025.00000003.18519846500.00000207272DA000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272DA000
Size:	4096

Details

Name:	0000002E.00000002.21756681377.0000016818B50000.00000004.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	16818B50000
Size:	4096

Details

Name:	00000001.00000002.17634121839.00000000021D0000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	21D0000
Size:	4096

Details

Name:	00000019.00000003.18239182180.000001CCFDAA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAA6000
Size:	53248

Details

Name:	0000002E.00000003.19928942537.0000016819574000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819574000
Size:	4096

Details

Name:	00000023.00000003.18294888223.0000015B1A60C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A60C000
Size:	266240

Details

Name:	00000029.00000003.18637417156.000001D4525D7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D7000
Size:	131072

Details

Name:	00000008.00000003.17613526353.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18575424093.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000000.16839772474.0000000000401000.00000020.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	86016

Details

Name:	0000002E.00000002.21762270877.00007FF5A2A8A000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A8A000
Size:	12288

Details

Name:	00000018.00000002.21893176066.00007FF5BD274000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD274000
Size:	12288

Details

Name:	00000019.00000003.18234727928.000001CCFDE26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE26000
Size:	45056

Details

Name:	00000008.00000003.18515604778.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21900726899.00007FF5DA50E000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA50E000
Size:	4096

Details

Name:	00000019.00000002.21902443482.00007FF5DA71A000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA71A000
Size:	4096

Details

Name:	00000019.00000003.18133467670.000001CCFD77D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD77D000
Size:	4096

Details

Name:	00000008.00000002.21901674273.000000001E220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E220000
Size:	8192

Details

Name:	0000002D.00000002.21123833165.000002779C600000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C600000
Size:	4096

Details

Name:	00000023.00000003.18291510402.0000015B1B9F4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9F4000
Size:	20480

Details

Name:	00000008.00000003.18533234107.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18574908691.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21753989415.0000016819519000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819519000
Size:	61440

Details

Name:	00000008.00000003.18546289652.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	65536

Details

Name:	00000019.00000003.18131990880.000001CCFD73F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD73F000
Size:	4096

Details

Name:	00000022.00000002.18581450450.00007FF52FD42000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD42000
Size:	8192

Details

Name:	00000008.00000003.18506896649.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19961030382.00007FF5797F8000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797F8000
Size:	8192

Details

Name:	0000000F.00000002.18021887582.00000000015C0000.00000004.00000040.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	15C0000
Size:	8192

Details

Name:	00000008.00000003.18526069696.000000001D220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D220000
Size:	16384

Details

Name:	0000000F.00000000.18016850139.000000007F912000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F912000
Size:	4096

Details

Name:	00000008.00000003.18624695417.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	45056

Details

Name:	00000008.00000003.17696007974.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18539317029.0000016EE0365000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0365000
Size:	12288

Details

Name:	0000002E.00000003.21755697186.000001681958F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681958F000
Size:	4096

Details

Name:	00000008.00000003.17716981770.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18544460228.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	4096

Details

Name:	00000029.00000003.18642008384.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	53248

Details

Name:	00000023.00000003.18319303993.0000015B1A5CA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A5CA000
Size:	4096

Details

Name:	00000019.00000003.18181932985.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000019.00000003.18154971352.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	20480

Details

Name:	00000023.00000003.18314846357.0000015B1B7EA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B7EA000
Size:	4096

Details

Name:	00000023.00000003.18325905490.0000015B1AC98000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC98000
Size:	86016

Signature Hits	Behavior Group	Mitre Attack
Detected Hacktool Mimikatz	Privilege Escalation	OS Credential Dumping

Details

Name:	00000008.00000003.18526129145.000000001D220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D220000
Size:	12288

Details

Name:	00000008.00000003.17712475467.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18699021588.00000265030E8000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030E8000
Size:	32768

Details

Name:	00000008.00000003.18532648739.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.17691858518.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17619687120.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000003.18507018011.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19958097555.0000026503D3C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503D3C000
Size:	245760

Details

Name:	00000008.00000003.17714322652.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17618309854.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000023.00000003.18292134563.0000015B1B8F2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8F2000
Size:	266240

Details

Name:	00000018.00000002.21891333209.00007FF5BC45D000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC45D000
Size:	4096

Details

Name:	0000002E.00000002.21761633647.00007FF5A296A000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A296A000
Size:	4096

Details

Name:	00000008.00000002.21886142467.0000000000FE0000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	FE0000
Size:	4096

Details

Name:	00000019.00000003.18132602681.000001CCFD75C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD75C000
Size:	4096

Details

Name:	00000008.00000003.17694994483.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18653604225.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	28672

Details

Name:	0000002A.00000000.18667258625.00007FF650CE1000.00000020.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF650CE1000
Size:	614400

Details

Name:	0000002D.00000002.21122380735.000000B8D677B000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B8D677B000
Size:	20480

Details

Name:	00000019.00000003.18172818116.000001CCFDE3F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE3F000
Size:	16384

Details

Name:	00000018.00000002.21892278389.00007FF5BD0D6000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD0D6000
Size:	4096

Details

Name:	00000019.00000003.18181373277.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000003.18529512326.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000023.00000003.18309303064.0000015B1AF66000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AF66000
Size:	4096

Details

Name:	00000008.00000003.18524359988.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	32768

Details

Name:	0000000D.00000002.17941614882.0000000000B4F000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B4F000
Size:	4096

Details

Name:	00000008.00000003.18517401922.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	0000002D.00000002.21124812281.00007FF4FCFDF000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFDF000
Size:	8192

Details

Name:	00000019.00000003.18156153151.000001CCFDBCB000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBCB000
Size:	20480

Details

Name:	00000008.00000003.18577528545.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21756760976.0000016818B70000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818B70000
Size:	118784

Details

Name:	00000008.00000003.18505136115.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17694419920.00000000012D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12D0000
Size:	12288

Details

Name:	00000019.00000002.21888587470.000001CCF7C00000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C00000
Size:	73728

Details

Name:	0000002E.00000002.21762648684.00007FF5A2ABA000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ABA000
Size:	12288

Details

Name:	00000025.00000003.18515224779.0000020727804000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727804000
Size:	102400

Details

Name:	00000027.00000003.18539804016.0000016EE038C000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE038C000
Size:	16384

Details

Name:	0000000D.00000002.17941896489.0000000000D80000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	D80000
Size:	73728

Details

Name:	00000008.00000003.17616855088.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17693882319.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000008.00000003.18520504761.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000025.00000000.18505551052.00007DF570750000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570750000
Size:	12288

Details

Name:	00000022.00000003.18219495193.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	00000029.00000003.18631650907.000001D4525D6000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D6000
Size:	262144

Details

Name:	00000023.00000003.18351150877.0000015B1B40C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B40C000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000002.21891003016.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000008.00000003.18624231976.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	28672

Details

Name:	0000000F.00000002.18021272750.000000000103D000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	103D000
Size:	8192

Details

Name:	0000002D.00000002.21123132385.000002779C360000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C360000
Size:	4096

Details

Name:	00000008.00000002.21886004180.0000000000FD0000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	FD0000
Size:	4096

Details

Name:	00000029.00000003.18664342596.000001D4525BC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525BC000
Size:	24576

Details

Name:	00000008.00000003.17610981901.000000000161A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	161A000
Size:	8192

Details

Name:	00000008.00000003.18561786139.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19931017165.0000016819AD0000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819AD0000
Size:	4096

Details

Name:	0000002A.00000002.19954867351.000000BD262FC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD262FC000
Size:	16384

Details

Name:	00000008.00000002.21910132621.000000001E983000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E983000
Size:	8192

Details

Name:	00000008.00000003.18525077405.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18334490678.0000015B1A6C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A6C2000
Size:	4096

Details

Name:	00000008.00000003.17685630743.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21760376806.0000016819C76000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C76000
Size:	73728

Details

Name:	0000000D.00000002.17942766411.000000007FEF2000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEF2000
Size:	4096

Details

Name:	0000000F.00000002.18023035248.0000000001B71000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1B71000
Size:	12288

Details

Name:	00000008.00000003.18624883997.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000025.00000003.18519994151.00000207277C0000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277C0000
Size:	28672

Details

Name:	00000008.00000003.18550366512.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000002E.00000003.21754913021.0000016819503000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819503000
Size:	16384

Details

Name:	0000002A.00000002.19956794019.0000026503154000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503154000
Size:	86016

Details

Name:	00000023.00000003.18296662261.0000015B1C292000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C292000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18132476347.000001CCFD758000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD758000
Size:	4096

Details

Name:	00000019.00000003.18155255825.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.18508147835.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	0000000D.00000002.17941825437.0000000000B80000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	B80000
Size:	36864

Details

Name:	00000008.00000003.18572474996.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18023772784.00000000031F0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	31F0000
Size:	4096

Details

Name:	0000002D.00000002.21125325333.00007FF4FD05E000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD05E000
Size:	16384

Details

Name:	00000008.00000003.18511393709.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	20480

Details

Name:	00000008.00000003.17694213100.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	16384

Details

Name:	00000008.00000003.17686781318.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18500406644.000000001D200000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D200000
Size:	57344

Details

Name:	00000008.00000003.18549032228.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	20480

Details

Name:	00000029.00000002.19967503761.000001D4525D2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D2000
Size:	28672

Details

Name:	0000002E.00000003.21753193587.0000016819541000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819541000
Size:	28672

Details

Name:	00000008.00000003.17616062301.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18557354519.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18265837595.0000015B0CA17000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0CA17000
Size:	397312

Details

Name:	00000027.00000003.18539112696.0000016EE035F000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE035F000
Size:	20480

Details

Name:	00000008.00000003.18509083786.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000008.00000003.17713284474.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17712328098.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000002.18581183517.00007FF52FCD2000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FCD2000
Size:	4096

Details

Name:	0000002E.00000003.19929239701.000001681950E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950E000
Size:	16384

Details

Name:	00000001.00000002.17632527743.00000000001C0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1C0000
Size:	4096

Details

Name:	00000029.00000003.19966211412.000001D4525DC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DC000
Size:	16384

Details

Name:	00000008.00000003.17716063604.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17616331354.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	00000008.00000003.18523237938.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	0000000F.00000002.18022788416.0000000001860000.00000004.00000040.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1860000
Size:	8192

Details

Name:	00000025.00000003.18516047626.0000020727829000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727829000
Size:	147456

Details

Name:	00000008.00000003.18556872394.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000008.00000003.18559302304.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17695598185.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000018.00000002.21892597209.00007FF5BD1D0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD1D0000
Size:	12288

Details

Name:	00000029.00000003.18643901435.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	69632

Details

Name:	00000008.00000003.18552213658.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17696574037.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000002.18580633393.00000175342EC000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	175342EC000
Size:	4096

Details

Name:	0000002E.00000000.19925890208.0000016818B70000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818B70000
Size:	118784

Details

Name:	00000008.00000003.17619726056.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000019.00000003.18169229634.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.17687045152.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000003.18519571770.00000207277D3000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D3000
Size:	4096

Details

Name:	00000008.00000003.17617433626.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000023.00000003.18340303091.0000015B1BB02000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB02000
Size:	53248

Details

Name:	0000002E.00000002.21761931286.00007FF5A2A3F000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A3F000
Size:	32768

Details

Name:	00000023.00000003.18292720428.0000015B1BA7E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BA7E000
Size:	4096

Details

Name:	00000008.00000003.17716480629.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21900139463.00007FF5DA21B000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA21B000
Size:	4096

Details

Name:	00000019.00000002.21903019181.00007FF5DA741000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA741000
Size:	4096

Details

Name:	0000002E.00000003.19928584601.0000016819529000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819529000
Size:	4096

Details

Name:	0000002A.00000002.19955402205.0000026503020000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26503020000
Size:	4096

Details

Name:	00000029.00000003.18624507680.000001D4525D2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D2000
Size:	163840

Details

Name:	00000008.00000003.18523492090.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	28672

Details

Name:	0000000D.00000003.17939231339.0000000002573000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2573000
Size:	53248

Details

Name:	00000019.00000002.21897811954.000001CCFDB91000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB91000
Size:	61440

Details

Name:	00000022.00000003.18212333919.00000175342EE000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342EE000
Size:	12288

Details

Name:	00000019.00000003.18137174835.000001CCFDA0F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA0F000
Size:	12288

Details

Name:	00000019.00000002.21899466622.00007FF5D9D63000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9D63000
Size:	4096

Details

Name:	00000019.00000002.21892661199.000001CCF8552000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8552000
Size:	221184

Details

Name:	00000019.00000003.18181021927.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	0000002E.00000003.19929056231.0000016819529000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819529000
Size:	4096

Details

Name:	0000000F.00000002.18021785613.00000000014B5000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	14B5000
Size:	16384

Details

Name:	00000008.00000002.21890571619.0000000001630000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1630000
Size:	20480

Details

Name:	00000019.00000003.18238877243.000001CCFDE87000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE87000
Size:	122880

Details

Name:	00000023.00000003.18318994950.0000015B1A589000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A589000
Size:	229376

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18543124038.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000008.00000003.18537693842.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	57344

Details

Name:	00000008.00000003.18505244917.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18245027909.0000015B0B6E9000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6E9000
Size:	4096

Details

Name:	0000000D.00000002.17942337668.0000000002560000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2560000
Size:	65536

Details

Name:	00000025.00000002.18522703738.00007FF559262000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF559262000
Size:	40960

Details

Name:	00000025.00000002.18521360569.0000020727000000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	20727000000
Size:	28672

Details

Name:	00000008.00000002.21904829624.000000001E502000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E502000
Size:	544768

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18519851687.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17688546516.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21894297256.00007FF5BD2E7000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2E7000
Size:	4096

Details

Name:	00000027.00000003.18540120806.0000016EE0376000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0376000
Size:	4096

Details

Name:	00000008.00000003.18549603035.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	24576

Details

Name:	00000008.00000003.18542587902.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	65536

Details

Name:	0000002A.00000002.19962310857.00007FF579874000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579874000
Size:	20480

Details

Name:	00000008.00000003.18508658986.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.17690694403.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000029.00000003.18644075701.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	32768

Details

Name:	0000002E.00000002.21759608993.0000016819C00000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C00000
Size:	32768

Details

Name:	0000002A.00000003.18690370387.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	53248

Details

Name:	0000000D.00000001.17936444474.0000000000100000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	100000
Size:	4096

Details

Name:	00000023.00000003.18315232746.0000015B1AFA8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFA8000
Size:	266240

Details

Name:	0000002E.00000002.21758019903.0000016818C8A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C8A000
Size:	4096

Details

Name:	00000008.00000003.18522648660.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.18552754189.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18645040061.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	32768

Details

Name:	00000023.00000003.18328665197.0000015B1C346000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C346000
Size:	69632

Details

Name:	00000008.00000003.17697296383.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18659072610.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	57344

Details

Name:	00000029.00000003.18643323972.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	61440

Details

Name:	00000008.00000003.18542862697.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	53248

Details

Name:	00000008.00000003.18556398312.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	36864

Details

Name:	00000023.00000003.18297258109.0000015B1BC4C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BC4C000
Size:	4096

Details

Name:	00000025.00000002.18522030465.00007DF570730000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570730000
Size:	4096

Details

Name:	00000022.00000000.18190438730.00007DF5471C0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471C0000
Size:	4096

Details

Name:	0000002A.00000003.18684956653.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	90112

Details

Name:	00000029.00000002.19966749390.000000498371C000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	498371C000
Size:	16384

Details

Name:	00000019.00000003.18225424063.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	65536

Details

Name:	00000019.00000002.21888414362.000001CCF7B60000.00000004.00000040.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1CCF7B60000
Size:	4096

Details

Name:	00000008.00000003.17717897580.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18131684135.000001CCFD735000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD735000
Size:	4096

Details

Name:	00000019.00000003.18211620774.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000029.00000003.18655268107.000001D4525EC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EC000
Size:	32768

Details

Name:	00000008.00000002.21901853262.000000001E22D000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E22D000
Size:	4096

Details

Name:	0000002E.00000003.19928797053.0000016818CA2000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CA2000
Size:	12288

Details

Name:	00000001.00000002.17633944442.0000000000C30000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	C30000
Size:	73728

Details

Name:	00000008.00000003.17691921494.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17685318659.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18530344144.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18510018718.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18523115236.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000019.00000002.21901102199.00007FF5DA677000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA677000
Size:	4096

Details

Name:	00000022.00000002.18581315668.00007FF52FCF6000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FCF6000
Size:	24576

Details

Name:	00000019.00000003.18238636673.000001CCFDA31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA31000
Size:	20480

Details

Name:	00000008.00000003.17696380917.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19942908094.0000026503C30000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503C30000
Size:	4096

Details

Name:	00000008.00000002.21910889874.0000000020478000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20478000
Size:	8192

Details

Name:	00000008.00000003.18549926154.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18132540970.000001CCFD75A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD75A000
Size:	4096

Details

Name:	0000002D.00000002.21124711820.00007FF4FCFC2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFC2000
Size:	4096

Details

Name:	00000008.00000002.21901132156.000000001DF9E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DF9E000
Size:	8192

Details

Name:	00000027.00000002.18542649813.00007DF5972D0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972D0000
Size:	12288

Details

Name:	00000008.00000003.17619956537.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000023.00000003.18276634115.0000015B08199000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08199000
Size:	45056

Details

Name:	00000019.00000002.21901569557.00007FF5DA6DE000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6DE000
Size:	4096

Details

Name:	00000027.00000003.18536861644.0000016EE0372000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0372000
Size:	20480

Details

Name:	00000019.00000003.18132975043.000001CCFD768000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD768000
Size:	4096

Details

Name:	00000022.00000003.18579609172.00000175342EE000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342EE000
Size:	12288

Details

Name:	00000019.00000002.21894326299.000001CCF85EE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85EE000
Size:	8192

Details

Name:	00000019.00000003.18185817568.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000008.00000003.17685925874.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21753904027.0000016819516000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819516000
Size:	8192

Details

Name:	00000008.00000003.17617796595.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	12288

Details

Name:	00000001.00000000.16839522831.0000000000040000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	40000
Size:	118784

Details

Name:	00000008.00000003.17614168691.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	36864

Details

Name:	00000008.00000003.18520322524.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000001.00000002.17634272412.0000000002200000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2200000
Size:	8192

Details

Name:	00000019.00000003.18169579156.000001CCFDBD6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBD6000
Size:	20480

Details

Name:	0000002A.00000003.18692016913.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	53248

Details

Name:	00000027.00000003.18540482285.0000016EDFE5A000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE5A000
Size:	4096

Details

Name:	00000008.00000003.17611986722.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.18575689646.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17686355451.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21902977028.000000001E2F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E2F0000
Size:	12288

Details

Name:	00000023.00000003.18269533592.0000015B08159000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08159000
Size:	65536

Details

Name:	00000019.00000003.18168339681.000001CCFDE24000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE24000
Size:	233472

Details

Name:	0000002E.00000003.21754495963.000001681951E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951E000
Size:	4096

Details

Name:	00000008.00000003.17620271299.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	0000002A.00000002.19955127721.0000026502EF0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26502EF0000
Size:	4096

Details

Name:	00000008.00000003.17616289368.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18528940518.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000019.00000003.18210691020.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000019.00000002.21900612223.00007FF5DA477000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA477000
Size:	4096

Details

Name:	00000008.00000003.17617187532.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000019.00000002.21899417573.00007FF5D9CF0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9CF0000
Size:	4096

Details

Name:	00000029.00000000.18609926795.000001D452450000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452450000
Size:	118784

Details

Name:	00000029.00000003.18625061884.000001D4525D3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D3000
Size:	262144

Details

Name:	00000008.00000003.18511988944.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18542154563.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	24576

Details

Name:	00000027.00000003.18539556871.0000016EE03C6000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03C6000
Size:	86016

Details

Name:	00000008.00000003.17695944489.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18427196191.0000015B1AB46000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB46000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
May infect USB drives	Spreading	Replication Through Removable Media
May initialize a security null descriptor	Lowering of HIPS / PFW / Operating System Security Settings
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002D.00000000.19910209544.00007DF5144B2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144B2000
Size:	4096

Details

Name:	00000008.00000003.17616474433.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000019.00000002.21887225660.00000052715F9000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52715F9000
Size:	28672

Details

Name:	00000029.00000003.18655046804.000001D4525EC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EC000
Size:	53248

Details

Name:	00000008.00000003.18514184366.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	57344

Details

Name:	0000002E.00000003.21756057251.0000016818C47000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C47000
Size:	40960

Details

Name:	0000000D.00000002.17940785059.0000000000601000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	601000
Size:	12288

Details

Name:	00000008.00000002.21915229266.000000007FA90000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA90000
Size:	12288

Details

Name:	00000008.00000003.17688415436.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17695566805.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18333278800.0000015B1AC5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC5E000
Size:	200704

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000025.00000002.18522066229.00007DF570732000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570732000
Size:	4096

Details

Name:	00000023.00000003.18291256000.0000015B1B9B9000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9B9000
Size:	229376

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000000F.00000002.18024640537.000000007F920000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F920000
Size:	12288

Details

Name:	00000027.00000000.18524344419.0000016EDFA20000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFA20000
Size:	118784

Details

Name:	0000002A.00000003.19950862655.0000026503154000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503154000
Size:	86016

Details

Name:	00000029.00000003.18641187646.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	65536

Details

Name:	00000029.00000003.18638368876.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	28672

Details

Name:	00000023.00000003.18260309272.0000015B0C57A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C57A000
Size:	1228800

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18349305406.0000015B1AA1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AA1C000
Size:	4096

Details

Name:	00000019.00000003.18198183759.000001CCFDE03000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE03000
Size:	126976

Details

Name:	0000002A.00000003.18692203846.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000023.00000003.18339677269.0000015B1AB04000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB04000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18553880062.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18227550484.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	28672

Details

Name:	00000023.00000003.18337687197.0000015B1BA3C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BA3C000
Size:	4096

Details

Name:	00000008.00000003.18526282112.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000002.21914337294.000000002155E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2155E000
Size:	8192

Details

Name:	00000008.00000003.18521027254.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	0000000D.00000000.17936219480.000000007FEE2000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEE2000
Size:	4096

Details

Name:	00000023.00000003.18333194957.0000015B1AC4F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC4F000
Size:	57344

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000003.18211852270.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000027.00000002.18543609998.00007FF57FE5E000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE5E000
Size:	16384

Details

Name:	0000002A.00000003.18698853843.0000026503108000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503108000
Size:	4096

Details

Name:	0000000D.00000002.17940009105.0000000000102000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	102000
Size:	45056

Details

Name:	00000008.00000003.18557525414.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18660592218.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	53248

Details

Name:	00000008.00000003.18507797818.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18511095596.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18185850130.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000023.00000003.18314484422.0000015B1BB86000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB86000
Size:	4096

Details

Name:	00000023.00000003.18351872898.0000015B1C1B6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C1B6000
Size:	4096

Details

Name:	0000000F.00000003.18019901108.00000000058E0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	58E0000
Size:	8192

Details

Name:	0000002E.00000002.21758104774.0000016818C90000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C90000
Size:	24576

Details

Name:	00000025.00000003.18518077633.0000020727836000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727836000
Size:	86016

Details

Name:	00000008.00000003.18576501840.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19926903540.0000016819529000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819529000
Size:	8192

Details

Name:	00000008.00000003.18018224980.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21898817394.00007DF5F1BF2000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1BF2000
Size:	4096

Details

Name:	00000019.00000003.18154062041.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000019.00000002.21893974703.000001CCF85D3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85D3000
Size:	32768

Details

Name:	00000027.00000003.18536582736.0000016EE0377000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0377000
Size:	12288

Details

Name:	0000002A.00000002.19962756586.00007FF5798CE000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798CE000
Size:	12288

Details

Name:	00000001.00000000.16839731726.0000000000400000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000018.00000002.21888590364.00000205EE257000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE257000
Size:	57344

Details

Name:	0000002E.00000003.21755434864.0000016819540000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819540000
Size:	4096

Details

Name:	0000002E.00000003.21755523015.0000016819551000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819551000
Size:	4096

Details

Name:	00000008.00000003.18514310244.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000008.00000003.17615786790.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	45056

Details

Name:	00000008.00000003.17694931515.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18539730242.0000016EE0387000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0387000
Size:	36864

Details

Name:	00000023.00000003.18307169245.0000015B1A4C3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A4C3000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17689041636.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18502844464.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18131809239.000001CCFD739000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD739000
Size:	4096

Details

Name:	0000002E.00000002.21763510714.00007FF5A2B4B000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B4B000
Size:	4096

Details

Name:	00000029.00000003.18641646253.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	73728

Details

Name:	00000029.00000003.18647047988.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	32768

Details

Name:	00000023.00000003.18316930994.0000015B1B590000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B590000
Size:	28672

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.17620330898.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	0000002A.00000000.18668115570.00007FF650D99000.00000008.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF650D99000
Size:	8192

Details

Name:	00000008.00000003.17715527480.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17694489291.00000000012D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12D0000
Size:	12288

Details

Name:	00000008.00000003.18523563374.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	12288

Details

Name:	00000001.00000002.17634076648.0000000000DB0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	DB0000
Size:	4096

Details

Name:	00000008.00000002.21912202714.000000002071E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2071E000
Size:	12288

Details

Name:	00000008.00000003.18552815403.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18338981392.0000015B1A80C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A80C000
Size:	4096

Details

Name:	00000008.00000003.17693393454.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18021344977.000000000104D000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	104D000
Size:	4096

Details

Name:	00000008.00000003.18529580635.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	4096

Details

Name:	0000002E.00000002.21756533896.00000039AFB7F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AFB7F000
Size:	4096

Details

Name:	00000023.00000003.18332554033.0000015B1C0AF000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0AF000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.17685869255.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21888079469.0000000001501000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1501000
Size:	12288

Details

Name:	0000002A.00000002.19961467089.00007FF579834000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579834000
Size:	12288

Details

Name:	00000008.00000003.18018148822.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18847709892.000001CCFDE02000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE02000
Size:	131072

Details

Name:	00000008.00000003.18503318622.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	65536

Details

Name:	00000008.00000003.18505906485.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17687286037.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21899925566.00007FF5DA06D000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA06D000
Size:	12288

Details

Name:	00000019.00000002.21898324699.000001CCFDBF9000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF9000
Size:	4096

Details

Name:	00000027.00000000.18524620922.00007DF5972C0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972C0000
Size:	4096

Details

Name:	00000001.00000002.17633218679.0000000000440000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	440000
Size:	4096

Details

Name:	0000002A.00000003.19922602599.0000026503116000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503116000
Size:	102400

Details

Name:	00000029.00000003.18652708230.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	28672

Details

Name:	00000018.00000002.21890657252.00007DF4D2630000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF4D2630000
Size:	20480

Details

Name:	0000002A.00000002.19960408465.00007FF5796F2000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5796F2000
Size:	20480

Details

Name:	00000022.00000002.18580950858.00007DF5471D2000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471D2000
Size:	4096

Details

Name:	00000008.00000003.18560894246.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19929505537.0000016818CAC000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CAC000
Size:	4096

Details

Name:	00000023.00000003.18350770272.0000015B1B6E2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6E2000
Size:	4096

Details

Name:	00000019.00000003.18181126355.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000008.00000003.18579015478.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21897726357.000001CCFDB88000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB88000
Size:	32768

Details

Name:	00000029.00000002.19968082717.00007FF560B57000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560B57000
Size:	4096

Details

Name:	00000019.00000003.18183309969.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000019.00000003.18226741942.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	45056

Details

Name:	00000008.00000002.21903352555.000000001E320000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1E320000
Size:	4096

Details

Name:	00000023.00000003.18411086505.0000015B1B2A1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2A1000
Size:	65536

Details

Name:	00000023.00000003.18344298562.0000015B1AD14000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD14000
Size:	4096

Details

Name:	0000002D.00000002.21124662865.00007FF4FCFBE000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFBE000
Size:	12288

Details

Name:	00000008.00000003.17618953287.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	00000023.00000003.18329340155.0000015B1AC0C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC0C000
Size:	143360

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18551903196.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18182040920.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.18575795345.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21893528741.00007FF5BD28B000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD28B000
Size:	20480

Details

Name:	00000008.00000003.18501803031.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	65536

Details

Name:	00000019.00000002.21899810571.00007FF5DA01C000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA01C000
Size:	4096

Details

Name:	00000008.00000003.18557758317.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000029.00000003.18654077430.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	32768

Details

Name:	00000008.00000003.18529300569.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	20480

Details

Name:	00000019.00000002.21894971686.000001CCF9130000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9130000
Size:	65536

Details

Name:	00000008.00000003.18517900824.0000000001771000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1771000
Size:	61440

Details

Name:	00000018.00000002.21892666070.00007FF5BD1D4000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD1D4000
Size:	4096

Details

Name:	00000019.00000003.18132910680.000001CCFD766000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD766000
Size:	4096

Details

Name:	00000029.00000003.19966315843.000001D4525D9000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D9000
Size:	12288

Details

Name:	00000008.00000003.18575011860.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18696254620.00000265030FF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030FF000
Size:	57344

Details

Name:	00000008.00000003.17715398296.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18544967091.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	12288

Details

Name:	00000023.00000003.18248085953.0000015B0B9B2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B9B2000
Size:	401408

Details

Name:	00000019.00000003.18179141146.000001CCFDE23000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE23000
Size:	36864

Details

Name:	00000025.00000003.18517869007.0000020727835000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727835000
Size:	90112

Details

Name:	00000008.00000003.17615460375.0000000020761000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20761000
Size:	61440

Details

Name:	0000000D.00000002.17940862147.0000000000625000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	625000
Size:	16384

Details

Name:	00000008.00000003.18518102602.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000023.00000003.18229434164.0000015B08155000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08155000
Size:	225280

Details

Name:	00000019.00000003.18153002925.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	0000000F.00000002.18021656635.0000000001490000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1490000
Size:	4096

Details

Name:	00000008.00000003.18553705408.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17716240458.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19939625934.0000016819595000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819595000
Size:	4096

Details

Name:	00000019.00000002.21895641896.000001CCFD710000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD710000
Size:	4096

Details

Name:	00000025.00000003.18518339114.00000207277EE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277EE000
Size:	24576

Details

Name:	00000008.00000003.18521853977.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000027.00000003.18540352200.0000016EDFE5B000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE5B000
Size:	16384

Details

Name:	00000025.00000002.18521325232.0000020726FC0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726FC0000
Size:	4096

Details

Name:	00000008.00000003.17714125384.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21905650034.000000001E595000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E595000
Size:	4108288

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.17692183608.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21911476443.000000002056F000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2056F000
Size:	4096

Details

Name:	0000002A.00000003.18697951200.0000026503109000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503109000
Size:	65536

Details

Name:	00000008.00000002.21915172016.000000007FA82000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA82000
Size:	4096

Details

Name:	00000001.00000002.17642353362.000000007FFD0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFD0000
Size:	12288

Details

Name:	00000008.00000002.21900189609.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	12288

Details

Name:	0000002E.00000003.21753260108.0000016819543000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819543000
Size:	20480

Details

Name:	00000023.00000003.18321252333.0000015B1B6A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6A0000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000023.00000003.18303445859.0000015B1B86F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B86F000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000003.19952475686.000002650313C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313C000
Size:	8192

Details

Name:	0000002E.00000003.19940450401.000001681955E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681955E000
Size:	20480

Details

Name:	0000002D.00000000.19909809708.000002779C1D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C1D0000
Size:	118784

Details

Name:	00000019.00000002.21903466570.00007FF5DA794000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA794000
Size:	20480

Details

Name:	00000008.00000003.17694287350.00000000012D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12D0000
Size:	12288

Details

Name:	00000008.00000003.17617391220.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18519583021.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21899048584.000000001D0B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B0000
Size:	4096

Details

Name:	00000022.00000002.18580575808.00000175342D4000.00000004.00000020.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	175342D4000
Size:	28672

Details

Name:	00000029.00000003.18638126557.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	90112

Details

Name:	00000018.00000002.21891127591.00007FF5BC414000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC414000
Size:	12288

Details

Name:	00000008.00000003.17685983763.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18212410966.000001CCF858B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF858B000
Size:	49152

Details

Name:	0000002E.00000003.21752758592.0000016819570000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819570000
Size:	8192

Details

Name:	00000022.00000002.18580281578.0000017534130000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	17534130000
Size:	4096

Details

Name:	00000022.00000003.18212437157.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	00000025.00000003.18517767374.0000020727807000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727807000
Size:	49152

Details

Name:	00000008.00000002.21910178869.000000001E986000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E986000
Size:	208896

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000002.21903322906.00007FF5DA78B000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA78B000
Size:	4096

Details

Name:	00000008.00000003.18515141032.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000023.00000003.18300098662.0000015B1C3F4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C3F4000
Size:	167936

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000002E.00000003.21753025633.0000016819539000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819539000
Size:	4096

Details

Name:	0000000F.00000002.18024228687.00000000033C1000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	33C1000
Size:	36864

Details

Name:	00000008.00000003.18018652126.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21896678371.000001CCFDA60000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA60000
Size:	4096

Details

Name:	00000023.00000003.18291555243.0000015B1B9FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9FA000
Size:	266240

Details

Name:	00000008.00000003.17612843116.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	32768

Details

Name:	00000008.00000003.18626088143.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18326614272.0000015B1A717000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A717000
Size:	188416

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18520832366.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000027.00000003.18537109319.0000016EE03AE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03AE000
Size:	192512

Details

Name:	00000008.00000003.18510246506.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	28672

Details

Name:	00000025.00000002.18522532818.00007FF559242000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF559242000
Size:	4096

Details

Name:	00000023.00000003.18288626396.0000015B081A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B081A0000
Size:	20480

Details

Name:	00000008.00000003.18626501352.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	65536

Details

Name:	0000002A.00000003.19953238431.000002650310B000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650310B000
Size:	12288

Details

Name:	00000025.00000003.18518525813.00000207277E8000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E8000
Size:	8192

Details

Name:	0000000D.00000002.17942607177.0000000004B50000.00000040.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	4B50000
Size:	4096

Details

Name:	00000008.00000003.18624551646.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	28672

Details

Name:	00000019.00000003.18211057491.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000022.00000003.18219471271.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	00000008.00000003.18626392949.00000000207D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207D0000
Size:	65536

Details

Name:	00000008.00000003.18525117801.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21891458770.00000000017C0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	17C0000
Size:	16384

Details

Name:	00000008.00000003.17690760214.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000019.00000002.21889621328.000001CCF7C75000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C75000
Size:	8192

Details

Name:	00000008.00000003.17616673057.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	49152

Details

Name:	00000008.00000002.21914572035.00000000215CD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	215CD000
Size:	20480

Details

Name:	00000008.00000003.17618864788.000000001E317000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E317000
Size:	16384

Details

Name:	00000008.00000003.18575168498.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18518993238.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000023.00000003.18316296435.0000015B1A4C2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A4C2000
Size:	4096

Details

Name:	00000029.00000003.18652317512.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	28672

Details

Name:	00000008.00000002.21912154065.000000002071B000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2071B000
Size:	8192

Details

Name:	00000008.00000003.17714063790.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17614815542.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002A.00000002.19960933534.00007FF5797DD000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797DD000
Size:	8192

Details

Name:	0000000F.00000003.18019644765.0000000003390000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	3390000
Size:	12288

Details

Name:	00000029.00000000.18610630876.00007FF6836AF000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6836AF000
Size:	61440

Details

Name:	00000029.00000003.18645612874.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	65536

Details

Name:	00000008.00000003.18560722542.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17621075945.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	131072

Details

Name:	0000002E.00000002.21759758341.0000016819C13000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C13000
Size:	24576

Details

Name:	00000008.00000003.17715881745.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19954681896.000000BD260FE000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD260FE000
Size:	8192

Details

Name:	00000025.00000002.18521829600.0000020727170000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20727170000
Size:	4096

Details

Name:	00000023.00000003.18402095009.0000015B1AE5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5E000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000018.00000002.21890973933.00007DF5D4782000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4782000
Size:	4096

Details

Name:	00000008.00000002.21887979157.00000000014B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	14B0000
Size:	8192

Details

Name:	00000008.00000003.18550167209.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21758737998.0000016818CF3000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CF3000
Size:	24576

Details

Name:	00000008.00000003.18572319960.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000000.18610357999.00007FF683680000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF683680000
Size:	4096

Details

Name:	00000029.00000003.18643470727.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	53248

Details

Name:	0000002E.00000003.21754758497.0000016819520000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819520000
Size:	4096

Details

Name:	00000008.00000003.17620396497.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000023.00000003.18291144807.0000015B1BFD5000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFD5000
Size:	73728

Details

Name:	00000008.00000003.18506265644.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18347923292.0000015B1B514000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B514000
Size:	4096

Details

Name:	00000001.00000002.17634594405.0000000002250000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2250000
Size:	4096

Details

Name:	0000000F.00000002.18020619769.0000000000F50000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F50000
Size:	4096

Details

Name:	00000029.00000002.19967395384.000001D4525BD000.00000004.00000020.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1D4525BD000
Size:	69632

Details

Name:	00000008.00000003.18587416343.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19929461948.000001681950F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950F000
Size:	4096

Details

Name:	0000002A.00000002.19959616304.00007FF578FE7000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578FE7000
Size:	4096

Details

Name:	00000008.00000003.18514614774.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000018.00000002.21893695190.00007FF5BD29A000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD29A000
Size:	4096

Details

Name:	00000019.00000002.21899277339.00007FF5D9B62000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9B62000
Size:	28672

Details

Name:	00000018.00000002.21894631222.00007FF5BD31A000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD31A000
Size:	8192

Details

Name:	00000027.00000002.18542337488.0000016EDFEC0000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFEC0000
Size:	12288

Details

Name:	00000019.00000002.21894592880.000001CCF9100000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9100000
Size:	65536

Details

Name:	0000002E.00000003.19930070729.0000016819532000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819532000
Size:	16384

Details

Name:	0000002D.00000002.21124159725.00007DF5144C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144C0000
Size:	4096

Details

Name:	00000008.00000003.17693464654.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21903248550.000000001E310000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1E310000
Size:	16384

Details

Name:	0000002A.00000003.18690652848.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	61440

Details

Name:	00000008.00000003.18552939734.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18510092829.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000027.00000002.18541341516.0000016EDFA00000.00000004.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	16EDFA00000
Size:	4096

Details

Name:	00000019.00000002.21892397852.000001CCF8536000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8536000
Size:	110592

Details

Name:	00000019.00000002.21886784141.000000527107F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	527107F000
Size:	4096

Details

Name:	00000029.00000003.19966160874.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	12288

Details

Name:	00000019.00000003.18185984840.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000027.00000003.18538063698.0000016EE0395000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0395000
Size:	61440

Details

Name:	00000023.00000003.18284212320.0000015B1B935000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B935000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May enable test signing (to load unsigned drivers)	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002E.00000003.21753603678.0000016819532000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819532000
Size:	16384

Details

Name:	00000023.00000003.18343980449.0000015B1ACD2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ACD2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000003.19953520537.000002650313C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313C000
Size:	8192

Details

Name:	00000019.00000003.18152128429.000001CCFDE24000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE24000
Size:	233472

Details

Name:	00000023.00000003.18312517091.0000015B1AD5A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD5A000
Size:	249856

Details

Name:	0000002D.00000002.21122230887.000000B8D5FDD000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B8D5FDD000
Size:	12288

Details

Name:	0000002A.00000003.19953878915.000002650314A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650314A000
Size:	16384

Details

Name:	00000008.00000003.17901131633.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000008.00000003.17684284317.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18533691175.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	20480

Details

Name:	00000001.00000002.17633331859.000000000045A000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	45A000
Size:	8192

Details

Name:	0000002D.00000002.21124941147.00007FF4FCFF4000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFF4000
Size:	20480

Details

Name:	00000019.00000003.18152457234.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	0000002A.00000002.19956576165.000002650313C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313C000
Size:	8192

Details

Name:	00000008.00000003.17610474541.00000000015BF000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15BF000
Size:	311296

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000003.18198336927.000001CCFDE10000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE10000
Size:	73728

Details

Name:	0000002A.00000003.18691364125.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000008.00000003.18506162897.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18244793250.0000015B0B6B4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6B4000
Size:	4096

Details

Name:	00000023.00000003.18231000672.0000015B0AA73000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0AA73000
Size:	8192

Details

Name:	00000001.00000000.16840040097.000000007FFD0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFD0000
Size:	12288

Details

Name:	00000008.00000003.18530646752.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	65536

Details

Name:	00000029.00000003.19965389543.000001D4525F0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525F0000
Size:	24576

Details

Name:	00000008.00000003.18554127542.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.19966414267.000001D4525EE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EE000
Size:	8192

Details

Name:	00000008.00000003.18528103890.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.18626683754.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	53248

Details

Name:	00000025.00000002.18522251445.00007FF5586A2000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5586A2000
Size:	28672

Details

Name:	00000019.00000002.21897926092.000001CCFDBA1000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBA1000
Size:	12288

Details

Name:	00000008.00000003.17684064301.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17689217886.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18680026507.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	00000025.00000003.18519275893.00000207277FE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277FE000
Size:	8192

Details

Name:	00000008.00000003.17688782282.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18645249066.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	28672

Details

Name:	00000008.00000003.17616174976.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17712687828.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19954732820.000000BD2617E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD2617E000
Size:	8192

Details

Name:	00000008.00000002.21891748761.0000000001810000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1810000
Size:	36864

Details

Name:	00000019.00000003.18224105762.000001CCFDE42000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE42000
Size:	28672

Details

Name:	00000008.00000003.17696526108.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19954029682.00000265030B3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030B3000
Size:	77824

Details

Name:	00000029.00000002.19968006367.00007FF5521DA000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5521DA000
Size:	4096

Details

Name:	00000008.00000003.18530460732.000000001D280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D280000
Size:	57344

Details

Name:	00000019.00000003.18239984116.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	122880

Details

Name:	00000018.00000002.21890575405.00000205EEA02000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EEA02000
Size:	4096

Details

Name:	00000008.00000003.17687848683.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18675682513.00000265030EA000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EA000
Size:	249856

Details

Name:	00000008.00000003.18573439787.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18167515147.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000008.00000003.18525176569.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	12288

Details

Name:	0000002E.00000003.19928183108.000001681950E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950E000
Size:	16384

Details

Name:	00000008.00000002.21902810648.000000001E2E0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E2E0000
Size:	65536

Details

Name:	00000008.00000003.18516051711.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	65536

Details

Name:	00000019.00000003.18132051044.000001CCFD741000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD741000
Size:	16384

Details

Name:	00000008.00000003.17712406031.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18545482327.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	65536

Details

Name:	00000023.00000003.18294272364.0000015B1C132000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C132000
Size:	4096

Details

Name:	00000008.00000003.18518341623.000000001D1B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1B0000
Size:	65536

Details

Name:	00000023.00000003.18331546156.0000015B1AB04000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB04000
Size:	266240

Details

Name:	00000019.00000003.18183532774.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.18552385737.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21892982908.00007FF5BD21D000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD21D000
Size:	4096

Details

Name:	00000001.00000002.17632685464.0000000000279000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	279000
Size:	12288

Details

Name:	00000019.00000002.21891195746.000001CCF8180000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF8180000
Size:	4096

Details

Name:	00000008.00000002.21914167644.00000000209F0000.00000040.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	209F0000
Size:	8192

Details

Name:	00000029.00000003.18660016280.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	69632

Details

Name:	00000008.00000003.18575946767.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000002.19967745895.00007DF475F90000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF475F90000
Size:	20480

Details

Name:	00000008.00000003.17696237409.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21911432322.000000002055A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2055A000
Size:	8192

Details

Name:	0000002D.00000002.21122881484.000002779C1F0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C1F0000
Size:	12288

Details

Name:	00000008.00000003.18513298286.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	0000002A.00000003.19953283474.0000026503116000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503116000
Size:	139264

Details

Name:	00000023.00000003.18417365974.0000015B1AE5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5E000
Size:	4096

Details

Name:	00000019.00000003.18155296072.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000019.00000003.18153528635.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000023.00000003.18287504316.0000015B1BBC8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BBC8000
Size:	57344

Details

Name:	00000008.00000003.17690465643.0000000001280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1280000
Size:	16384

Details

Name:	00000008.00000003.18550021697.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19929406341.000001681950F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950F000
Size:	12288

Details

Name:	00000008.00000003.18554399002.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616570070.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002A.00000002.19963065934.00007FF650CE1000.00000020.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF650CE1000
Size:	614400

Details

Name:	00000025.00000002.18522576304.00007FF55924B000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF55924B000
Size:	20480

Details

Name:	0000002A.00000002.19956753467.0000026503150000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503150000
Size:	4096

Details

Name:	00000019.00000003.18156562872.000001CCFDBF7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF7000
Size:	20480

Details

Name:	00000008.00000003.18574573409.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21890837219.0000000001710000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1710000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000018.00000002.21892874294.00007FF5BD209000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD209000
Size:	53248

Details

Name:	00000022.00000001.18209075087.00007FF758840000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF758840000
Size:	4096

Details

Name:	00000008.00000003.18558283218.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000029.00000003.18657777804.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000008.00000002.21903052610.000000001E300000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E300000
Size:	65536

Details

Name:	00000008.00000003.18521534720.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	32768

Details

Name:	00000008.00000003.18525924777.000000001D220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D220000
Size:	65536

Details

Name:	00000008.00000003.17682658738.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17684520237.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18696455995.0000026503103000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503103000
Size:	53248

Details

Name:	00000018.00000002.21893316881.00007FF5BD27E000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD27E000
Size:	12288

Details

Name:	00000025.00000003.18514867473.000002072781D000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072781D000
Size:	196608

Details

Name:	00000008.00000003.18550070960.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21123945966.000002779C613000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C613000
Size:	8192

Details

Name:	0000002E.00000000.19926375485.00007FF5A2B5E000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B5E000
Size:	16384

Details

Name:	00000008.00000003.18576708324.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18554731304.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000019.00000002.21896803536.000001CCFDAB1000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAB1000
Size:	8192

Details

Name:	00000023.00000000.18220689224.00007DF5B95E2000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B95E2000
Size:	4096

Details

Name:	00000019.00000003.18133035069.000001CCFD76A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD76A000
Size:	4096

Details

Name:	00000018.00000000.18127732569.00007DF5D4790000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4790000
Size:	12288

Details

Name:	0000002A.00000003.18698618149.0000026503108000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503108000
Size:	4096

Details

Name:	00000008.00000003.18513860754.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.17612330164.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000001.00000002.17634167895.00000000021E0000.00000020.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute read
Base address:	21E0000
Size:	40960

Details

Name:	00000008.00000003.18531836007.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	49152

Details

Name:	00000008.00000003.17712885246.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18197179826.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000008.00000003.17689276578.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000000.18190607618.00007FF52FD6E000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD6E000
Size:	16384

Details

Name:	00000001.00000002.17634787214.0000000002A50000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2A50000
Size:	36864

Details

Name:	00000008.00000003.18501598940.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000008.00000003.18530394357.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000002.21891304312.00000000017A0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	17A0000
Size:	65536

Details

Name:	0000002A.00000002.19961935305.00007FF57984B000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57984B000
Size:	20480

Details

Name:	0000002E.00000003.21753319557.0000016819542000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819542000
Size:	4096

Details

Name:	00000023.00000003.18297289690.0000015B1BCD0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BCD0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000029.00000003.18638532682.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	57344

Details

Name:	0000002A.00000003.19952819783.0000026503174000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503174000
Size:	24576

Details

Name:	0000002E.00000000.19926319232.00007DF5B9FD0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FD0000
Size:	12288

Details

Name:	0000002A.00000002.19963779666.00007FF650D77000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650D77000
Size:	139264

Details

Name:	00000001.00000002.17636064879.0000000002D19000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2D19000
Size:	24576

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000019.00000002.21891094708.000001CCF8000000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF8000000
Size:	16384

Details

Name:	00000022.00000003.18219520565.00000175342E3000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342E3000
Size:	40960

Details

Name:	00000008.00000003.18524281779.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	16384

Details

Name:	00000019.00000003.18132726419.000001CCFD760000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD760000
Size:	4096

Details

Name:	00000008.00000003.17687114547.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17712167003.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18137353471.000001CCF855C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF855C000
Size:	118784

Details

Name:	0000000D.00000002.17941643444.0000000000B53000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B53000
Size:	4096

Details

Name:	00000018.00000002.21890894769.00007DF5D4780000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4780000
Size:	4096

Details

Name:	0000002A.00000002.19956931024.000002650316C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2650316C000
Size:	12288

Details

Name:	00000029.00000002.19967956321.00007DF5780F0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780F0000
Size:	12288

Details

Name:	00000008.00000003.18511710918.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.18577318359.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21886786000.0000000001220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1220000
Size:	4096

Details

Name:	00000008.00000003.18018491810.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21890292117.000001CCF7CE8000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7CE8000
Size:	16384

Details

Name:	00000019.00000003.18198105297.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000000.17218436212.0000000001370000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1370000
Size:	4096

Details

Name:	00000008.00000003.17713219975.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18021413659.00000000012FC000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	12FC000
Size:	16384

Details

Name:	00000019.00000003.18197011489.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000008.00000003.18529435313.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	24576

Details

Name:	00000025.00000003.18517224954.00000207272D5000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D5000
Size:	12288

Details

Name:	0000002A.00000002.19960004447.00007FF57955C000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57955C000
Size:	4096

Details

Name:	00000008.00000002.21914775461.00000000219E0000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	219E0000
Size:	8192

Details

Name:	00000008.00000003.17714188102.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17697388292.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17618359261.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	40960

Details

Name:	00000001.00000002.17642263501.000000007FFC0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC0000
Size:	4096

Details

Name:	0000002E.00000002.21758922000.0000016818D05000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818D05000
Size:	53248

Details

Name:	0000000D.00000002.17940213612.0000000000150000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	150000
Size:	118784

Details

Name:	00000029.00000002.19968045479.00007FF560B3D000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560B3D000
Size:	4096

Details

Name:	00000025.00000002.18522377798.00007FF5591B7000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5591B7000
Size:	4096

Details

Name:	00000019.00000003.18133831068.000001CCFD78F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD78F000
Size:	4096

Details

Name:	00000008.00000003.18556323298.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	12288

Details

Name:	00000008.00000003.17713800297.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000003.21121946875.000002779C713000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C713000
Size:	8192

Details

Name:	00000023.00000003.18341409257.0000015B1C4E4000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C4E4000
Size:	4096

Details

Name:	00000019.00000003.18153071521.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000023.00000003.18320569449.0000015B1B556000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B556000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18169276528.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.17684775425.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17687236398.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21894087396.000001CCF85DC000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85DC000
Size:	32768

Details

Name:	00000001.00000002.17632566515.00000000001D0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D0000
Size:	4096

Details

Name:	00000018.00000002.21889912361.00000205EE631000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE631000
Size:	12288

Details

Name:	0000002D.00000003.19911642579.000002779C700000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C700000
Size:	4096

Details

Name:	00000008.00000003.18508991866.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.19928447159.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	4096

Details

Name:	00000008.00000003.17619262293.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	12288

Details

Name:	00000008.00000003.18626286121.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	65536

Details

Name:	0000000F.00000002.18024390420.000000000559E000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	559E000
Size:	8192

Details

Name:	00000019.00000003.18179874368.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000019.00000003.18154789954.000001CCFD6F0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD6F0000
Size:	4096

Details

Name:	00000019.00000003.18225997434.000001CCFDA31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA31000
Size:	20480

Details

Name:	0000002A.00000002.19957305592.00000265032E5000.00000004.00000040.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	265032E5000
Size:	36864

Details

Name:	00000029.00000003.18649792288.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	57344

Details

Name:	0000002A.00000002.19955713787.00000265030A0000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	265030A0000
Size:	24576

Details

Name:	00000019.00000003.18154692878.000001CCF85B3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B3000
Size:	4096

Details

Name:	00000008.00000003.18558346745.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18502616522.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	0000002E.00000002.21763461129.00007FF5A2B32000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B32000
Size:	8192

Details

Name:	00000019.00000003.18228432206.000001CCFDAA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAA6000
Size:	53248

Details

Name:	00000008.00000002.21914515165.00000000215B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	215B0000
Size:	4096

Details

Name:	00000018.00000002.21889308291.00000205EE2BB000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE2BB000
Size:	8192

Details

Name:	00000019.00000002.21893559390.000001CCF85AC000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85AC000
Size:	32768

Details

Name:	0000002E.00000002.21758231591.0000016818CAD000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CAD000
Size:	16384

Details

Name:	00000019.00000003.18214106838.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000019.00000002.21900968036.00007FF5DA5BD000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA5BD000
Size:	8192

Details

Name:	00000018.00000002.21887319964.00000205EE0E0000.00000004.00000020.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	205EE0E0000
Size:	12288

Details

Name:	00000008.00000003.17692245936.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17634852166.0000000002BD0000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2BD0000
Size:	28672

Details

Name:	00000008.00000003.17685507812.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17617834848.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000027.00000000.18524745754.00007FF57FE5E000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE5E000
Size:	16384

Details

Name:	00000008.00000003.17713474898.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17632466468.00000000001A0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A0000
Size:	16384

Details

Name:	00000019.00000003.18239819729.000001CCFDE87000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE87000
Size:	122880

Details

Name:	00000001.00000002.17634687490.00000000022E0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	22E0000
Size:	8192

Details

Name:	00000019.00000003.18200673923.000001CCFDBF6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF6000
Size:	4096

Details

Name:	00000008.00000003.18512438578.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000023.00000003.18316647369.0000015B1B557000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B557000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18651415155.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	32768

Details

Name:	00000008.00000003.18522222692.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000019.00000002.21894480476.000001CCF85FD000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85FD000
Size:	12288

Details

Name:	0000002E.00000003.19927281425.000001681953B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953B000
Size:	131072

Details

Name:	00000029.00000003.18640631220.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	65536

Details

Name:	00000023.00000003.18326506118.0000015B1A705000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A705000
Size:	65536

Signature Hits	Behavior Group	Mitre Attack
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	0000002E.00000002.21759228641.0000016819111000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16819111000
Size:	12288

Details

Name:	0000002A.00000002.19961371214.00007FF579826000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579826000
Size:	8192

Details

Name:	0000002A.00000003.19950683504.000002650316F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650316F000
Size:	65536

Details

Name:	0000000F.00000002.18022248505.0000000001600000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1600000
Size:	40960

Details

Name:	00000019.00000002.21900683635.00007FF5DA479000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA479000
Size:	4096

Details

Name:	0000002A.00000003.19951010457.000002650316C000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650316C000
Size:	12288

Details

Name:	00000008.00000002.21901243745.000000001E0EA000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E0EA000
Size:	24576

Details

Name:	0000002A.00000003.19950604984.0000026503DA0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503DA0000
Size:	24576

Details

Name:	00000025.00000002.18523202097.00007FF5592DE000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592DE000
Size:	16384

Details

Name:	00000019.00000003.18209563304.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000019.00000003.18210760035.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000008.00000003.18550420312.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17683440456.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18227809909.000001CCFDE31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE31000
Size:	237568

Details

Name:	00000027.00000002.18542924770.00007FF57FDBE000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDBE000
Size:	12288

Details

Name:	00000008.00000003.17712814616.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000019.00000003.18137087880.000001CCFDA5E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA5E000
Size:	12288

Details

Name:	0000002D.00000000.19910279440.00007DF5144C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144C0000
Size:	4096

Details

Name:	00000008.00000003.18521776998.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002A.00000003.18684447739.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	262144

Details

Name:	00000025.00000003.18518848747.00000207277F7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F7000
Size:	36864

Details

Name:	00000008.00000003.18507173256.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000025.00000003.18515459283.000002072781E000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072781E000
Size:	192512

Details

Name:	00000008.00000003.18502941444.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000000F.00000000.18016243543.0000000000F52000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	F52000
Size:	45056

Details

Name:	00000025.00000002.18521284340.0000020726FB0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726FB0000
Size:	4096

Details

Name:	00000025.00000003.18519525934.00000207277D0000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D0000
Size:	8192

Details

Name:	00000019.00000003.18213113711.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000027.00000003.18538503712.0000016EE03A3000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03A3000
Size:	4096

Details

Name:	0000000D.00000002.17940940921.00000000006AE000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6AE000
Size:	8192

Details

Name:	0000002A.00000002.19961133538.00007FF57980A000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57980A000
Size:	12288

Details

Name:	00000023.00000003.18418805485.0000015B1B281000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B281000
Size:	65536

Details

Name:	00000023.00000003.18303365623.0000015B1C05E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C05E000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000018.00000002.21891839661.00007FF5BCB95000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCB95000
Size:	8192

Details

Name:	00000018.00000002.21886613132.00000030364FD000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	30364FD000
Size:	12288

Details

Name:	00000023.00000003.18417220631.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	40960

Details

Name:	00000019.00000003.18139768752.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.18532326372.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	36864

Details

Name:	00000018.00000002.21891689424.00007FF5BC9EE000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC9EE000
Size:	4096

Details

Name:	00000029.00000002.19968458803.00007FF560C52000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C52000
Size:	8192

Details

Name:	00000019.00000003.18183667061.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000002.21902476163.000000001E255000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E255000
Size:	4096

Details

Name:	00000019.00000002.21903388500.00007FF5DA78E000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA78E000
Size:	12288

Details

Name:	00000008.00000003.18505738487.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17992450292.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21762172668.00007FF5A2A78000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A78000
Size:	8192

Details

Name:	00000008.00000003.18553325750.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21896718510.000001CCFDA71000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA71000
Size:	4096

Details

Name:	00000008.00000003.18516204191.0000000001783000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1783000
Size:	53248

Details

Name:	00000008.00000003.18560442827.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	4096

Details

Name:	0000002A.00000003.18689829704.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	61440

Details

Name:	00000008.00000003.18531925632.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	28672

Details

Name:	00000008.00000003.17685812004.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21895939345.000001CCFD820000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD820000
Size:	20480

Details

Name:	00000022.00000003.18579486306.00000175342DB000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342DB000
Size:	4096

Details

Name:	0000002E.00000003.21755990773.0000016818CAC000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CAC000
Size:	20480

Details

Name:	0000002E.00000002.21760782329.00007DF5B9FB0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FB0000
Size:	4096

Details

Name:	00000023.00000003.18348974636.0000015B1AE5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5E000
Size:	4096

Details

Name:	00000008.00000000.17217477368.0000000001200000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1200000
Size:	118784

Details

Name:	00000008.00000003.17612227733.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002E.00000003.19931124420.0000016819AD0000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819AD0000
Size:	4096

Details

Name:	0000002E.00000002.21762329706.00007FF5A2A8E000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A8E000
Size:	4096

Details

Name:	00000019.00000002.21902940674.00007FF5DA73A000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA73A000
Size:	12288

Details

Name:	00000008.00000003.17685449059.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21889230172.00000205EE2B6000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE2B6000
Size:	16384

Details

Name:	00000008.00000003.18551348668.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17619863293.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	0000000F.00000003.18019814272.00000000058F0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	58F0000
Size:	24576

Details

Name:	00000019.00000002.21900545848.00007FF5DA471000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA471000
Size:	8192

Details

Name:	0000002A.00000003.18679618352.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	147456

Details

Name:	00000008.00000003.18558856068.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17941554661.0000000000A0F000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	A0F000
Size:	4096

Details

Name:	0000002A.00000003.18698430611.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	94208

Details

Name:	00000008.00000003.17620941989.0000000020790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20790000
Size:	20480

Details

Name:	00000019.00000000.18130095627.00007DF5F1C02000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C02000
Size:	4096

Details

Name:	00000019.00000003.18133545109.000001CCFD781000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD781000
Size:	4096

Details

Name:	00000008.00000003.18576050381.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18546538526.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	12288

Details

Name:	0000002E.00000003.19930408019.0000016819AB0000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819AB0000
Size:	4096

Details

Name:	00000008.00000003.18625071917.000000001DC20000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1DC20000
Size:	32768

Details

Name:	0000002E.00000002.21763067540.00007FF5A2ADF000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ADF000
Size:	8192

Details

Name:	00000029.00000003.18650482822.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	40960

Details

Name:	0000002E.00000002.21761541451.00007FF5A2965000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2965000
Size:	4096

Details

Name:	00000008.00000003.18550651503.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18648276040.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	32768

Details

Name:	00000023.00000003.18324175378.0000015B1BDD8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BDD8000
Size:	4096

Details

Name:	00000008.00000003.18554676802.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17634722113.0000000002300000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2300000
Size:	8192

Details

Name:	00000008.00000003.17715031472.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21891909093.00007FF5BCD9D000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCD9D000
Size:	4096

Details

Name:	0000002A.00000002.19962647068.00007FF5798BA000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798BA000
Size:	12288

Details

Name:	00000029.00000002.19967136222.000001D452570000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452570000
Size:	4096

Details

Name:	0000002E.00000003.21755737773.0000016819591000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819591000
Size:	4096

Details

Name:	00000008.00000003.18510334120.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	0000002E.00000003.21755251257.0000016819552000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819552000
Size:	8192

Details

Name:	00000023.00000003.18351474739.0000015B1BD12000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD12000
Size:	4096

Details

Name:	00000019.00000002.21893404868.000001CCF85A2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A2000
Size:	8192

Details

Name:	00000008.00000003.17691318291.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21125171300.00007FF4FD032000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD032000
Size:	8192

Details

Name:	0000002E.00000003.19928408706.0000016819576000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819576000
Size:	4096

Details

Name:	00000023.00000003.18317322207.0000015B1B5DB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B5DB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18131119569.000001CCFD6F0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD6F0000
Size:	253952

Details

Name:	00000019.00000003.18182263717.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000025.00000002.18521973871.00007DF46E5F0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF46E5F0000
Size:	20480

Details

Name:	00000008.00000003.18512509694.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000019.00000003.18224952234.000001CCFDE7F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE7F000
Size:	122880

Details

Name:	00000027.00000002.18543091097.00007FF57FDDF000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDDF000
Size:	8192

Details

Name:	00000008.00000003.18526875589.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	0000002A.00000003.18698915761.00000265030E4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030E4000
Size:	49152

Details

Name:	00000008.00000003.17614682497.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18552694356.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17715185993.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000002.18579982698.00000175340E0000.00000004.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	175340E0000
Size:	4096

Details

Name:	00000008.00000002.21900063783.000000001D2C0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1D2C0000
Size:	32768

Details

Name:	00000019.00000003.18185908167.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.18572966573.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	16384

Details

Name:	00000018.00000002.21893618008.00007FF5BD296000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD296000
Size:	8192

Details

Name:	00000027.00000003.18539955440.0000016EE0378000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0378000
Size:	8192

Details

Name:	00000025.00000002.18522867947.00007FF55927A000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF55927A000
Size:	12288

Details

Name:	00000019.00000002.21899733507.00007FF5DA018000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA018000
Size:	12288

Details

Name:	0000000F.00000002.18023967753.0000000003260000.00000040.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	3260000
Size:	8192

Details

Name:	00000019.00000003.18166078381.000001CCF8599000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8599000
Size:	32768

Details

Name:	00000023.00000003.18345751640.0000015B1C358000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C358000
Size:	266240

Details

Name:	0000002A.00000002.19959375966.00007FF578D6E000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578D6E000
Size:	12288

Details

Name:	00000008.00000003.17619471588.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	32768

Details

Name:	00000019.00000002.21899002238.00007FF5D9805000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9805000
Size:	4096

Details

Name:	00000029.00000003.18654593955.000001D4525EC000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EC000
Size:	28672

Details

Name:	00000019.00000002.21895890417.000001CCFD810000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD810000
Size:	8192

Details

Name:	00000008.00000003.17687987545.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18131871482.000001CCFD73B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD73B000
Size:	4096

Details

Name:	0000002E.00000003.21755212899.000001681957A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957A000
Size:	4096

Details

Name:	00000008.00000003.18557473955.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18516162821.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	8192

Details

Name:	00000023.00000003.18418771267.0000015B1A448000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A448000
Size:	8192

Details

Name:	00000008.00000003.18554999716.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000008.00000003.18519757381.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17642214102.000000007FFB2000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB2000
Size:	4096

Details

Name:	00000019.00000002.21888752156.000001CCF7C13000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C13000
Size:	90112

Details

Name:	00000023.00000003.18242312560.0000015B0B476000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B476000
Size:	610304

Details

Name:	00000008.00000003.18574629713.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000000.19910441753.00007FF4FD05E000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD05E000
Size:	16384

Details

Name:	00000018.00000002.21890740613.00007DF5D4770000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4770000
Size:	4096

Details

Name:	0000000F.00000002.18020873855.0000000000F70000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	F70000
Size:	4096

Details

Name:	0000002D.00000002.21125274835.00007FF4FD05A000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD05A000
Size:	8192

Details

Name:	00000008.00000003.18561139128.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18542309758.000000001D2B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2B0000
Size:	65536

Details

Name:	00000008.00000002.21888487316.000000000154A000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	154A000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000029.00000003.18654270498.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	32768

Details

Name:	00000019.00000003.18132786728.000001CCFD762000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD762000
Size:	4096

Details

Name:	00000023.00000003.18327662015.0000015B1B6C0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6C0000
Size:	135168

Details

Name:	00000019.00000003.18197834297.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000008.00000003.17682207529.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	184320

Details

Name:	00000008.00000003.17693614472.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	16384

Details

Name:	0000002A.00000002.19960834960.00007FF5797C9000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797C9000
Size:	53248

Details

Name:	00000019.00000003.18136604509.000001CCFDA46000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA46000
Size:	73728

Details

Name:	00000019.00000002.21895083232.000001CCF9140000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9140000
Size:	65536

Details

Name:	0000002A.00000002.19962886348.00007FF5798DA000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798DA000
Size:	8192

Details

Name:	00000008.00000003.18558924270.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18629908962.000001D4525E9000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E9000
Size:	176128

Details

Name:	00000019.00000002.21902007479.00007FF5DA6FE000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6FE000
Size:	12288

Details

Name:	00000008.00000003.18513562280.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18134150010.000001CCFD734000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD734000
Size:	4096

Details

Name:	00000019.00000003.18212064364.000001CCFDE10000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE10000
Size:	73728

Details

Name:	0000002E.00000003.20226830113.0000016818C99000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C99000
Size:	4096

Details

Name:	00000019.00000002.21887356631.00000052718FE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52718FE000
Size:	8192

Details

Name:	0000002E.00000002.21762411224.00007FF5A2A9E000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A9E000
Size:	4096

Details

Name:	0000000D.00000002.17940097963.000000000010E000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	10E000
Size:	4096

Details

Name:	0000002E.00000002.21761786101.00007FF5A2994000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2994000
Size:	4096

Details

Name:	00000008.00000003.18576605608.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18677696675.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	258048

Details

Name:	00000008.00000003.18576347238.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21900969606.000000001DCAE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DCAE000
Size:	8192

Details

Name:	00000019.00000003.18197918607.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000002.21912003917.000000002070E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2070E000
Size:	8192

Details

Name:	00000008.00000003.17713929083.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000003.18514085323.00000207277EA000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277EA000
Size:	405504

Details

Name:	00000023.00000000.18220664914.00007DF5B95E0000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B95E0000
Size:	4096

Details

Name:	00000023.00000003.18259811456.0000015B0C516000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C516000
Size:	405504

Details

Name:	0000002E.00000002.21756434467.00000039AF8FF000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AF8FF000
Size:	4096

Details

Name:	0000002A.00000002.19959569759.00007FF578F9F000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578F9F000
Size:	4096

Details

Name:	00000008.00000003.18531986766.000000001D248000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D248000
Size:	32768

Details

Name:	00000019.00000003.18140324169.000001CCFD980000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD980000
Size:	4096

Details

Name:	00000008.00000003.17619615556.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000023.00000003.18342515456.0000015B1A60C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A60C000
Size:	266240

Details

Name:	00000008.00000002.21901786233.000000001E224000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E224000
Size:	8192

Details

Name:	00000008.00000003.18515376468.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21901385168.00007FF5DA6CA000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6CA000
Size:	12288

Details

Name:	00000025.00000003.18517266463.00000207272DA000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272DA000
Size:	20480

Details

Name:	00000008.00000003.18515822687.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000008.00000003.17616769005.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000018.00000000.18127550986.00007DF5D4772000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4772000
Size:	4096

Details

Name:	00000008.00000003.17714472307.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18555331377.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	4096

Details

Name:	00000019.00000002.21902152551.00007FF5DA704000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA704000
Size:	24576

Details

Name:	00000008.00000003.18543844366.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.17684640130.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18290582002.0000015B1BF65000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF65000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18133793095.000001CCFD78D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD78D000
Size:	4096

Details

Name:	00000008.00000003.18561671843.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21123793510.000002779C540000.00000004.00000040.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2779C540000
Size:	4096

Details

Name:	0000002A.00000002.19964058986.00007FF650D9C000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650D9C000
Size:	28672

Details

Name:	00000008.00000002.21899553866.000000001D260000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1D260000
Size:	65536

Details

Name:	00000008.00000003.18574100388.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18553593656.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17613073902.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	00000027.00000002.18541388895.0000016EDFA10000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFA10000
Size:	4096

Details

Name:	00000008.00000002.21905483140.000000001E588000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E588000
Size:	8192

Details

Name:	00000008.00000003.18624454480.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	28672

Details

Name:	0000002A.00000002.19955608062.000002650308D000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2650308D000
Size:	69632

Details

Name:	00000008.00000003.18501174557.000000001D1C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1C0000
Size:	65536

Details

Name:	0000002E.00000003.21752008052.0000016818CB4000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB4000
Size:	16384

Details

Name:	00000019.00000002.21902647517.00007FF5DA722000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA722000
Size:	40960

Details

Name:	00000023.00000003.18230968329.0000015B0AA70000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0AA70000
Size:	8192

Details

Name:	0000000D.00000002.17942547579.00000000035D1000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	35D1000
Size:	8192

Details

Name:	00000008.00000003.18522796823.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	36864

Details

Name:	00000023.00000003.18330602885.0000015B1B5DA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B5DA000
Size:	4096

Details

Name:	00000001.00000002.17634325566.0000000002210000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2210000
Size:	16384

Details

Name:	0000000F.00000002.18021222741.0000000000FFC000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	FFC000
Size:	16384

Details

Name:	00000008.00000003.18623893206.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	16384

Details

Name:	00000008.00000003.18553825698.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18167279251.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	20480

Details

Name:	00000008.00000003.18529632509.000000001D241000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D241000
Size:	61440

Details

Name:	00000008.00000003.18504744028.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18653031925.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	65536

Details

Name:	0000002E.00000002.21759469531.0000016819400000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819400000
Size:	4096

Details

Name:	0000002E.00000003.21752231147.0000016818C28000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C28000
Size:	4096

Details

Name:	00000008.00000003.18528590320.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000029.00000003.18652512704.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	32768

Details

Name:	00000029.00000003.18660288434.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	57344

Details

Name:	0000000F.00000002.18021616571.000000000148E000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	148E000
Size:	8192

Details

Name:	00000025.00000003.18517482420.000002072782A000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072782A000
Size:	135168

Details

Name:	0000002A.00000003.19950542808.0000026503D95000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503D95000
Size:	4096

Details

Name:	00000019.00000002.21886528712.0000005270CFA000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5270CFA000
Size:	24576

Details

Name:	00000008.00000003.17716916923.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18521662014.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21901036692.00007FF5DA5EF000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA5EF000
Size:	8192

Details

Name:	0000002E.00000003.19939763843.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	16384

Details

Name:	00000019.00000003.18240151733.000001CCFDAA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAA6000
Size:	53248

Details

Name:	00000019.00000002.21901504981.00007FF5DA6D6000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6D6000
Size:	4096

Details

Name:	00000008.00000002.21900010436.000000001D2B0000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1D2B0000
Size:	8192

Details

Name:	00000022.00000002.18580313230.0000017534220000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	17534220000
Size:	8192

Details

Name:	0000002E.00000003.21754849052.000001681950C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950C000
Size:	24576

Details

Name:	0000002E.00000002.21761450007.00007FF5A2837000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2837000
Size:	4096

Details

Name:	00000008.00000003.17612286282.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.18577373169.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18021933657.00000000015D0000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	15D0000
Size:	4096

Details

Name:	00000027.00000003.18538453790.0000016EE0373000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0373000
Size:	16384

Details

Name:	0000002A.00000003.18683893002.0000026503104000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503104000
Size:	180224

Details

Name:	00000018.00000002.21891377411.00007FF5BC968000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC968000
Size:	28672

Details

Name:	00000023.00000003.18312817586.0000015B1AD98000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD98000
Size:	4096

Details

Name:	00000008.00000003.18528429179.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	8192

Details

Name:	00000023.00000003.18343267506.0000015B1AC0C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC0C000
Size:	143360

Details

Name:	00000023.00000000.18220614806.00007DF5B95D0000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B95D0000
Size:	4096

Details

Name:	00000019.00000003.18213936000.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	0000000F.00000002.18021379730.0000000001050000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1050000
Size:	4096

Details

Name:	0000002A.00000003.18679127427.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	00000008.00000003.18501928928.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000029.00000003.18630967674.000001D4525D6000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D6000
Size:	262144

Details

Name:	00000023.00000003.18418366334.0000015B1B291000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B291000
Size:	65536

Details

Name:	00000019.00000003.18153173495.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	0000002A.00000003.18699547599.0000026503108000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503108000
Size:	4096

Details

Name:	00000018.00000002.21892793071.00007FF5BD1FF000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD1FF000
Size:	32768

Details

Name:	00000008.00000003.18558733458.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17717326650.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.17687784910.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18199698406.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	24576

Details

Name:	00000023.00000003.18312179621.0000015B1C06C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C06C000
Size:	151552

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery

Details

Name:	00000008.00000003.18544017954.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	16384

Details

Name:	00000008.00000003.18544201512.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	65536

Details

Name:	00000008.00000003.18510751059.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18133700317.000001CCFD789000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD789000
Size:	4096

Details

Name:	00000029.00000003.18663174484.000001D4525F3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525F3000
Size:	65536

Details

Name:	0000002A.00000003.18699280374.0000026503108000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503108000
Size:	4096

Details

Name:	0000002E.00000003.19940528323.0000016818D2B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818D2B000
Size:	12288

Details

Name:	00000008.00000003.17692120311.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21894178773.00007FF5BD2C1000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2C1000
Size:	4096

Details

Name:	00000008.00000003.18572609271.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000027.00000003.18537779309.0000016EE03B9000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03B9000
Size:	147456

Details

Name:	00000023.00000003.18330938423.0000015B1AA81000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AA81000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000002.21888213793.0000000001520000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1520000
Size:	4096

Details

Name:	00000022.00000000.18191017358.00007FF758881000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF758881000
Size:	10485760

Details

Name:	00000019.00000002.21888920468.000001CCF7C2A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C2A000
Size:	77824

Details

Name:	00000025.00000002.18521873967.0000020727330000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	20727330000
Size:	12288

Details

Name:	00000008.00000003.17620491426.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000023.00000003.18348276800.0000015B1BF64000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BF64000
Size:	4096

Details

Name:	0000002E.00000002.21763548715.00007FF5A2B4E000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B4E000
Size:	12288

Details

Name:	00000029.00000003.19965562048.000001D4525D0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D0000
Size:	131072

Details

Name:	00000008.00000003.17716008732.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18558230520.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17940969242.00000000006B0000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6B0000
Size:	8192

Details

Name:	00000023.00000003.18338690411.0000015B1A7CB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A7CB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18587484920.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18530848643.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	20480

Details

Name:	00000008.00000002.21904770887.000000001E4FC000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E4FC000
Size:	12288

Details

Name:	00000029.00000003.18640335831.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	32768

Details

Name:	0000002A.00000003.19924224071.0000026503131000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503131000
Size:	4096

Details

Name:	00000008.00000003.18556591702.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	45056

Details

Name:	00000008.00000002.21910969327.0000000020510000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20510000
Size:	16384

Details

Name:	00000019.00000003.18151940853.000001CCF8582000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8582000
Size:	32768

Details

Name:	00000008.00000003.18553929309.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18332853360.0000015B1C0F0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C0F0000
Size:	4096

Details

Name:	00000019.00000003.18441243034.000001CCF8526000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8526000
Size:	28672

Details

Name:	0000002A.00000003.19953650359.000002650313F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313F000
Size:	8192

Details

Name:	00000008.00000003.18507397857.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.18578909119.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21899512950.00007FF5D9D94000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9D94000
Size:	4096

Details

Name:	00000018.00000002.21888052316.00000205EE22A000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE22A000
Size:	86016

Details

Name:	0000000F.00000000.18016793172.000000007F910000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F910000
Size:	4096

Details

Name:	00000027.00000003.18538839019.0000016EE03AE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03AE000
Size:	16384

Details

Name:	00000027.00000003.18540870322.0000016EDFE5A000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE5A000
Size:	4096

Details

Name:	00000023.00000003.18299991338.0000015B1C3DD000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C3DD000
Size:	81920

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17618737161.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000023.00000003.18301864575.0000015B1AEA0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEA0000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000002A.00000002.19957146225.0000026503180000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503180000
Size:	8192

Details

Name:	00000018.00000000.18127672449.00007DF5D4782000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4782000
Size:	4096

Details

Name:	00000008.00000002.21899248466.000000001D244000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D244000
Size:	49152

Details

Name:	0000002A.00000002.19960593327.00007FF57979C000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57979C000
Size:	8192

Details

Name:	00000008.00000003.18520700130.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000002.21887806960.000000000139C000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	139C000
Size:	4096

Details

Name:	00000008.00000003.18504477511.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000008.00000003.18504104963.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	0000000F.00000002.18022857240.000000000196F000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	196F000
Size:	4096

Details

Name:	00000008.00000003.18627130440.00000000209D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	209D0000
Size:	12288

Details

Name:	00000008.00000003.17616140570.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17682547544.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18538759262.0000016EE0364000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0364000
Size:	20480

Details

Name:	0000000F.00000002.18021309865.0000000001041000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1041000
Size:	4096

Details

Name:	00000008.00000003.18506371018.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17693429507.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18134322673.000001CCFD7C0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD7C0000
Size:	4096

Details

Name:	00000008.00000002.21889413130.00000000015BA000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15BA000
Size:	4096

Details

Name:	0000002D.00000003.19910945494.000002779C700000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C700000
Size:	4096

Details

Name:	00000019.00000003.18196888618.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	0000002A.00000002.19954604838.000000BD26078000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD26078000
Size:	32768

Details

Name:	00000008.00000003.18514011660.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21895365582.000001CCF9240000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF9240000
Size:	4096

Details

Name:	00000022.00000003.18211877942.00000175342F1000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F1000
Size:	258048

Details

Name:	0000000D.00000002.17941206960.0000000000730000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	730000
Size:	24576

Details

Name:	00000008.00000003.18577061532.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17633472099.0000000000473000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	473000
Size:	135168

Details

Name:	0000002E.00000003.19940387524.000001681955A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681955A000
Size:	12288

Details

Name:	00000022.00000002.18581219573.00007FF52FCDB000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FCDB000
Size:	20480

Details

Name:	00000019.00000003.18181323734.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	0000002D.00000002.21124344813.00007FF4FCE6F000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCE6F000
Size:	8192

Details

Name:	00000008.00000003.18503958883.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	65536

Details

Name:	00000008.00000003.17695444292.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18543407251.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	28672

Details

Name:	00000008.00000003.18518688381.0000000001784000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1784000
Size:	49152

Details

Name:	00000008.00000002.21901346474.000000001E1E7000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E1E7000
Size:	36864

Details

Name:	00000023.00000003.18346827221.0000015B1B1B9000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B1B9000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000002.21902577220.00007FF5DA71F000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA71F000
Size:	8192

Details

Name:	00000008.00000003.18531438724.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.18512643062.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18557298441.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000000.18610729104.00007FF6836BE000.00000008.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF6836BE000
Size:	4096

Details

Name:	00000025.00000000.18505364958.00007DF570732000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570732000
Size:	4096

Details

Name:	00000029.00000003.18633602934.000001D4525D7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D7000
Size:	258048

Details

Name:	00000023.00000003.18308349219.0000015B1B8F2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8F2000
Size:	266240

Details

Name:	00000008.00000003.18502572460.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000022.00000002.18580059308.0000017534100000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	17534100000
Size:	118784

Details

Name:	00000023.00000003.18284187667.0000015B1A88D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A88D000
Size:	4096

Details

Name:	00000008.00000003.17713735878.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18545271673.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18550216707.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17613664650.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	49152

Details

Name:	0000000F.00000002.18024139366.0000000003280000.00000040.00000040.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	3280000
Size:	4096

Details

Name:	0000002D.00000002.21123877923.000002779C602000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C602000
Size:	20480

Details

Name:	00000008.00000003.18511894910.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18511602945.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18554027096.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18284523151.0000015B1B976000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B976000
Size:	12288

Details

Name:	0000000D.00000002.17941665983.0000000000B54000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B54000
Size:	4096

Details

Name:	0000002A.00000002.19954829112.000000BD2627F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD2627F000
Size:	4096

Details

Name:	00000008.00000003.17685075165.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18520772329.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000008.00000003.18502803788.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	0000002E.00000002.21756482823.00000039AFA7E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AFA7E000
Size:	8192

Details

Name:	00000008.00000003.17616807217.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	16384

Details

Name:	0000000F.00000002.18021507507.0000000001310000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1310000
Size:	4096

Details

Name:	0000002D.00000002.21123500394.000002779C422000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C422000
Size:	28672

Details

Name:	00000008.00000003.17717838972.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000000D.00000002.17940706016.00000000005D0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	5D0000
Size:	4096

Details

Name:	00000008.00000003.18519706454.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000001.00000002.17632043449.0000000000020000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20000
Size:	4096

Details

Name:	00000019.00000002.21887160233.00000052714FE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52714FE000
Size:	8192

Details

Name:	0000002E.00000003.21752094072.0000016818CB3000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB3000
Size:	4096

Details

Name:	00000019.00000003.18166608118.000001CCF8594000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8594000
Size:	53248

Details

Name:	00000018.00000002.21888325124.00000205EE240000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE240000
Size:	90112

Details

Name:	00000019.00000002.21887619578.000001CCF79E0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF79E0000
Size:	4096

Details

Name:	00000022.00000002.18579888586.00000040D775C000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	40D775C000
Size:	16384

Details

Name:	00000008.00000003.18516546722.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17715950136.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18292431996.0000015B1BA3D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BA3D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18133949241.000001CCFD840000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD840000
Size:	4096

Details

Name:	00000008.00000003.17689100552.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000003.18428276588.00000205EE28A000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE28A000
Size:	65536

Details

Name:	0000002A.00000002.19955521657.0000026503080000.00000004.00000020.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	26503080000
Size:	49152

Details

Name:	00000023.00000003.18321924399.0000015B1B06E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B06E000
Size:	266240

Details

Name:	00000022.00000002.18580022687.00000175340F0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	175340F0000
Size:	4096

Details

Name:	00000008.00000003.18522983048.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17620070134.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000019.00000003.18234805811.000001CCFDE3A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE3A000
Size:	12288

Details

Name:	00000027.00000003.18539198244.0000016EE0376000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0376000
Size:	4096

Details

Name:	00000008.00000003.18560093661.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000019.00000003.18132267949.000001CCFD74D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD74D000
Size:	4096

Details

Name:	00000008.00000003.18556258175.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	12288

Details

Name:	00000008.00000003.18542980438.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	65536

Details

Name:	00000008.00000003.18554459034.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000027.00000002.18542828506.00007FF57FD37000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FD37000
Size:	4096

Details

Name:	00000023.00000003.18314518681.0000015B1B7A8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B7A8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002E.00000002.21761357515.00007FF5A27DC000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A27DC000
Size:	4096

Details

Name:	00000027.00000002.18543397662.00007FF57FE24000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE24000
Size:	8192

Details

Name:	00000029.00000003.18650026528.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	57344

Details

Name:	0000002A.00000002.19962940686.00007FF5798DE000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798DE000
Size:	16384

Details

Name:	0000002A.00000003.19942427696.000002650314E000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650314E000
Size:	4096

Details

Name:	00000023.00000003.18340677055.0000015B1BB86000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB86000
Size:	4096

Details

Name:	00000027.00000003.18538594955.0000016EDFE55000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE55000
Size:	12288

Details

Name:	00000025.00000002.18523075788.00007FF5592B2000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592B2000
Size:	8192

Details

Name:	00000018.00000002.21889561737.00000205EE302000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE302000
Size:	32768

Details

Name:	00000025.00000002.18522145697.00007DF570742000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570742000
Size:	4096

Details

Name:	00000008.00000003.18575374760.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21763023533.00007FF5A2ADC000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ADC000
Size:	4096

Details

Name:	00000008.00000003.18525822541.000000001D230000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D230000
Size:	40960

Details

Name:	00000019.00000002.21894405646.000001CCF85F2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85F2000
Size:	8192

Details

Name:	00000001.00000002.17632871159.0000000000401000.00000020.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page execute read
Base address:	401000
Size:	86016

Details

Name:	00000008.00000003.17693749973.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	0000002E.00000003.19928982743.000001681957C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681957C000
Size:	4096

Details

Name:	0000000D.00000002.17941786860.0000000000B70000.00000004.00000040.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	B70000
Size:	8192

Details

Name:	00000008.00000003.18502757577.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000025.00000000.18504784503.0000020726E90000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726E90000
Size:	118784

Details

Name:	00000008.00000003.18512350245.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	0000002A.00000003.19952572696.0000026503142000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503142000
Size:	4096

Details

Name:	00000008.00000003.18526822595.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000025.00000003.18518259904.00000207277E6000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E6000
Size:	4096

Details

Name:	00000008.00000003.18575222233.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18504210194.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000023.00000003.18276908463.0000015B08179000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08179000
Size:	65536

Details

Name:	00000019.00000003.18152917671.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000019.00000002.21890920259.000001CCF7D15000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7D15000
Size:	8192

Details

Name:	00000027.00000003.18540517256.0000016EE0357000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0357000
Size:	28672

Details

Name:	00000008.00000003.17615609036.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18548536224.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	20480

Details

Name:	00000008.00000003.18559363760.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18519624108.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21891455547.00007FF5BC970000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BC970000
Size:	36864

Details

Name:	00000008.00000002.21886472617.0000000001200000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1200000
Size:	118784

Details

Name:	00000008.00000003.18524834148.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	53248

Details

Name:	00000019.00000003.18140269156.000001CCFD980000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD980000
Size:	4096

Details

Name:	00000008.00000003.17686108384.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18530075562.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	0000002A.00000003.19952615290.000002650314A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650314A000
Size:	16384

Details

Name:	00000008.00000003.17685573396.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18644389068.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	61440

Details

Name:	0000002E.00000002.21759287062.0000016819120000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16819120000
Size:	16384

Details

Name:	0000002E.00000002.21759560913.0000016819415000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819415000
Size:	8192

Details

Name:	0000002A.00000002.19960178415.00007FF579677000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579677000
Size:	8192

Details

Name:	00000001.00000002.17634978616.0000000002BE0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2BE0000
Size:	925696

Details

Name:	00000008.00000003.18018408642.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757227275.0000016818C13000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C13000
Size:	28672

Details

Name:	0000002E.00000003.19929965520.0000016819529000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819529000
Size:	20480

Details

Name:	00000008.00000003.18512771682.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18523986698.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	20480

Details

Name:	00000008.00000003.17611017965.000000000161D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	161D000
Size:	16384

Details

Name:	00000008.00000003.18525340953.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	8192

Details

Name:	00000008.00000003.17619050205.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	4096

Details

Name:	00000027.00000003.18540442046.0000016EDFE57000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE57000
Size:	8192

Details

Name:	00000019.00000003.18239373375.000001CCFDE6C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE6C000
Size:	233472

Details

Name:	0000002A.00000002.19962153065.00007FF57985F000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57985F000
Size:	8192

Details

Name:	00000027.00000002.18541291131.0000002CB7AFE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB7AFE000
Size:	8192

Details

Name:	00000008.00000002.21911059056.0000000020518000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20518000
Size:	266240

Details

Name:	00000019.00000002.21896995694.000001CCFDB13000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB13000
Size:	126976

Details

Name:	0000002E.00000003.19930623038.0000016818CCF000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CCF000
Size:	12288

Details

Name:	00000008.00000003.18525509586.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	49152

Details

Name:	0000002A.00000003.18690925784.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000008.00000003.17612915513.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	0000002E.00000002.21756374850.00000039AF56B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AF56B000
Size:	20480

Details

Name:	00000029.00000003.18641347397.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	57344

Details

Name:	0000002A.00000003.19923978712.0000026503131000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503131000
Size:	4096

Details

Name:	0000002A.00000003.18698268752.0000026503126000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503126000
Size:	69632

Details

Name:	00000008.00000003.18572819538.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	12288

Details

Name:	00000008.00000002.21911521733.00000000205B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205B1000
Size:	245760

Details

Name:	00000022.00000002.18580665785.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	00000019.00000003.18197992753.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	0000002A.00000002.19956662391.0000026503142000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503142000
Size:	4096

Details

Name:	00000008.00000003.17686039684.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18549224156.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	65536

Details

Name:	00000019.00000003.18211802979.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	24576

Details

Name:	00000019.00000003.18168001236.000001CCF85A3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A3000
Size:	24576

Details

Name:	0000002E.00000000.19926189207.00007DF5B9FB2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FB2000
Size:	4096

Details

Name:	00000019.00000003.18197537912.000001CCFDE4E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE4E000
Size:	237568

Details

Name:	0000002A.00000002.19962434575.00007FF579881000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579881000
Size:	4096

Details

Name:	00000019.00000003.18197430870.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000019.00000002.21887438753.0000005271AFA000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5271AFA000
Size:	24576

Details

Name:	00000029.00000003.18646105179.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	73728

Details

Name:	00000008.00000003.17687719140.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19952522732.000002650313F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650313F000
Size:	8192

Details

Name:	00000008.00000003.18515660946.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.21755476145.000001681954B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681954B000
Size:	8192

Details

Name:	0000000D.00000000.17935701405.0000000000100000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	100000
Size:	4096

Details

Name:	00000027.00000002.18542530104.00007DF5972B2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972B2000
Size:	4096

Details

Name:	0000002E.00000003.19929097082.000001681952B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952B000
Size:	4096

Details

Name:	00000008.00000003.17619376593.0000000020778000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20778000
Size:	20480

Details

Name:	00000018.00000002.21892502998.00007FF5BD164000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD164000
Size:	4096

Details

Name:	00000029.00000002.19968372586.00007FF560C44000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C44000
Size:	8192

Details

Name:	00000025.00000002.18523029449.00007FF5592A7000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592A7000
Size:	4096

Details

Name:	0000002A.00000002.19956977793.0000026503172000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503172000
Size:	8192

Details

Name:	0000002A.00000003.18692381817.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000027.00000002.18542564255.00007DF5972C0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972C0000
Size:	4096

Details

Name:	0000002D.00000003.19912423147.000002779C700000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C700000
Size:	4096

Details

Name:	0000002A.00000002.19960094615.00007FF5795B7000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5795B7000
Size:	4096

Details

Name:	0000002E.00000002.21759090193.0000016818ED0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818ED0000
Size:	4096

Details

Name:	00000023.00000003.18269374494.0000015B08169000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08169000
Size:	65536

Details

Name:	00000019.00000002.21898368436.000001CCFDBFB000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBFB000
Size:	8192

Details

Name:	00000008.00000003.18578634010.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18699401767.00000265030E5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030E5000
Size:	12288

Details

Name:	0000002E.00000002.21759516816.0000016819402000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819402000
Size:	4096

Details

Name:	00000008.00000003.18541870538.000000001D2E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2E0000
Size:	65536

Details

Name:	00000008.00000003.18524923157.000000000179E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	179E000
Size:	8192

Details

Name:	0000002D.00000002.21124387982.00007FF4FCE93000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCE93000
Size:	8192

Details

Name:	00000023.00000003.18340030081.0000015B1AB4D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB4D000
Size:	237568

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18554607787.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	24576

Details

Name:	00000023.00000003.18429740183.0000015B1B2C1000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B2C1000
Size:	270336

Signature Hits	Behavior Group	Mitre Attack
Deletes shadow drive data (may be related to ransomware)	Spam, unwanted Advertisements and Ransom Demands	File Deletion
May infect USB drives	Spreading	Replication Through Removable Media
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000002.19962814712.00007FF5798D4000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798D4000
Size:	20480

Details

Name:	00000008.00000003.17618609076.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.18529369170.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000019.00000003.18166507275.000001CCFDBE7000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBE7000
Size:	45056

Details

Name:	00000008.00000003.17615244588.000000001E318000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E318000
Size:	20480

Details

Name:	0000002E.00000002.21758876877.0000016818D02000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818D02000
Size:	8192

Details

Name:	00000019.00000002.21886271506.0000005270A7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5270A7B000
Size:	20480

Details

Name:	00000008.00000003.17688104769.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18302736140.0000015B1BFD5000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFD5000
Size:	73728

Details

Name:	0000002D.00000002.21123577040.000002779C42A000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C42A000
Size:	40960

Details

Name:	00000023.00000003.18287221841.0000015B08169000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08169000
Size:	81920

Details

Name:	0000002E.00000003.21752978244.0000016819538000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819538000
Size:	8192

Details

Name:	00000008.00000003.18557174587.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17686486308.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757069525.0000016818BF0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818BF0000
Size:	4096

Details

Name:	00000008.00000003.17715670385.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761213039.00007FF5A25DB000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A25DB000
Size:	4096

Details

Name:	00000023.00000000.18221512570.00007FF791CE7000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF791CE7000
Size:	139264

Details

Name:	00000008.00000003.18554785833.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	57344

Details

Name:	00000008.00000003.17614745848.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000019.00000003.18172625632.000001CCFDE43000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE43000
Size:	106496

Details

Name:	00000008.00000003.18511147349.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002A.00000001.18668327259.00007FF650CE0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650CE0000
Size:	4096

Details

Name:	00000023.00000003.18349641444.0000015B1A9DA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A9DA000
Size:	4096

Details

Name:	0000002D.00000002.21124244623.00007DF5144D0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144D0000
Size:	12288

Details

Name:	00000019.00000002.21896448609.000001CCFDA43000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA43000
Size:	12288

Details

Name:	00000019.00000002.21900794099.00007FF5DA5AF000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA5AF000
Size:	8192

Details

Name:	00000025.00000003.18518291869.00000207277E8000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E8000
Size:	8192

Details

Name:	00000023.00000003.18268911421.0000015B08199000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08199000
Size:	45056

Details

Name:	0000000D.00000002.17939968999.0000000000100000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	100000
Size:	4096

Details

Name:	00000029.00000003.18648128468.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	65536

Details

Name:	00000023.00000003.18305947537.0000015B1C3DC000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C3DC000
Size:	4096

Details

Name:	00000019.00000000.18130036741.00007DF5F1C00000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C00000
Size:	4096

Details

Name:	00000008.00000003.18561001860.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18502154221.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18504315725.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	0000002A.00000002.19959799695.00007FF57935B000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57935B000
Size:	4096

Details

Name:	0000000F.00000002.18024199487.00000000033B0000.00000004.00000040.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	33B0000
Size:	4096

Details

Name:	0000000F.00000002.18024615303.000000007F912000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F912000
Size:	4096

Details

Name:	00000008.00000003.17713665378.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000003.19912551083.000002779C702000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C702000
Size:	16384

Details

Name:	00000001.00000000.16840006501.000000007FFC0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC0000
Size:	4096

Details

Name:	00000008.00000003.18574740510.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761405018.00007FF5A2831000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2831000
Size:	8192

Details

Name:	0000002E.00000003.21752646404.0000016819572000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819572000
Size:	20480

Details

Name:	00000008.00000000.17218469177.000000007FA72000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA72000
Size:	4096

Details

Name:	00000008.00000003.18521278918.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000029.00000003.18648978531.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	65536

Details

Name:	00000008.00000003.18507118438.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000023.00000003.18322610510.0000015B1A546000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A546000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected RemCom RemoteAdmin tool	Remote Access Functionality
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18209859898.000001CCFDE52000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE52000
Size:	237568

Details

Name:	00000008.00000003.18507549134.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	65536

Details

Name:	00000019.00000002.21887093551.00000052713FE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52713FE000
Size:	8192

Details

Name:	00000025.00000003.18516991083.00000207277D9000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277D9000
Size:	4096

Details

Name:	00000023.00000003.18347136325.0000015B1B1FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B1FA000
Size:	4096

Details

Name:	00000023.00000003.18330778639.0000015B1B6C0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6C0000
Size:	135168

Details

Name:	00000008.00000003.18509198585.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	36864

Details

Name:	0000002E.00000002.21762122913.00007FF5A2A5D000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A5D000
Size:	8192

Details

Name:	0000002E.00000002.21758058587.0000016818C8D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C8D000
Size:	8192

Details

Name:	00000001.00000001.16840131113.0000000000400000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000019.00000003.18226905071.000001CCFDE42000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE42000
Size:	94208

Details

Name:	0000002A.00000002.19955474827.0000026503051000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26503051000
Size:	12288

Details

Name:	00000008.00000003.18560264321.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000008.00000003.17611919282.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000019.00000002.21899632739.00007FF5D9FD5000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9FD5000
Size:	8192

Details

Name:	00000008.00000003.18545366575.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	40960

Details

Name:	00000029.00000003.18647336304.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	32768

Details

Name:	00000019.00000003.18199608950.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000001.00000002.17634628476.0000000002290000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2290000
Size:	4096

Details

Name:	00000008.00000003.18523181919.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17685139745.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21888722927.00000205EE266000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE266000
Size:	16384

Details

Name:	0000002E.00000003.21751713971.0000016818CB8000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CB8000
Size:	73728

Details

Name:	00000018.00000002.21886809660.00000205EE090000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE090000
Size:	118784

Details

Name:	00000008.00000003.18515889339.000000001D1C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1C0000
Size:	16384

Details

Name:	00000025.00000002.18520904224.0000020726E80000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726E80000
Size:	4096

Details

Name:	00000029.00000003.18638737298.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	28672

Details

Name:	00000001.00000002.17631990224.0000000000010000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	10000
Size:	4096

Details

Name:	00000008.00000002.21914708610.00000000218DD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	218DD000
Size:	12288

Details

Name:	00000025.00000003.18520250764.00000207272D7000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D7000
Size:	8192

Details

Name:	00000019.00000003.18199569709.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000001.00000002.17634657037.00000000022D0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	22D0000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	0000002D.00000002.21123089849.000002779C350000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C350000
Size:	4096

Details

Name:	00000008.00000003.18558795006.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000000.18610194015.00007DF5780E2000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780E2000
Size:	4096

Details

Name:	00000008.00000002.21888327150.0000000001540000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1540000
Size:	36864

Details

Name:	00000019.00000002.21902348735.00007FF5DA716000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA716000
Size:	8192

Details

Name:	00000008.00000002.21889565912.00000000015BF000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15BF000
Size:	356352

Details

Name:	00000027.00000003.18540237194.0000016EE0363000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0363000
Size:	4096

Details

Name:	00000018.00000002.21886745476.00000205EE080000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE080000
Size:	4096

Details

Name:	00000008.00000003.17691601651.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000002.18521772360.0000020727100000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20727100000
Size:	8192

Details

Name:	00000019.00000002.21898262553.000001CCFDBF2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF2000
Size:	20480

Details

Name:	00000023.00000003.18310333819.0000015B1B44E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B44E000
Size:	4096

Details

Name:	00000008.00000002.21903960191.000000001E460000.00000040.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	1E460000
Size:	4096

Details

Name:	00000018.00000002.21886683203.00000205EE070000.00000004.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	205EE070000
Size:	4096

Details

Name:	00000018.00000000.18127241262.00000205EE090000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE090000
Size:	118784

Details

Name:	00000008.00000002.21903417618.000000001E42E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E42E000
Size:	8192

Details

Name:	0000002E.00000003.21751277632.0000016818C51000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C51000
Size:	53248

Details

Name:	00000019.00000003.18167659014.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000022.00000002.18580878484.00007DF5471C2000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471C2000
Size:	4096

Details

Name:	00000019.00000003.18226826801.000001CCFDE31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE31000
Size:	36864

Details

Name:	00000008.00000003.17696858357.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17714406852.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17620554159.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000002.21904654414.000000001E4E9000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E4E9000
Size:	65536

Details

Name:	00000008.00000002.21912848996.0000000020780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20780000
Size:	65536

Details

Name:	00000008.00000003.17809461213.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959059388.00007DF590D30000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D30000
Size:	4096

Details

Name:	0000002A.00000002.19955090886.0000026502EE0000.00000004.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	26502EE0000
Size:	4096

Details

Name:	00000008.00000002.21901200982.000000001E09F000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E09F000
Size:	4096

Details

Name:	0000002E.00000003.19929672830.000001681952E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952E000
Size:	4096

Details

Name:	00000027.00000002.18543301387.00007FF57FDFA000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDFA000
Size:	12288

Details

Name:	00000008.00000003.18525382512.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000008.00000002.21892235847.0000000001BA1000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1BA1000
Size:	364544

Signature Hits	Behavior Group	Mitre Attack
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery

Details

Name:	00000029.00000003.18619732129.000001D452590000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D452590000
Size:	65536

Details

Name:	00000008.00000002.21889476958.00000000015BC000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15BC000
Size:	8192

Details

Name:	00000029.00000003.18652077418.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	53248

Details

Name:	0000002A.00000000.18667217039.00007FF650CE0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650CE0000
Size:	4096

Details

Name:	00000008.00000003.18511825339.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.18505456420.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18238337022.000001CCFDE6C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE6C000
Size:	233472

Details

Name:	00000023.00000003.18286860697.0000015B081A5000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B081A5000
Size:	98304

Signature Hits	Behavior Group	Mitre Attack
May enable test signing (to load unsigned drivers)	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000001.00000002.17632342267.000000000009A000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	9A000
Size:	24576

Details

Name:	00000008.00000003.18517524458.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000008.00000003.18523606508.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	12288

Details

Name:	00000008.00000003.18513049209.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000000F.00000000.18016679831.000000007F900000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F900000
Size:	4096

Details

Name:	00000008.00000003.17716182240.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18227904984.0000015B08153000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08153000
Size:	262144

Details

Name:	00000019.00000002.21903554804.00007FF5DA79A000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA79A000
Size:	8192

Details

Name:	00000008.00000003.18554926389.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	28672

Details

Name:	00000008.00000002.21903657262.000000001E440000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E440000
Size:	36864

Details

Name:	00000025.00000000.18505594614.00007FF5592DE000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5592DE000
Size:	16384

Details

Name:	00000019.00000002.21890188084.000001CCF7CA1000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7CA1000
Size:	16384

Details

Name:	00000008.00000003.18557416567.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17690835201.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000008.00000003.17619330113.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	28672

Details

Name:	00000008.00000003.17615983917.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	0000000D.00000002.17940485752.00000000001C0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1C0000
Size:	4096

Details

Name:	00000008.00000003.17690109056.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000023.00000003.18329979252.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17612116054.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000002.21888967761.000000000158C000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	158C000
Size:	131072

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18544362559.000000001D255000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D255000
Size:	40960

Details

Name:	00000029.00000003.18646566282.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	73728

Details

Name:	00000022.00000002.18581496584.00007FF52FD66000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FD66000
Size:	12288

Details

Name:	00000027.00000002.18543024904.00007FF57FDCB000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDCB000
Size:	20480

Details

Name:	00000019.00000002.21898549386.000001CCFDE25000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE25000
Size:	36864

Details

Name:	00000023.00000003.18308046687.0000015B1B7A8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B7A8000
Size:	266240

Details

Name:	0000002E.00000002.21758556705.0000016818CD4000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CD4000
Size:	114688

Details

Name:	0000002D.00000003.19911730160.000002779C702000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C702000
Size:	16384

Details

Name:	00000023.00000003.18352294984.0000015B1AD14000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD14000
Size:	4096

Details

Name:	00000019.00000003.18183410515.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000003.18521080882.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18140215533.000001CCFD980000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD980000
Size:	4096

Details

Name:	00000008.00000003.17618141091.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000023.00000003.18344475813.0000015B1C1D6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C1D6000
Size:	135168

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000025.00000003.18519424846.00000207277E6000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E6000
Size:	4096

Details

Name:	00000008.00000003.18575323810.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18559919786.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21899172013.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000008.00000003.18521167062.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000003.18156499167.000001CCFDBF5000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF5000
Size:	4096

Details

Name:	00000027.00000003.18537546524.0000016EE03AE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03AE000
Size:	16384

Details

Name:	00000008.00000003.18515551252.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17618253035.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	24576

Details

Name:	00000008.00000003.17695636384.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19960050783.00007FF5795B1000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5795B1000
Size:	8192

Details

Name:	00000008.00000002.21900426976.000000001D82E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D82E000
Size:	8192

Details

Name:	00000008.00000003.18507331591.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000008.00000003.18577477643.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18023846592.00000000031FB000.00000040.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	31FB000
Size:	4096

Details

Name:	00000019.00000002.21902781573.00007FF5DA72D000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA72D000
Size:	12288

Details

Name:	00000008.00000003.18533016722.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.17618098705.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000019.00000003.18181536731.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000002.21901534407.000000001E200000.00000004.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1E200000
Size:	4096

Details

Name:	0000002A.00000003.18698701082.00000265030F6000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F6000
Size:	69632

Details

Name:	00000008.00000000.17217719994.000000007FA80000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA80000
Size:	4096

Details

Name:	00000008.00000003.18574391191.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21760633944.0000016819C97000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C97000
Size:	36864

Details

Name:	00000019.00000002.21898628881.000001CCFDE2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE2F000
Size:	40960

Details

Name:	00000023.00000003.18300290660.0000015B1C41E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C41E000
Size:	266240

Details

Name:	00000022.00000002.18581104434.00007FF52FC47000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FC47000
Size:	4096

Details

Name:	0000002E.00000002.21760203191.0000016819C5C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C5C000
Size:	102400

Details

Name:	00000008.00000003.18523427566.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	20480

Details

Name:	00000001.00000002.17633736117.00000000006AE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	6AE000
Size:	8192

Details

Name:	00000023.00000003.18290902842.0000015B1BFA6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFA6000
Size:	188416

Signature Hits	Behavior Group	Mitre Attack
Contains strings related to BOT control commands	Remote Access Functionality
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17620097815.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000002.21899108955.000000001D220000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D220000
Size:	4096

Details

Name:	00000001.00000002.17632646581.00000000001F0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1F0000
Size:	4096

Details

Name:	00000008.00000003.17687504133.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17619826153.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000003.17714606763.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17620528077.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000008.00000003.17615861368.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	45056

Details

Name:	0000002D.00000002.21123175428.000002779C400000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C400000
Size:	4096

Details

Name:	00000025.00000003.18519957723.00000207271E0000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207271E0000
Size:	8192

Details

Name:	00000019.00000002.21888334087.000001CCF7B50000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF7B50000
Size:	4096

Details

Name:	00000027.00000002.18541875544.0000016EDFC30000.00000004.00000020.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16EDFC30000
Size:	28672

Details

Name:	0000002A.00000003.18683659124.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	73728

Details

Name:	00000019.00000000.18130154912.00007DF5F1C10000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C10000
Size:	12288

Details

Name:	00000008.00000003.18518015606.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	36864

Details

Name:	00000008.00000003.17613216832.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000023.00000003.18351921954.0000015B1AC0C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC0C000
Size:	143360

Details

Name:	00000008.00000003.17611736588.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	45056

Details

Name:	00000023.00000003.18298733478.0000015B1A8D3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A8D3000
Size:	16384

Details

Name:	00000029.00000003.18646269983.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	32768

Details

Name:	00000023.00000003.18305975996.0000015B1C41E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C41E000
Size:	266240

Details

Name:	0000002A.00000003.18676213206.00000265030EB000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EB000
Size:	204800

Details

Name:	00000008.00000003.17713603691.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21900186447.00007FF5DA2B0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA2B0000
Size:	8192

Details

Name:	0000002E.00000002.21756720891.0000016818B60000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818B60000
Size:	4096

Details

Name:	00000008.00000003.17617895328.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000019.00000002.21903188921.00007FF5DA772000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA772000
Size:	8192

Details

Name:	0000002A.00000003.19952238329.0000026503116000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503116000
Size:	139264

Details

Name:	00000018.00000000.18127801374.00007FF5BD31E000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD31E000
Size:	16384

Details

Name:	0000002E.00000002.21762877396.00007FF5A2ACB000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2ACB000
Size:	20480

Details

Name:	00000008.00000003.17685197363.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18213857242.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000002.21911866934.00000000205F9000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205F9000
Size:	90112

Details

Name:	00000019.00000003.18138508494.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000003.18558052650.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000000F.00000002.18021543493.0000000001330000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1330000
Size:	4096

Details

Name:	00000008.00000003.18507222647.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000027.00000003.18539232573.0000016EE0397000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0397000
Size:	49152

Details

Name:	00000008.00000003.18579155839.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18226649725.000001CCFDAA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDAA6000
Size:	53248

Details

Name:	00000022.00000002.18581139674.00007FF52FCCE000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FCCE000
Size:	12288

Details

Name:	0000002A.00000002.19960514643.00007FF57974B000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57974B000
Size:	4096

Details

Name:	00000008.00000003.18517742161.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000002.21902295904.000000001E24A000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E24A000
Size:	8192

Details

Name:	00000008.00000003.18555677321.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18520153394.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000019.00000003.18210624564.000001CCFDA2C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2C000
Size:	40960

Details

Name:	0000002A.00000002.19961854536.00007FF579844000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579844000
Size:	24576

Details

Name:	0000002D.00000002.21125218666.00007FF4FD056000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FD056000
Size:	12288

Details

Name:	00000008.00000003.18529936157.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000025.00000003.18518571452.00000207277EE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277EE000
Size:	24576

Details

Name:	00000027.00000002.18542864903.00007FF57FDBA000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDBA000
Size:	12288

Details

Name:	00000008.00000003.17689730075.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	0000000D.00000002.17942305319.0000000002550000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	2550000
Size:	8192

Details

Name:	00000008.00000003.17716589302.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17941715284.0000000000B60000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B60000
Size:	12288

Details

Name:	00000023.00000003.18287345828.0000015B08195000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08195000
Size:	65536

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery

Details

Name:	00000023.00000003.18305031309.0000015B1B82C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B82C000
Size:	167936

Details

Name:	00000019.00000003.18186138452.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000008.00000003.17687352801.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18574452068.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959842975.00007FF5793F0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5793F0000
Size:	8192

Details

Name:	00000025.00000003.18517675176.00000207277CF000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277CF000
Size:	20480

Details

Name:	00000008.00000003.17809365295.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21888262011.0000000001530000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1530000
Size:	4096

Details

Name:	0000000D.00000002.17940511717.00000000001E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1E0000
Size:	4096

Details

Name:	00000023.00000003.18312097809.0000015B1C05E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C05E000
Size:	53248

Details

Name:	00000019.00000003.18153244410.000001CCFDE24000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE24000
Size:	233472

Details

Name:	0000002A.00000003.18690806473.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	53248

Details

Name:	00000008.00000003.18516477267.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.18548001631.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17612440083.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000029.00000003.18644812949.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	61440

Details

Name:	00000019.00000003.18165088072.000001CCF85A9000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A9000
Size:	45056

Details

Name:	00000019.00000002.21895310808.000001CCF9160000.00000004.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	1CCF9160000
Size:	4096

Details

Name:	00000027.00000003.18536499656.0000016EE035E000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE035E000
Size:	49152

Details

Name:	00000019.00000003.18169554041.000001CCFDBCF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBCF000
Size:	4096

Details

Name:	00000023.00000003.18329672768.0000015B1ADDA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ADDA000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18533299354.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000002.21889262552.00000000015AE000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15AE000
Size:	45056

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery

Details

Name:	00000008.00000003.18515323534.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.21754798555.0000016819507000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819507000
Size:	12288

Details

Name:	00000019.00000002.21886997223.00000052711FF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52711FF000
Size:	4096

Details

Name:	00000008.00000003.18511658087.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000019.00000002.21890350572.000001CCF7CF0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7CF0000
Size:	36864

Details

Name:	00000023.00000003.18347505722.0000015B1A788000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A788000
Size:	4096

Details

Name:	00000008.00000003.18546851265.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	20480

Details

Name:	00000008.00000003.18577787022.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000002.18542975131.00007FF57FDC2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDC2000
Size:	4096

Details

Name:	00000019.00000003.18185334783.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000002.21899381177.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	65536

Details

Name:	0000002E.00000002.21756636238.00000039AFD7E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AFD7E000
Size:	8192

Details

Name:	00000008.00000003.18553976099.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000000.17217787005.000000007FA90000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA90000
Size:	12288

Details

Name:	0000002A.00000003.19952928373.00000265030CF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030CF000
Size:	237568

Details

Name:	00000019.00000003.18153574077.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000002.21912323985.000000002072A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2072A000
Size:	4096

Details

Name:	0000002E.00000002.21758376684.0000016818CBA000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CBA000
Size:	65536

Details

Name:	00000019.00000003.18198741559.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000002.21902409530.000000001E252000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E252000
Size:	4096

Details

Name:	00000001.00000002.17632411439.000000000019C000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	19C000
Size:	16384

Details

Name:	0000002D.00000002.21123996305.00007DF412370000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF412370000
Size:	20480

Details

Name:	00000023.00000003.18336047645.0000015B1B86E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B86E000
Size:	4096

Details

Name:	00000008.00000003.17713084665.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000022.00000002.18580985143.00007DF5471E0000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471E0000
Size:	12288

Details

Name:	00000023.00000003.18351179947.0000015B1BCD0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BCD0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	0000002E.00000003.21753065755.000001681953D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953D000
Size:	45056

Details

Name:	00000027.00000003.18539995518.0000016EE037E000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE037E000
Size:	8192

Details

Name:	0000000D.00000003.17938900230.0000000002570000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2570000
Size:	12288

Details

Name:	00000008.00000003.18517080961.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	0000002E.00000002.21761006365.00007FF5A1DC8000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A1DC8000
Size:	4096

Details

Name:	0000000F.00000002.18022728163.000000000185E000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	185E000
Size:	8192

Details

Name:	00000008.00000003.17615657027.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	40960

Details

Name:	00000008.00000003.18502076905.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000008.00000003.17696438040.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18198833705.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000023.00000003.18335432095.0000015B1A956000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A956000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.17616208366.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000023.00000003.18350803213.0000015B1B766000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B766000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	0000002A.00000003.19951494405.0000026503B20000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503B20000
Size:	45056

Details

Name:	00000027.00000000.18524656928.00007DF5972C2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972C2000
Size:	4096

Details

Name:	00000001.00000000.16840022914.000000007FFC2000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFC2000
Size:	4096

Details

Name:	0000002E.00000003.19929304734.000001681950F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950F000
Size:	12288

Details

Name:	0000002E.00000003.19928486364.0000016819574000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819574000
Size:	4096

Details

Name:	00000008.00000003.18504257667.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000008.00000003.18520369281.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000019.00000003.18166297260.000001CCF85D6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85D6000
Size:	20480

Details

Name:	00000019.00000003.18167850171.000001CCF85B2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85B2000
Size:	8192

Details

Name:	00000008.00000003.17620459609.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000008.00000003.17901058953.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	00000019.00000003.18167085226.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000018.00000002.21892366404.00007FF5BD132000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD132000
Size:	20480

Details

Name:	00000023.00000003.18288987987.0000015B1BAC0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BAC0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000023.00000003.18339009742.0000015B1C06C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C06C000
Size:	151552

Details

Name:	0000002A.00000003.18692531784.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	57344

Details

Name:	00000018.00000002.21890125030.00000205EE7D1000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE7D1000
Size:	110592

Details

Name:	00000008.00000003.18525607232.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18351506864.0000015B1BD54000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD54000
Size:	4096

Details

Name:	00000008.00000003.18526344575.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000019.00000003.18136390889.000001CCFDA3F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA3F000
Size:	102400

Details

Name:	00000019.00000003.18152530199.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000029.00000003.19966105413.000001D4525EE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EE000
Size:	8192

Details

Name:	0000002E.00000003.21755103381.0000016819526000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819526000
Size:	8192

Details

Name:	00000008.00000003.18527666469.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	0000002E.00000002.21762455376.00007FF5A2AA0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AA0000
Size:	16384

Details

Name:	00000027.00000003.18538259446.0000016EDFC4D000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EDFC4D000
Size:	94208

Details

Name:	0000000D.00000002.17942486763.00000000025D1000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	25D1000
Size:	36864

Details

Name:	0000002A.00000003.18699109651.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	8192

Details

Name:	00000008.00000003.18512836704.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21895419916.000001CCF9660000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF9660000
Size:	8192

Details

Name:	00000027.00000003.18537590352.0000016EE03B9000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03B9000
Size:	147456

Details

Name:	00000018.00000002.21893792913.00007FF5BD29F000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD29F000
Size:	8192

Details

Name:	00000008.00000003.18521716198.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000023.00000003.18303744930.0000015B1B8B0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B8B0000
Size:	4096

Details

Name:	00000018.00000002.21892546168.00007FF5BD1A7000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD1A7000
Size:	12288

Details

Name:	00000019.00000002.21889743649.000001CCF7C7F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C7F000
Size:	4096

Details

Name:	00000008.00000003.18507671599.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000018.00000002.21894408794.00007FF5BD30B000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD30B000
Size:	4096

Details

Name:	0000000D.00000002.17940728212.00000000005E0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	5E0000
Size:	4096

Details

Name:	0000002D.00000002.21123752115.000002779C515000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C515000
Size:	4096

Details

Name:	0000000F.00000002.18023108380.0000000001B80000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1B80000
Size:	73728

Details

Name:	00000023.00000003.18423819335.0000015B1B1FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B1FA000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
Found strings which match to known social media urls	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18526465438.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	65536

Details

Name:	00000023.00000003.18319810399.0000015B1BE00000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BE00000
Size:	102400

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18290253359.0000015B1AEA0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEA0000
Size:	69632

Details

Name:	00000023.00000003.18334799670.0000015B1A704000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A704000
Size:	4096

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.18509513262.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000019.00000002.21890494318.000001CCF7CFA000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7CFA000
Size:	28672

Details

Name:	00000027.00000003.18538704464.0000016EE03DB000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03DB000
Size:	8192

Details

Name:	00000027.00000002.18543489198.00007FF57FE32000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FE32000
Size:	8192

Details

Name:	00000008.00000002.21902118925.000000001E240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E240000
Size:	4096

Details

Name:	00000019.00000003.18131746438.000001CCFD737000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD737000
Size:	4096

Details

Name:	00000019.00000002.21901637296.00007FF5DA6E0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6E0000
Size:	16384

Details

Name:	00000008.00000003.18504789240.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18168999745.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.18537808005.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	49152

Details

Name:	00000008.00000003.18624313013.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000023.00000003.18401899544.0000015B1AE5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5E000
Size:	4096

Details

Name:	00000023.00000003.18302834450.0000015B1BFE8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFE8000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18518813156.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000008.00000003.17696192904.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18350042449.0000015B1A998000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A998000
Size:	4096

Details

Name:	0000002A.00000000.18667157373.00007FF5798DE000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798DE000
Size:	16384

Details

Name:	00000019.00000002.21896371394.000001CCFDA37000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA37000
Size:	32768

Details

Name:	0000002E.00000003.19928077656.000001681952F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952F000
Size:	28672

Details

Name:	0000002E.00000003.19940029899.0000016819563000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819563000
Size:	28672

Details

Name:	00000008.00000003.17686982602.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18213780447.000001CCFDA2C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2C000
Size:	40960

Details

Name:	00000008.00000003.18515772744.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	16384

Details

Name:	00000008.00000003.17717258030.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17695057644.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000000F.00000002.18023809163.00000000031F7000.00000040.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	31F7000
Size:	4096

Details

Name:	00000008.00000003.17696615949.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000002.18521252743.0000020726EC0000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726EC0000
Size:	4096

Details

Name:	00000008.00000003.18523650497.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	12288

Details

Name:	0000002E.00000002.21757707034.0000016818C5F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C5F000
Size:	122880

Details

Name:	00000029.00000002.19968170656.00007FF560BE2000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560BE2000
Size:	4096

Details

Name:	0000000D.00000002.17940615847.00000000003C1000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3C1000
Size:	4096

Details

Name:	00000029.00000003.18659862840.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	28672

Details

Name:	00000008.00000002.21914400366.00000000215A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	215A0000
Size:	57344

Details

Name:	0000002E.00000002.21763329276.00007FF5A2B01000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B01000
Size:	4096

Details

Name:	00000008.00000003.17717534614.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18512705352.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17614000664.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	36864

Details

Name:	00000023.00000003.18306271212.0000015B1C292000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C292000
Size:	266240

Details

Name:	00000023.00000003.18313512818.0000015B1B346000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B346000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	0000002A.00000000.18666748282.00007DF590D30000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D30000
Size:	4096

Details

Name:	00000008.00000003.18506590101.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21912630772.0000000020750000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20750000
Size:	65536

Details

Name:	0000000F.00000002.18021039056.0000000000FA0000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	FA0000
Size:	118784

Details

Name:	00000008.00000003.17687552971.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18286999705.0000015B0817D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0817D000
Size:	163840

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18558475620.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18697364451.00000265030E3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030E3000
Size:	155648

Details

Name:	00000019.00000003.18238743926.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	57344

Details

Name:	00000025.00000003.18518765994.00000207277F0000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F0000
Size:	16384

Details

Name:	00000019.00000002.21887044259.00000052712FE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52712FE000
Size:	8192

Details

Name:	00000008.00000003.18517796697.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.17683547430.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18539853529.0000016EE0387000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0387000
Size:	20480

Details

Name:	00000027.00000003.18538908610.0000016EE03BA000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03BA000
Size:	135168

Details

Name:	0000000F.00000000.18016377169.0000000000F5E000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	F5E000
Size:	4096

Details

Name:	00000019.00000003.18213226270.000001CCFDBE6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBE6000
Size:	65536

Details

Name:	0000000F.00000002.18021577142.000000000144E000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	144E000
Size:	8192

Details

Name:	00000023.00000003.18336723789.0000015B1BAC0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BAC0000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000008.00000003.18527500468.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000023.00000003.18326856028.0000015B1A746000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A746000
Size:	266240

Details

Name:	0000002D.00000003.21121852287.000002779C702000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C702000
Size:	8192

Details

Name:	00000023.00000003.18269218107.0000015B08179000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08179000
Size:	65536

Details

Name:	0000000D.00000002.17940188736.0000000000140000.00000004.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	140000
Size:	4096

Details

Name:	00000027.00000003.18535061765.0000016EDFC63000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EDFC63000
Size:	45056

Details

Name:	0000002E.00000003.21753844722.0000016819513000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819513000
Size:	20480

Details

Name:	00000023.00000000.18220847174.00007FF791C51000.00000020.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page execute read
Base address:	7FF791C51000
Size:	614400

Details

Name:	00000008.00000003.18559495876.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21900395391.00007FF5DA333000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA333000
Size:	12288

Details

Name:	00000019.00000003.18182118097.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000023.00000003.18349735909.0000015B1A956000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A956000
Size:	266240

Details

Name:	00000025.00000002.18521437825.0000020727009000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	20727009000
Size:	20480

Details

Name:	00000008.00000003.18531732075.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	40960

Details

Name:	00000023.00000003.18262597335.0000015B0C754000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C754000
Size:	2879488

Signature Hits	Behavior Group	Mitre Attack
SQL strings found in memory and binary data	System Summary

Details

Name:	00000008.00000003.17684583391.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18661531919.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	28672

Details

Name:	00000023.00000000.18221696005.00007FF791D09000.00000008.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page write copy
Base address:	7FF791D09000
Size:	8192

Details

Name:	00000008.00000003.18505948253.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000003.18540769743.0000016EDFE52000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE52000
Size:	4096

Details

Name:	0000002A.00000002.19959945808.00007FF579473000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579473000
Size:	12288

Details

Name:	00000008.00000003.17685695781.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18627992491.000001D4525D3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D3000
Size:	262144

Details

Name:	00000019.00000002.21889107456.000001CCF7C3E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C3E000
Size:	4096

Details

Name:	00000008.00000003.18516302470.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000019.00000002.21900320676.00007FF5DA323000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA323000
Size:	8192

Details

Name:	00000022.00000002.18580705566.00000175343C0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	175343C0000
Size:	4096

Details

Name:	0000000D.00000002.17941023718.0000000000710000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	710000
Size:	24576

Details

Name:	00000023.00000003.18284560534.0000015B1B97A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B97A000
Size:	249856

Details

Name:	00000008.00000003.17691681339.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18699334335.00000265030DF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030DF000
Size:	16384

Details

Name:	00000008.00000003.17690978222.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	12288

Details

Name:	00000027.00000002.18541248879.0000002CB7A7F000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB7A7F000
Size:	4096

Details

Name:	00000018.00000002.21886571946.00000030363FF000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	30363FF000
Size:	4096

Details

Name:	00000018.00000002.21892202358.00007FF5BD0B6000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD0B6000
Size:	12288

Details

Name:	00000008.00000003.18503503918.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	00000019.00000003.18139428345.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	45056

Details

Name:	00000008.00000003.17614094114.000000001E31A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E31A000
Size:	24576

Details

Name:	00000008.00000003.18531674314.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000027.00000003.18535436707.0000016EE036A000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE036A000
Size:	471040

Details

Name:	00000008.00000002.21887098687.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	49152

Details

Name:	00000019.00000002.21896061038.000001CCFD8A0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD8A0000
Size:	12288

Details

Name:	00000008.00000003.18547826818.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000003.18519148511.00000207277EE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277EE000
Size:	8192

Details

Name:	00000029.00000003.18661030511.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	65536

Details

Name:	00000023.00000000.18220816979.00007FF791C50000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF791C50000
Size:	4096

Details

Name:	0000000F.00000002.18021843865.00000000015BE000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	15BE000
Size:	8192

Details

Name:	00000019.00000002.21901714841.00007FF5DA6E6000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6E6000
Size:	8192

Details

Name:	00000029.00000003.18659300287.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000019.00000002.21892150375.000001CCF8513000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8513000
Size:	73728

Details

Name:	00000019.00000002.21899210283.00007FF5D9812000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9812000
Size:	4096

Details

Name:	00000008.00000003.17619199345.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18531617545.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	0000002E.00000002.21761680714.00007FF5A296F000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A296F000
Size:	8192

Details

Name:	0000002E.00000003.20226981242.0000016818CA1000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CA1000
Size:	20480

Details

Name:	00000023.00000003.18340640787.0000015B1BB44000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BB44000
Size:	4096

Details

Name:	00000008.00000003.17715803194.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000002E.00000002.21763115657.00007FF5A2AE2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AE2000
Size:	57344

Details

Name:	00000023.00000003.18433793263.0000015B1AEE2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AEE2000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
May infect USB drives	Spreading	Replication Through Removable Media
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000023.00000003.18327831413.0000015B1A891000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A891000
Size:	258048

Signature Hits	Behavior Group	Mitre Attack
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000018.00000002.21894247147.00007FF5BD2E4000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2E4000
Size:	8192

Details

Name:	00000027.00000002.18541978200.0000016EDFC39000.00000004.00000020.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16EDFC39000
Size:	81920

Details

Name:	0000002E.00000002.21763661423.00007FF5A2B5A000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B5A000
Size:	8192

Details

Name:	00000008.00000003.17599908535.000000001DF60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1DF60000
Size:	4096

Details

Name:	00000023.00000003.18347184421.0000015B1A746000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A746000
Size:	266240

Details

Name:	00000029.00000003.18658796065.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	65536

Details

Name:	00000008.00000003.17618675094.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000008.00000003.17691051568.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	32768

Details

Name:	00000008.00000003.17697346346.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21898859933.00007DF5F1C00000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1C00000
Size:	4096

Details

Name:	00000027.00000000.18524691609.00007DF5972D0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972D0000
Size:	12288

Details

Name:	00000008.00000003.17686907745.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18510649053.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	0000000D.00000002.17942120969.00000000023A7000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	23A7000
Size:	4096

Details

Name:	00000008.00000003.17696334083.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000000.19910104807.00007DF5144B0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144B0000
Size:	4096

Details

Name:	00000008.00000003.18523037950.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18546074972.000000001D2A2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A2000
Size:	57344

Details

Name:	00000008.00000003.17686612056.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21910441099.000000001F471000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1F471000
Size:	32768

Details

Name:	00000008.00000003.18500773880.000000001D1E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1E0000
Size:	32768

Details

Name:	00000008.00000003.18572736478.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000003.18209497023.0000017534430000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	17534430000
Size:	192512

Details

Name:	00000008.00000003.18515202478.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000003.18524712643.000000001D220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D220000
Size:	65536

Details

Name:	00000019.00000003.18200727330.000001CCFDBFF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBFF000
Size:	4096

Details

Name:	00000029.00000003.18656511717.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	32768

Details

Name:	00000008.00000003.17714535507.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18526763608.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000008.00000003.18560654239.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18520411600.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000025.00000003.18520132317.00000207272D0000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D0000
Size:	4096

Details

Name:	00000008.00000003.17683772657.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18558537430.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17301824335.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	49152

Details

Name:	00000019.00000002.21886435836.0000005270B7D000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5270B7D000
Size:	12288

Details

Name:	00000008.00000003.18520205523.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002A.00000003.18695794095.00000265030FF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030FF000
Size:	262144

Details

Name:	00000025.00000003.18517327705.000002072784B000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072784B000
Size:	8192

Details

Name:	00000008.00000003.17693682625.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000008.00000003.18520902558.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	0000000D.00000000.17935991050.0000000000150000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	150000
Size:	118784

Details

Name:	00000023.00000003.18284099493.0000015B1A87C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A87C000
Size:	65536

Details

Name:	00000008.00000003.18556956958.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	36864

Details

Name:	00000008.00000002.21914118440.00000000209CE000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	209CE000
Size:	8192

Details

Name:	00000018.00000002.21890409492.00000205EE8B0000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE8B0000
Size:	4096

Details

Name:	00000008.00000003.18551952806.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21887440761.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	65536

Details

Name:	00000008.00000003.18561082211.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21890896067.0000000001720000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1720000
Size:	8192

Details

Name:	00000019.00000003.18186012575.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000019.00000003.18152949056.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.17697128817.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18503836184.000000000177A000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	177A000
Size:	24576

Details

Name:	0000000D.00000002.17941253151.0000000000737000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	737000
Size:	16384

Details

Name:	00000008.00000003.18576234133.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18502523832.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	00000008.00000003.18576555846.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18199383423.000001CCFDA2C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2C000
Size:	40960

Details

Name:	00000025.00000002.18522422084.00007FF55923A000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF55923A000
Size:	12288

Details

Name:	00000008.00000003.17691454086.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21895730217.000001CCFD7A0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD7A0000
Size:	4096

Details

Name:	00000008.00000003.18552451544.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18306868118.0000015B1AA1D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AA1D000
Size:	180224

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18532134280.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	36864

Details

Name:	00000029.00000003.18648730164.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	57344

Details

Name:	00000023.00000003.18294597236.0000015B1A5CB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A5CB000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000008.00000003.18575848619.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000002.18522802972.00007FF559274000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF559274000
Size:	20480

Details

Name:	00000025.00000003.18518659272.00000207277F7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F7000
Size:	36864

Details

Name:	00000008.00000003.18510997369.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000023.00000003.18325871818.0000015B1AC95000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC95000
Size:	8192

Details

Name:	00000008.00000003.17695485272.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18573943567.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19929631762.000001681952A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952A000
Size:	4096

Details

Name:	00000023.00000003.18330638755.0000015B1B6A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6A0000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000019.00000003.18181448500.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.17617149153.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002A.00000003.18686166432.00000265030F2000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F2000
Size:	32768

Details

Name:	0000002A.00000003.19922331450.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	94208

Details

Name:	0000002E.00000003.19929359783.000001681950F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681950F000
Size:	4096

Details

Name:	00000027.00000002.18541709128.0000016EDFB40000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16EDFB40000
Size:	8192

Details

Name:	00000008.00000003.18520465548.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	0000002E.00000003.21752282635.0000016819558000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819558000
Size:	8192

Details

Name:	00000023.00000003.18302514149.0000015B1BFA6000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BFA6000
Size:	188416

Details

Name:	00000008.00000003.17619418370.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	32768

Details

Name:	00000027.00000003.18536908398.0000016EE0394000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0394000
Size:	102400

Details

Name:	0000000F.00000000.18016734510.000000007F902000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F902000
Size:	4096

Details

Name:	00000019.00000002.21890628585.000001CCF7D02000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7D02000
Size:	65536

Details

Name:	00000019.00000003.18197098641.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.17615369058.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	57344

Details

Name:	00000018.00000002.21894024990.00007FF5BD2B4000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2B4000
Size:	20480

Details

Name:	0000002A.00000002.19962058949.00007FF57985A000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57985A000
Size:	4096

Details

Name:	00000008.00000003.17612178384.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.18579260816.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000000.18129714539.000001CCF79F0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF79F0000
Size:	118784

Details

Name:	00000018.00000002.21894475449.00007FF5BD30E000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD30E000
Size:	12288

Details

Name:	0000002E.00000003.21754717973.000001681951B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951B000
Size:	4096

Details

Name:	00000019.00000003.18196376583.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000008.00000003.18548394775.000000001D2A2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A2000
Size:	57344

Details

Name:	00000008.00000003.18502324576.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	8192

Details

Name:	00000008.00000003.17716778542.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000002A.00000003.18689982421.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000019.00000000.18129926131.00007DF5F1BF0000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5F1BF0000
Size:	4096

Details

Name:	00000008.00000003.18552511785.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18136776152.000001CCFDA59000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA59000
Size:	32768

Details

Name:	0000002A.00000002.19963011013.00007FF650CE0000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF650CE0000
Size:	4096

Details

Name:	0000000F.00000000.18016446942.0000000000FA0000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	FA0000
Size:	118784

Details

Name:	00000023.00000003.18307074601.0000015B1AA4C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AA4C000
Size:	69632

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18167725710.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000008.00000003.18574957962.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17613285559.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	57344

Details

Name:	0000000D.00000002.17942150504.00000000023AB000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	23AB000
Size:	4096

Details

Name:	00000008.00000003.18577268542.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17940908658.000000000066E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	66E000
Size:	8192

Details

Name:	00000019.00000002.21891267665.000001CCF8191000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF8191000
Size:	110592

Details

Name:	00000019.00000002.21901855277.00007FF5DA6F4000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6F4000
Size:	12288

Details

Name:	0000002A.00000002.19960234783.00007FF579696000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579696000
Size:	4096

Details

Name:	00000023.00000003.18328117929.0000015B1A8D2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A8D2000
Size:	4096

Details

Name:	00000008.00000003.18504594768.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000019.00000002.21886616686.0000005270DFD000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	5270DFD000
Size:	12288

Details

Name:	00000018.00000002.21887973884.00000205EE228000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE228000
Size:	4096

Details

Name:	00000019.00000003.18226249048.000001CCFDE63000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE63000
Size:	4096

Details

Name:	00000027.00000003.18539912297.0000016EE038E000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE038E000
Size:	8192

Details

Name:	00000008.00000003.18521128821.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000023.00000003.18403436679.0000015B1A448000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A448000
Size:	8192

Details

Name:	00000008.00000003.18554273191.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18548202914.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	45056

Details

Name:	00000025.00000003.18519888820.00000207277C7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277C7000
Size:	24576

Details

Name:	00000027.00000003.18537339236.0000016EE03B2000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03B2000
Size:	176128

Details

Name:	00000008.00000002.21915001754.000000007FA70000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA70000
Size:	4096

Details

Name:	00000023.00000003.18222286707.0000015B083A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B083A0000
Size:	192512

Details

Name:	00000008.00000003.17688282707.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17695128073.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000D.00000002.17940640556.00000000003C4000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3C4000
Size:	4096

Details

Name:	00000008.00000003.18519486916.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21893861059.00007FF5BD2A2000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2A2000
Size:	57344

Details

Name:	00000008.00000003.17715261868.0000000001341000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1341000
Size:	53248

Details

Name:	00000008.00000003.17620168095.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000019.00000003.18133996562.000001CCFD720000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD720000
Size:	8192

Details

Name:	00000019.00000003.18240230415.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	65536

Details

Name:	0000002E.00000003.21755346843.0000016819578000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819578000
Size:	8192

Details

Name:	00000022.00000003.18216017047.00000175342F0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F0000
Size:	4096

Details

Name:	0000002E.00000002.21762019296.00007FF5A2A49000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A49000
Size:	53248

Details

Name:	0000002E.00000003.19929755840.0000016819576000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819576000
Size:	4096

Details

Name:	00000008.00000003.18555931433.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000019.00000003.18239790560.000001CCFDE6B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE6B000
Size:	4096

Details

Name:	00000019.00000002.21894854639.000001CCF9120000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9120000
Size:	65536

Details

Name:	00000018.00000002.21887409052.00000205EE1E0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE1E0000
Size:	4096

Details

Name:	0000002A.00000002.19956535365.0000026503139000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503139000
Size:	8192

Details

Name:	00000008.00000003.17689951934.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000008.00000003.17713864385.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616922115.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	00000008.00000003.18520550082.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000019.00000002.21897975210.000001CCFDBB1000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBB1000
Size:	94208

Details

Name:	00000008.00000003.17688342182.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18520097818.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000001.00000002.17642076320.000000007FE50000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FE50000
Size:	20480

Details

Name:	0000000F.00000002.18023922023.000000000325E000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	325E000
Size:	8192

Details

Name:	00000019.00000003.18225592518.000001CCFDE64000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE64000
Size:	233472

Details

Name:	0000002A.00000003.18674419720.00000265030E3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030E3000
Size:	262144

Details

Name:	00000018.00000002.21888995389.00000205EE288000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE288000
Size:	8192

Details

Name:	00000029.00000003.18659674936.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	65536

Details

Name:	00000008.00000003.18551393334.00000000205E1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205E1000
Size:	28672

Details

Name:	00000019.00000002.21898504897.000001CCFDE23000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE23000
Size:	4096

Details

Name:	00000022.00000002.18579936371.00000040D7A7E000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	40D7A7E000
Size:	8192

Details

Name:	00000008.00000003.18576395104.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000003.18518405079.00000207277F7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F7000
Size:	36864

Details

Name:	00000008.00000003.17686667649.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000000.18220775446.00007FF5A217E000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A217E000
Size:	16384

Details

Name:	00000008.00000003.18518610256.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	12288

Details

Name:	0000002A.00000003.19952671830.00000265030AF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030AF000
Size:	102400

Details

Name:	00000022.00000002.18582021966.00007FF758881000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF758881000
Size:	10485760

Details

Name:	00000008.00000002.21890687962.0000000001636000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1636000
Size:	20480

Details

Name:	00000008.00000003.18576912941.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18555988778.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	12288

Details

Name:	00000008.00000003.18559052597.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757298533.0000016818C1F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C1F000
Size:	36864

Details

Name:	00000029.00000003.18658249283.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	57344

Details

Name:	00000008.00000003.18577115529.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18575899324.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17717469488.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18654450321.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	32768

Details

Name:	00000023.00000003.18283593829.0000015B1A80D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A80D000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara signature match	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18133505366.000001CCFD77F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD77F000
Size:	4096

Details

Name:	0000000D.00000002.17941578462.0000000000A4E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	A4E000
Size:	8192

Details

Name:	00000008.00000003.17712542816.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000022.00000003.18212200863.00000175342DC000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342DC000
Size:	32768

Details

Name:	00000029.00000002.19966877367.000001D452450000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D452450000
Size:	118784

Details

Name:	00000027.00000003.18538422717.0000016EE0371000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0371000
Size:	4096

Details

Name:	00000008.00000003.17616098772.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000018.00000002.21894358790.00007FF5BD2F2000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2F2000
Size:	8192

Details

Name:	00000008.00000003.18558114893.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18154350118.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000029.00000002.19967211827.000001D4525A0000.00000004.00000020.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1D4525A0000
Size:	40960

Details

Name:	00000008.00000003.18550311552.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18515047455.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000019.00000002.21896114026.000001CCFDA00000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA00000
Size:	73728

Details

Name:	0000002E.00000000.19926240221.00007DF5B9FC0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FC0000
Size:	4096

Details

Name:	00000018.00000002.21893375137.00007FF5BD282000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD282000
Size:	4096

Details

Name:	00000023.00000003.18341049449.0000015B1B766000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B766000
Size:	4096

Details

Name:	00000019.00000003.18185522095.000001CCFDE25000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE25000
Size:	237568

Details

Name:	00000019.00000003.18182450510.000001CCFDE10000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE10000
Size:	73728

Details

Name:	00000023.00000003.18285220965.0000015B1AFA8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFA8000
Size:	266240

Details

Name:	00000019.00000003.18227448673.000001CCFDA31000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA31000
Size:	20480

Details

Name:	0000000F.00000002.18024464275.000000007F7A0000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7F7A0000
Size:	20480

Details

Name:	00000029.00000003.18640797621.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	53248

Details

Name:	00000027.00000003.18540620248.0000016EE0350000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0350000
Size:	28672

Details

Name:	00000008.00000003.18547481605.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000008.00000003.17683072619.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18180939080.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000001.00000002.17633656834.0000000000550000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	550000
Size:	20480

Details

Name:	0000002A.00000003.18680590387.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	00000029.00000003.18656259315.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	57344

Details

Name:	00000019.00000003.18226291033.000001CCFDE7F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE7F000
Size:	122880

Details

Name:	0000000F.00000002.18024313225.00000000043C1000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	43C1000
Size:	8192

Details

Name:	00000008.00000003.17615177055.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000008.00000003.17683127858.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.20226761965.0000016818C96000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C96000
Size:	4096

Details

Name:	00000008.00000003.18551121638.00000000215A6000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	215A6000
Size:	40960

Details

Name:	0000002A.00000002.19959755478.00007FF579151000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579151000
Size:	4096

Details

Name:	00000029.00000003.18644545261.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	53248

Details

Name:	00000008.00000003.18528198520.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18502711485.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	0000002D.00000003.19911832715.000002779C713000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C713000
Size:	16384

Details

Name:	00000008.00000003.18575639405.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21122571685.000002779C1C0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C1C0000
Size:	4096

Details

Name:	00000019.00000003.18132398932.000001CCFD753000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD753000
Size:	16384

Details

Name:	00000008.00000003.18513437103.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000029.00000003.18639308419.000001D4525DA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DA000
Size:	28672

Details

Name:	00000019.00000003.18138642037.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000029.00000002.19969083304.00007FF6836C1000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF6836C1000
Size:	7516160

Details

Name:	0000002D.00000002.21124752561.00007FF4FCFCB000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFCB000
Size:	20480

Details

Name:	00000008.00000003.17715736956.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17684227497.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18133156548.000001CCFD76E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD76E000
Size:	4096

Details

Name:	00000022.00000002.18581071102.00007FF52FC2D000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF52FC2D000
Size:	4096

Details

Name:	00000008.00000003.18553651455.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000027.00000000.18524541388.00007DF5972B0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5972B0000
Size:	4096

Details

Name:	00000008.00000003.17599984942.000000001DF60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1DF60000
Size:	4096

Details

Name:	0000002E.00000003.19930891568.0000016819AD0000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819AD0000
Size:	4096

Details

Name:	00000008.00000003.17614623918.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000029.00000000.18610270773.00007FF5521DA000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5521DA000
Size:	4096

Details

Name:	00000019.00000003.18240335687.000001CCFDE39000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE39000
Size:	36864

Details

Name:	00000008.00000003.18515096669.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000019.00000003.18212538625.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000008.00000003.18522732469.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	0000002A.00000002.19955322583.0000026502F20000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26502F20000
Size:	12288

Details

Name:	00000029.00000003.18622699161.000001D4525D3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D3000
Size:	225280

Details

Name:	00000025.00000003.18516269245.0000020727829000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727829000
Size:	147456

Details

Name:	0000002A.00000003.19954302027.00000265030A6000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030A6000
Size:	20480

Details

Name:	00000023.00000003.18310962205.0000015B1ADDA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ADDA000
Size:	266240

Details

Name:	00000027.00000003.18536628840.0000016EE03AD000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03AD000
Size:	196608

Details

Name:	0000002A.00000003.18678463272.00000265030EC000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EC000
Size:	163840

Details

Name:	0000002A.00000002.19954964577.000000BD263FF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD263FF000
Size:	4096

Details

Name:	00000008.00000003.18514709983.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18544079092.000000001D280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D280000
Size:	65536

Details

Name:	00000019.00000003.18183826923.000001CCFDE25000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE25000
Size:	237568

Details

Name:	0000000F.00000002.18024349747.000000000549D000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	549D000
Size:	12288

Details

Name:	0000002A.00000002.19961227867.00007FF579816000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579816000
Size:	4096

Details

Name:	00000023.00000003.18348673105.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	266240

Details

Name:	00000008.00000003.18560007981.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21896614358.000001CCFDA59000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA59000
Size:	24576

Details

Name:	00000008.00000003.18554079432.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18184502528.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000023.00000003.18346482197.0000015B1AC0C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC0C000
Size:	143360

Details

Name:	00000018.00000002.21890083255.00000205EE7C0000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	205EE7C0000
Size:	4096

Details

Name:	00000018.00000000.18127610871.00007DF5D4780000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4780000
Size:	4096

Details

Name:	00000008.00000003.17618641509.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.18533151365.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000022.00000000.18190513976.00007DF5471D2000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5471D2000
Size:	4096

Details

Name:	00000029.00000003.18663863047.000001D4525F6000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525F6000
Size:	253952

Details

Name:	00000008.00000003.17620027053.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000008.00000003.18502665168.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	16384

Details

Name:	0000002E.00000002.21762373367.00007FF5A2A96000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2A96000
Size:	4096

Details

Name:	00000008.00000003.18520656934.0000000001775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1775000
Size:	8192

Details

Name:	00000008.00000003.17610440206.00000000015B8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B8000
Size:	4096

Details

Name:	00000008.00000003.17687609622.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959892272.00007FF57945A000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57945A000
Size:	12288

Details

Name:	00000008.00000003.18506808392.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18300838310.0000015B1A6BC000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A6BC000
Size:	20480

Details

Name:	00000029.00000003.18646735920.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	61440

Details

Name:	0000002E.00000003.19929916799.0000016819574000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819574000
Size:	4096

Details

Name:	00000019.00000002.21896900520.000001CCFDB06000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB06000
Size:	49152

Details

Name:	00000008.00000002.21887925210.00000000014A0000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	14A0000
Size:	4096

Details

Name:	00000029.00000003.18640936479.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	32768

Details

Name:	0000002A.00000003.18686591078.00000265030F3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F3000
Size:	262144

Details

Name:	00000008.00000003.17716529419.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000008.00000003.18555803410.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	65536

Details

Name:	0000002D.00000002.21123387513.000002779C413000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C413000
Size:	57344

Details

Name:	00000019.00000002.21902863863.00007FF5DA734000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA734000
Size:	20480

Details

Name:	00000008.00000003.18552323897.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	00000025.00000003.18519655476.00000207272D3000.00000004.00000040.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	207272D3000
Size:	8192

Details

Name:	00000019.00000003.18153096871.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000019.00000003.18197317301.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.18533572084.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	65536

Details

Name:	00000019.00000002.21893924813.000001CCF85CF000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85CF000
Size:	8192

Details

Name:	0000002A.00000002.19954780010.000000BD261FE000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD261FE000
Size:	8192

Details

Name:	0000002A.00000003.18696863559.0000026503109000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503109000
Size:	65536

Details

Name:	00000022.00000002.18581873966.00007FF75886F000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF75886F000
Size:	61440

Details

Name:	00000023.00000003.18242976274.0000015B0B50C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B50C000
Size:	1716224

Signature Hits	Behavior Group	Mitre Attack
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
SQL strings found in memory and binary data	System Summary
URLs found in memory or binary data	Networking

Details

Name:	00000023.00000003.18401929350.0000015B1AE1C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE1C000
Size:	131072

Details

Name:	00000008.00000003.18524188365.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	20480

Details

Name:	00000008.00000003.18549344346.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	53248

Details

Name:	00000029.00000003.18645435911.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	32768

Details

Name:	00000008.00000003.18557816539.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	0000002A.00000002.19960280878.00007FF5796B2000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5796B2000
Size:	28672

Details

Name:	00000018.00000002.21893121356.00007FF5BD260000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD260000
Size:	8192

Details

Name:	00000019.00000002.21898183965.000001CCFDBE0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBE0000
Size:	36864

Details

Name:	00000008.00000003.18549972008.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18022412236.0000000001618000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1618000
Size:	114688

Details

Name:	00000019.00000003.18184689782.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	0000002E.00000002.21757010093.0000016818BC0000.00000004.00000020.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	16818BC0000
Size:	16384

Details

Name:	00000008.00000003.18548640492.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	61440

Details

Name:	00000019.00000002.21898455832.000001CCFDE00000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE00000
Size:	8192

Details

Name:	00000023.00000003.18401609415.0000015B08159000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08159000
Size:	65536

Details

Name:	00000008.00000003.17689159982.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000000.17218502665.000000007FA82000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA82000
Size:	4096

Details

Name:	00000023.00000003.18283288165.0000015B1BBC8000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BBC8000
Size:	57344

Details

Name:	00000008.00000003.17688480380.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18518301930.000000001D1C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1C0000
Size:	4096

Details

Name:	00000019.00000003.18167771550.000001CCF85A9000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A9000
Size:	32768

Details

Name:	00000023.00000003.18338192789.0000015B1B3A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B3A0000
Size:	167936

Details

Name:	00000008.00000003.18526412821.000000001D260000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D260000
Size:	16384

Details

Name:	00000023.00000003.18350420297.0000015B1B766000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B766000
Size:	4096

Details

Name:	00000008.00000003.18501510724.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	53248

Details

Name:	00000018.00000002.21894118419.00007FF5BD2BA000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD2BA000
Size:	12288

Details

Name:	0000002D.00000002.21124063565.00007DF5144B0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144B0000
Size:	4096

Details

Name:	00000023.00000003.18261775762.0000015B0C6AB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C6AB000
Size:	4096

Details

Name:	0000002D.00000003.19911224976.000002779C713000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C713000
Size:	16384

Details

Name:	00000027.00000003.18536043796.0000016EE037A000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE037A000
Size:	405504

Details

Name:	00000008.00000003.18543952445.000000001D270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D270000
Size:	16384

Details

Name:	00000029.00000003.18658546925.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	53248

Details

Name:	00000008.00000003.18508254936.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17619928488.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000018.00000002.21889776732.00000205EE400000.00000004.00000040.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	205EE400000
Size:	4096

Details

Name:	00000019.00000003.18196205234.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000019.00000002.21895773387.000001CCFD7C0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD7C0000
Size:	24576

Details

Name:	0000000D.00000000.17936187870.000000007FEE0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEE0000
Size:	4096

Details

Name:	0000002E.00000003.21754263698.000001681951F000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951F000
Size:	36864

Details

Name:	0000002A.00000003.18682653952.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	155648

Details

Name:	00000008.00000003.18511292065.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000008.00000003.17611848194.000000001E450000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E450000
Size:	24576

Details

Name:	00000027.00000003.18540198363.0000016EE0360000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0360000
Size:	8192

Details

Name:	00000019.00000002.21900064103.00007FF5DA078000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA078000
Size:	4096

Details

Name:	00000008.00000003.18528508269.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000023.00000003.18309971305.0000015B1A446000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A446000
Size:	8192

Details

Name:	00000025.00000003.18517166097.000002072781E000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072781E000
Size:	16384

Details

Name:	00000008.00000003.17619798624.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000008.00000003.18512099727.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000000.17218486175.000000007FA80000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA80000
Size:	4096

Details

Name:	0000000D.00000002.17941074825.0000000000718000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	718000
Size:	94208

Details

Name:	00000029.00000003.18642895705.000001D4525E2000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E2000
Size:	61440

Details

Name:	0000002E.00000003.21752843358.000001681954D000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681954D000
Size:	8192

Details

Name:	00000019.00000003.18197867872.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000022.00000003.18212375809.00000175342E5000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342E5000
Size:	36864

Details

Name:	00000008.00000002.21892984251.0000000002FB0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2FB0000
Size:	4096

Details

Name:	00000023.00000003.18265806549.0000015B0CA14000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0CA14000
Size:	8192

Details

Name:	0000002E.00000003.21751907826.0000016818CCD000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16818CCD000
Size:	24576

Details

Name:	0000002A.00000002.19959470462.00007FF578DF1000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578DF1000
Size:	12288

Details

Name:	00000029.00000002.19967291364.000001D4525AB000.00000004.00000020.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1D4525AB000
Size:	69632

Details

Name:	0000002E.00000003.21755872783.0000016819C8A000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C8A000
Size:	8192

Details

Name:	00000008.00000003.18626175820.00000000209D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	209D0000
Size:	61440

Details

Name:	00000008.00000003.17686843379.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000000.18190646607.00007FF758840000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF758840000
Size:	4096

Details

Name:	00000023.00000003.18429643834.0000015B1B291000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B291000
Size:	65536

Details

Name:	00000019.00000003.18224833983.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	57344

Details

Name:	00000008.00000003.18503042187.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000018.00000002.21892047360.00007FF5BCE87000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCE87000
Size:	8192

Details

Name:	00000029.00000003.18640125174.000001D4525E0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E0000
Size:	69632

Details

Name:	00000008.00000003.18579092714.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000002.18022059674.00000000015E8000.00000004.00000020.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	15E8000
Size:	94208

Details

Name:	0000002D.00000002.21124476811.00007FF4FCF33000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCF33000
Size:	4096

Details

Name:	0000002E.00000002.21757880052.0000016818C7E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C7E000
Size:	4096

Details

Name:	00000001.00000002.17632823424.0000000000400000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	400000
Size:	4096

Details

Name:	00000008.00000003.18532453252.000000001D241000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D241000
Size:	61440

Details

Name:	00000008.00000003.17714260078.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17612634577.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	28672

Details

Name:	00000008.00000003.18577682906.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18545661623.000000001D2D0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2D0000
Size:	61440

Details

Name:	00000008.00000003.18542730841.000000001D280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D280000
Size:	65536

Details

Name:	00000029.00000002.19967695902.000001D4527A0000.00000004.00000040.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1D4527A0000
Size:	12288

Details

Name:	00000008.00000003.18545782586.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	16384

Details

Name:	00000023.00000003.18350449076.0000015B1B6A0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B6A0000
Size:	118784

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000023.00000003.18411898405.0000015B1B281000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B281000
Size:	65536

Details

Name:	00000019.00000003.18156242870.000001CCFDBE2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBE2000
Size:	53248

Details

Name:	00000008.00000003.18574019713.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000002.21122933603.000002779C200000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	2779C200000
Size:	4096

Details

Name:	0000000D.00000002.17942057266.0000000002320000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2320000
Size:	4096

Details

Name:	00000029.00000003.18647991749.000001D4525E5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E5000
Size:	28672

Details

Name:	00000019.00000003.18166867604.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	00000008.00000003.18519427461.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000000.18220751195.00007FF597A71000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF597A71000
Size:	4096

Details

Name:	00000008.00000003.17620298869.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000023.00000003.18410599226.0000015B1AE5E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AE5E000
Size:	4096

Details

Name:	0000002A.00000003.18683289997.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	126976

Details

Name:	0000002E.00000003.19927710107.0000016819540000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819540000
Size:	110592

Details

Name:	00000008.00000003.17691253397.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000025.00000000.18505434899.00007DF570740000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF570740000
Size:	4096

Details

Name:	00000027.00000003.18538644542.0000016EDFE5A000.00000004.00000040.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	heap private
Protect:	page read and write
Base address:	16EDFE5A000
Size:	20480

Details

Name:	00000019.00000002.21896240680.000001CCFDA13000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA13000
Size:	77824

Details

Name:	00000008.00000003.17692663029.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	16384

Details

Name:	00000008.00000003.18508471175.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000029.00000002.19969023000.00007FF6836BE000.00000004.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page read and write
Base address:	7FF6836BE000
Size:	12288

Details

Name:	00000023.00000003.18411503736.0000015B1B291000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B291000
Size:	65536

Details

Name:	00000029.00000000.18610158525.00007DF5780E0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780E0000
Size:	4096

Details

Name:	00000023.00000003.18343934755.0000015B1BD54000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BD54000
Size:	4096

Details

Name:	00000029.00000003.18649535341.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	69632

Details

Name:	00000008.00000002.21901744995.000000001E223000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1E223000
Size:	4096

Details

Name:	00000019.00000003.18238843100.000001CCFDE6B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE6B000
Size:	4096

Details

Name:	0000002A.00000003.18686372000.00000265030F3000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F3000
Size:	45056

Details

Name:	0000002E.00000003.19926957344.000001681952C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952C000
Size:	40960

Details

Name:	0000000D.00000002.17940662713.00000000004FC000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	4FC000
Size:	16384

Details

Name:	0000000D.00000002.17942790225.000000007FF00000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF00000
Size:	12288

Details

Name:	00000008.00000003.18525224589.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	65536

Details

Name:	0000002D.00000000.19910336132.00007DF5144C2000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5144C2000
Size:	4096

Details

Name:	00000008.00000003.18553771721.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	8192

Details

Name:	0000002E.00000002.21762554182.00007FF5A2AAE000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AAE000
Size:	8192

Details

Name:	00000029.00000003.18664491240.000001D4525C5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525C5000
Size:	200704

Details

Name:	0000002A.00000003.18682150773.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	00000019.00000003.18184224533.000001CCFDA2B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2B000
Size:	12288

Details

Name:	00000008.00000003.17619760005.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000019.00000003.18245663248.000001CCFDBEE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBEE000
Size:	36864

Details

Name:	00000019.00000002.21895512035.000001CCFD670000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD670000
Size:	4096

Details

Name:	00000008.00000003.18573275360.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	00000008.00000003.17715599628.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17614485467.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	24576

Details

Name:	0000002E.00000002.21762934376.00007FF5A2AD6000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AD6000
Size:	8192

Details

Name:	00000025.00000002.18521512723.000002072700F000.00000004.00000020.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2072700F000
Size:	110592

Details

Name:	00000008.00000003.18575581288.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19927627594.000001681952C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681952C000
Size:	40960

Details

Name:	00000027.00000002.18542786618.00007FF57FC7D000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FC7D000
Size:	8192

Details

Name:	0000002A.00000003.18699171969.00000265030FA000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030FA000
Size:	53248

Details

Name:	00000008.00000003.18557123801.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21761830076.00007FF5A29AF000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A29AF000
Size:	8192

Details

Name:	00000001.00000002.17636034500.0000000002CE0000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CE0000
Size:	12288

Details

Name:	00000008.00000002.21900921744.000000001DC60000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1DC60000
Size:	4096

Details

Name:	0000002A.00000002.19957024636.0000026503175000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503175000
Size:	20480

Details

Name:	0000000F.00000002.18024434202.0000000005AB0000.00000040.00000040.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page execute and read and write
Base address:	5AB0000
Size:	4096

Details

Name:	00000008.00000003.18553532856.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17616970071.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	00000025.00000003.18517132463.0000020727813000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20727813000
Size:	4096

Details

Name:	00000019.00000003.18153645523.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000008.00000003.18510465171.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000023.00000003.18333848371.0000015B1A546000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A546000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Yara detected RemCom RemoteAdmin tool	Remote Access Functionality
Yara signature match	System Summary

Details

Name:	00000008.00000003.18018576451.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18197150632.000001CCFDA35000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA35000
Size:	4096

Details

Name:	00000019.00000002.21896004351.000001CCFD830000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD830000
Size:	12288

Details

Name:	00000019.00000003.18180045867.000001CCFDA7E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7E000
Size:	61440

Details

Name:	00000018.00000003.18251130477.00000205EE2B2000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE2B2000
Size:	65536

Details

Name:	00000001.00000002.17633078092.0000000000418000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	418000
Size:	40960

Details

Name:	00000008.00000003.17686411995.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18557237075.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17693949233.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	12288

Details

Name:	00000019.00000003.18167573996.000001CCFDA2F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA2F000
Size:	28672

Details

Name:	00000008.00000003.18509336010.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	0000002A.00000002.19955000577.000000BD264FB000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BD264FB000
Size:	20480

Details

Name:	00000019.00000003.18196156892.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000008.00000003.18504530492.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	20480

Details

Name:	00000023.00000003.18316847212.0000015B1B582000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B582000
Size:	53248

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary

Details

Name:	00000019.00000003.18153904689.000001CCFDE3F000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE3F000
Size:	122880

Details

Name:	00000023.00000003.18314882300.0000015B1B82C000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B82C000
Size:	167936

Details

Name:	00000008.00000003.18555370851.00000000012B2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B2000
Size:	53248

Details

Name:	00000019.00000002.21895840884.000001CCFD7D0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD7D0000
Size:	8192

Details

Name:	0000002A.00000003.19951316031.0000026503260000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503260000
Size:	8192

Details

Name:	0000000D.00000002.17942271151.000000000254D000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	254D000
Size:	12288

Details

Name:	00000019.00000003.18168835921.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000027.00000002.18541143023.0000002CB776B000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2CB776B000
Size:	20480

Details

Name:	0000000D.00000002.17942709980.000000007FEE2000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEE2000
Size:	4096

Details

Name:	00000008.00000003.18551467703.00000000205B8000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205B8000
Size:	114688

Details

Name:	00000008.00000003.17696285286.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18507944114.0000000001771000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1771000
Size:	57344

Details

Name:	00000023.00000003.18296960051.0000015B1BC0A000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BC0A000
Size:	266240

Details

Name:	0000000F.00000003.18019741007.00000000058F0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	58F0000
Size:	12288

Details

Name:	00000008.00000003.18542451896.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	65536

Details

Name:	00000027.00000003.18540269496.0000016EE0376000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0376000
Size:	4096

Details

Name:	00000029.00000003.18648483531.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	69632

Details

Name:	00000008.00000003.18509729729.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17614343813.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	65536

Details

Name:	00000008.00000003.17301953432.0000000001494000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1494000
Size:	4096

Details

Name:	00000025.00000003.18516844144.00000207277F4000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F4000
Size:	49152

Details

Name:	00000019.00000003.18153878957.000001CCFDE23000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE23000
Size:	4096

Details

Name:	00000023.00000003.18296359788.0000015B1C251000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C251000
Size:	245760

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary
Binary contains paths to development resources	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

Details

Name:	0000002E.00000003.19927585459.0000016819529000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819529000
Size:	8192

Details

Name:	00000019.00000003.18133874300.000001CCFD791000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD791000
Size:	12288

Details

Name:	00000008.00000003.18526191725.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	45056

Details

Name:	00000008.00000003.17693353613.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19956333361.0000026503116000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	26503116000
Size:	139264

Details

Name:	00000001.00000002.17632605598.00000000001E0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1E0000
Size:	4096

Details

Name:	0000000D.00000000.17936292342.000000007FEF2000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEF2000
Size:	4096

Details

Name:	00000008.00000002.21891907707.0000000001A10000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1A10000
Size:	73728

Details

Name:	00000008.00000003.18557999036.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000001.18221851163.00007FF791C50000.00000002.00020000.sdmp
TargetID:	35
Dumpstage:	image loaded
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF791C50000
Size:	4096

Details

Name:	00000008.00000003.17618904149.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	0000000D.00000002.17941328913.0000000000749000.00000004.00000020.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	749000
Size:	131072

Details

Name:	0000002A.00000002.19961187204.00007FF57980E000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57980E000
Size:	4096

Details

Name:	00000019.00000002.21890244606.000001CCF7CA6000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7CA6000
Size:	4096

Details

Name:	00000019.00000003.18167457606.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	0000002A.00000003.19952883412.00000265030C6000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030C6000
Size:	8192

Details

Name:	00000008.00000003.17619992779.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000008.00000003.18560527693.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000000F.00000000.18016166583.0000000000F50000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	F50000
Size:	4096

Details

Name:	00000008.00000003.18529878191.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	0000000D.00000002.17940591920.00000000003B5000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	3B5000
Size:	4096

Details

Name:	00000025.00000002.18520618269.000000BFF387B000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	BFF387B000
Size:	20480

Details

Name:	0000002E.00000002.21759865778.0000016819C34000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C34000
Size:	65536

Details

Name:	0000002E.00000002.21761049285.00007FF5A1F22000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A1F22000
Size:	28672

Details

Name:	00000001.00000003.16921399176.000000001CDD1000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CDD1000
Size:	49152

Details

Name:	0000002A.00000003.19922827353.000002650311F000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650311F000
Size:	65536

Details

Name:	00000019.00000002.21896851325.000001CCFDB00000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB00000
Size:	8192

Details

Name:	00000019.00000003.18209504549.000001CCFDA74000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA74000
Size:	24576

Details

Name:	00000022.00000003.18212260940.00000175342E5000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342E5000
Size:	49152

Details

Name:	00000019.00000003.18133376455.000001CCFD779000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD779000
Size:	4096

Details

Name:	00000029.00000003.19966268272.000001D4525E1000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E1000
Size:	8192

Details

Name:	00000008.00000003.17683386452.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17612592885.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	8192

Details

Name:	00000008.00000003.17617106340.0000000020760000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20760000
Size:	24576

Details

Name:	0000002D.00000002.21122988853.000002779C220000.00000004.00000020.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	2779C220000
Size:	8192

Details

Name:	00000027.00000002.18543144855.00007FF57FDE2000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57FDE2000
Size:	40960

Details

Name:	00000008.00000002.21912738491.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	65536

Details

Name:	0000002A.00000003.18692726659.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	65536

Details

Name:	00000008.00000003.18522370417.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	45056

Details

Name:	00000019.00000002.21889154958.000001CCF7C40000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C40000
Size:	65536

Details

Name:	00000001.00000002.17633169461.0000000000431000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	431000
Size:	12288

Details

Name:	0000002E.00000003.21753948654.0000016819515000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819515000
Size:	4096

Details

Name:	00000008.00000003.17690248608.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	0000002E.00000002.21760826228.00007DF5B9FB2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FB2000
Size:	4096

Details

Name:	00000023.00000003.18352255261.0000015B1AC4E000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AC4E000
Size:	4096

Details

Name:	00000008.00000003.18502892088.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000000D.00000000.17936258477.000000007FEF0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEF0000
Size:	4096

Details

Name:	00000025.00000003.18518991880.00000207277F7000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277F7000
Size:	20480

Details

Name:	00000008.00000003.18507069600.0000000001350000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1350000
Size:	12288

Details

Name:	0000002E.00000003.21753407759.0000016819528000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819528000
Size:	57344

Details

Name:	0000002A.00000003.18693134437.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	53248

Details

Name:	00000008.00000003.17683946271.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000003.18215642494.00000175342F1000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342F1000
Size:	262144

Details

Name:	00000008.00000003.18542220979.000000001D2C7000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C7000
Size:	36864

Details

Name:	00000029.00000002.19968209530.00007FF560BEB000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560BEB000
Size:	20480

Details

Name:	00000023.00000003.18340705312.0000015B1B725000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B725000
Size:	16384

Details

Name:	00000022.00000002.18580505849.00000175342CB000.00000004.00000020.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	175342CB000
Size:	32768

Details

Name:	00000029.00000003.18651186070.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	32768

Details

Name:	00000019.00000003.18239695574.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	57344

Details

Name:	00000008.00000003.18551209313.00000000205D4000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205D4000
Size:	81920

Details

Name:	0000002D.00000002.21123712613.000002779C502000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C502000
Size:	4096

Details

Name:	00000019.00000003.18211150432.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000022.00000002.18581033188.00007FF524811000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF524811000
Size:	4096

Details

Name:	00000008.00000003.18555597481.00000000012B0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12B0000
Size:	32768

Details

Name:	00000008.00000003.18507464106.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	36864

Details

Name:	00000008.00000002.21901917816.000000001E230000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E230000
Size:	40960

Details

Name:	00000008.00000003.18551640552.00000000205C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	205C0000
Size:	81920

Details

Name:	00000008.00000003.18530212670.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	16384

Details

Name:	00000008.00000003.18519146876.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18154602512.000001CCF85A3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85A3000
Size:	61440

Details

Name:	00000029.00000003.18639707807.000001D4525DE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DE000
Size:	28672

Details

Name:	00000019.00000002.21890838369.000001CCF7D13000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7D13000
Size:	4096

Details

Name:	00000008.00000003.17682831916.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18661296716.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	65536

Details

Name:	00000008.00000003.17693570869.00000000012C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	12C0000
Size:	16384

Details

Name:	00000008.00000003.17683603155.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18344332390.0000015B1C1B7000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C1B7000
Size:	114688

Signature Hits	Behavior Group	Mitre Attack
Binary contains paths to development resources	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
URLs found in memory or binary data	Networking

Details

Name:	00000022.00000003.18209311493.00000175342B0000.00000004.00000001.sdmp
TargetID:	34
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	175342B0000
Size:	65536

Details

Name:	00000008.00000003.18529105888.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000008.00000002.21912523428.000000002073D000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	2073D000
Size:	69632

Details

Name:	00000018.00000002.21894550922.00007FF5BD314000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD314000
Size:	20480

Details

Name:	00000029.00000000.18610089830.00007DF5780D0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780D0000
Size:	4096

Details

Name:	00000008.00000002.21890767700.000000000163D000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	163D000
Size:	8192

Details

Name:	0000002E.00000002.21760006928.0000016819C45000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C45000
Size:	49152

Details

Name:	00000008.00000003.18625316372.000000001DC20000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1DC20000
Size:	16384

Details

Name:	00000008.00000003.18558176220.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21753506642.000001681953E000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953E000
Size:	12288

Details

Name:	00000019.00000003.18133304732.000001CCFD775000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD775000
Size:	12288

Details

Name:	00000008.00000003.18550530728.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000018.00000002.21886475278.00000030362FD000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	30362FD000
Size:	12288

Details

Name:	0000002E.00000002.21759184855.0000016818F10000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16818F10000
Size:	8192

Details

Name:	00000008.00000003.18521941341.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	45056

Details

Name:	00000008.00000003.17615039075.000000001E315000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E315000
Size:	12288

Details

Name:	0000000F.00000002.18022918468.0000000001970000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1970000
Size:	36864

Details

Name:	00000008.00000002.21888152543.0000000001510000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1510000
Size:	4096

Details

Name:	00000008.00000003.18515496182.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.17695720720.0000000001340000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1340000
Size:	8192

Details

Name:	0000002A.00000003.19951070637.000002650317A000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2650317A000
Size:	20480

Details

Name:	00000008.00000003.17695339764.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000022.00000002.18580238365.0000017534120000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	17534120000
Size:	12288

Details

Name:	0000002A.00000003.18689330226.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	262144

Details

Name:	0000002A.00000003.18680986588.00000265030EF000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030EF000
Size:	262144

Details

Name:	00000008.00000003.17620648073.0000000020775000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20775000
Size:	8192

Details

Name:	00000008.00000003.17715462266.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18519904979.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	36864

Details

Name:	00000027.00000002.18541755307.0000016EDFBB0000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFBB0000
Size:	4096

Details

Name:	00000025.00000003.18518004348.000002072782C000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2072782C000
Size:	36864

Details

Name:	00000008.00000003.18627821779.00000000207E0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207E0000
Size:	8192

Details

Name:	00000019.00000002.21899351333.00007FF5D9CEE000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9CEE000
Size:	4096

Details

Name:	00000001.00000002.17634558099.0000000002244000.00000004.00000040.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	2244000
Size:	4096

Details

Name:	00000023.00000003.18326202359.0000015B1ACD2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ACD2000
Size:	262144

Details

Name:	0000002E.00000003.21752480016.0000016819554000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819554000
Size:	8192

Details

Name:	00000022.00000000.18190286636.0000017534100000.00000002.00020000.sdmp
TargetID:	34
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	17534100000
Size:	118784

Details

Name:	00000023.00000003.18248588438.0000015B0BB16000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0BB16000
Size:	10485760

Details

Name:	0000002A.00000002.19957521788.0000026503670000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26503670000
Size:	4096

Details

Name:	00000008.00000003.18512574133.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18508367279.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	12288

Details

Name:	00000029.00000003.18651702550.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	40960

Details

Name:	0000002E.00000002.21756579826.00000039AFC7B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	39AFC7B000
Size:	20480

Details

Name:	0000002D.00000002.21124559437.00007FF4FCFA0000.00000002.00020000.sdmp
TargetID:	45
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF4FCFA0000
Size:	8192

Details

Name:	00000008.00000003.18515271077.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18525678355.0000000001780000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1780000
Size:	53248

Details

Name:	0000002A.00000002.19955867916.00000265030BA000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265030BA000
Size:	16384

Details

Name:	00000025.00000002.18520954627.0000020726E90000.00000002.00020000.sdmp
TargetID:	37
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	20726E90000
Size:	118784

Details

Name:	00000008.00000003.18624042962.000000001D2C0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2C0000
Size:	65536

Details

Name:	0000000D.00000002.17942179218.00000000023C0000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	23C0000
Size:	4096

Details

Name:	0000002A.00000003.19953476975.0000026503139000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503139000
Size:	8192

Details

Name:	00000023.00000003.18318342429.0000015B1C460000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C460000
Size:	266240

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000008.00000003.18561504712.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21757919580.0000016818C80000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16818C80000
Size:	4096

Details

Name:	00000019.00000003.18166442417.000001CCFDBF2000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBF2000
Size:	20480

Details

Name:	00000019.00000003.18209750671.000001CCFDA95000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA95000
Size:	77824

Details

Name:	00000027.00000003.18538538794.0000016EE03AE000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE03AE000
Size:	16384

Details

Name:	00000008.00000003.18513241581.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	12288

Details

Name:	00000029.00000003.18630242572.000001D4525D5000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525D5000
Size:	200704

Details

Name:	00000008.00000003.17696137240.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.19940725128.0000016819CB2000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819CB2000
Size:	20480

Details

Name:	0000002A.00000003.18668595906.0000026503040000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503040000
Size:	65536

Details

Name:	0000002A.00000002.19955775582.00000265030A7000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	265030A7000
Size:	16384

Details

Name:	00000008.00000003.17696937134.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18411055797.0000015B1A449000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1A449000
Size:	4096

Details

Name:	00000008.00000003.17696073816.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21759687263.0000016819C0B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819C0B000
Size:	28672

Details

Name:	00000023.00000003.18308684776.0000015B1B9FA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B9FA000
Size:	266240

Details

Name:	00000029.00000002.19967881169.00007DF5780E0000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5780E0000
Size:	4096

Details

Name:	00000019.00000003.18196979817.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000008.00000003.18545089755.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	12288

Details

Name:	00000023.00000003.18244844735.0000015B0B6BC000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6BC000
Size:	135168

Details

Name:	00000001.00000000.16839971792.000000007FFB0000.00000002.00020000.sdmp
TargetID:	1
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FFB0000
Size:	4096

Details

Name:	00000019.00000003.18132662782.000001CCFD75E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD75E000
Size:	4096

Details

Name:	0000002A.00000002.19961521366.00007FF57983A000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57983A000
Size:	12288

Details

Name:	00000029.00000002.19968310014.00007FF560C06000.00000002.00020000.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF560C06000
Size:	24576

Details

Name:	00000027.00000003.18540159755.0000016EE0362000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0362000
Size:	8192

Details

Name:	0000002A.00000003.18698109106.0000026503126000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503126000
Size:	69632

Details

Name:	00000008.00000003.17697244022.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17618819355.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	24576

Details

Name:	0000002E.00000002.21761256953.00007FF5A2670000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2670000
Size:	8192

Details

Name:	0000002E.00000003.21754090677.000001681951C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681951C000
Size:	49152

Details

Name:	00000023.00000003.18328449327.0000015B1C317000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1C317000
Size:	188416

Details

Name:	00000008.00000003.18514891798.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000002E.00000003.21753556075.0000016819546000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819546000
Size:	8192

Details

Name:	0000002E.00000003.21754539487.0000016819522000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819522000
Size:	24576

Details

Name:	00000008.00000003.18576145112.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18262560984.0000015B0C751000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C751000
Size:	8192

Details

Name:	0000002A.00000003.19942804635.0000026503C30000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503C30000
Size:	4096

Details

Name:	00000023.00000003.18312854355.0000015B1ADDA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ADDA000
Size:	266240

Details

Name:	00000019.00000000.18130224945.00007FF5DA79E000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA79E000
Size:	16384

Details

Name:	0000000D.00000002.17940132741.0000000000120000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	120000
Size:	4096

Details

Name:	00000008.00000003.18513708542.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	00000008.00000003.18543333624.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	20480

Details

Name:	00000008.00000003.17688046091.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000029.00000003.18645951273.000001D4525E3000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E3000
Size:	32768

Details

Name:	00000019.00000002.21894741253.000001CCF9110000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1CCF9110000
Size:	65536

Details

Name:	0000002A.00000002.19959186042.00007DF590D40000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF590D40000
Size:	4096

Details

Name:	00000023.00000003.18231034020.0000015B0AA76000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0AA76000
Size:	10485760

Details

Name:	00000019.00000003.18136885744.000001CCFDA5A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA5A000
Size:	28672

Details

Name:	0000000D.00000002.17942243101.000000000250E000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	250E000
Size:	8192

Details

Name:	0000002A.00000003.18697159720.0000026503109000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503109000
Size:	98304

Details

Name:	00000023.00000003.18333539153.0000015B1ACD2000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ACD2000
Size:	262144

Details

Name:	0000002A.00000003.18690205840.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	61440

Details

Name:	00000008.00000003.18503159512.00000000017A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	17A0000
Size:	49152

Details

Name:	00000019.00000002.21893823309.000001CCF85C3000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF85C3000
Size:	32768

Details

Name:	00000018.00000002.21891748787.00007FF5BCB26000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BCB26000
Size:	4096

Details

Name:	00000019.00000002.21889671276.000001CCF7C7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF7C7B000
Size:	12288

Details

Name:	00000008.00000003.18505819873.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17687659042.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18693347393.00000265030F7000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F7000
Size:	40960

Details

Name:	00000008.00000003.17618777596.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	16384

Details

Name:	0000002E.00000002.21759422532.0000016819390000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	16819390000
Size:	4096

Details

Name:	00000023.00000003.18261846086.0000015B0C6B3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0C6B3000
Size:	602112

Details

Name:	00000008.00000003.18517638110.0000000001771000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1771000
Size:	53248

Details

Name:	00000019.00000003.18210864359.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	24576

Details

Name:	00000019.00000003.18214055731.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	24576

Details

Name:	00000019.00000003.18181648498.000001CCFDE46000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDE46000
Size:	237568

Details

Name:	00000008.00000002.21905535951.000000001E58E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E58E000
Size:	16384

Details

Name:	00000008.00000003.18576755879.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21899881830.00007FF5DA06B000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA06B000
Size:	4096

Details

Name:	00000008.00000003.18500589795.000000001D1F0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D1F0000
Size:	65536

Details

Name:	0000002A.00000003.18691806927.00000265030F5000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F5000
Size:	57344

Details

Name:	00000008.00000003.17713347594.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18519073414.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21897612105.000001CCFDB78000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDB78000
Size:	53248

Details

Name:	00000019.00000003.18184884995.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	0000002A.00000003.19951841208.00000265030C8000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030C8000
Size:	266240

Details

Name:	00000019.00000003.18152029034.000001CCF858E000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF858E000
Size:	77824

Details

Name:	0000002E.00000002.21760866366.00007DF5B9FC0000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5B9FC0000
Size:	4096

Details

Name:	00000008.00000003.18559113109.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000002.21762603057.00007FF5A2AB5000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AB5000
Size:	8192

Details

Name:	00000029.00000003.18653233070.000001D4525EA000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525EA000
Size:	28672

Details

Name:	00000029.00000002.19967614033.000001D4526A0000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4526A0000
Size:	8192

Details

Name:	00000018.00000002.21889477002.00000205EE300000.00000004.00000001.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	205EE300000
Size:	4096

Details

Name:	00000008.00000003.17691388885.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.18682968717.00000265030F0000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F0000
Size:	258048

Details

Name:	00000008.00000002.21913101523.00000000208A0000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	208A0000
Size:	925696

Details

Name:	00000001.00000002.17633800365.00000000007EE000.00000004.00000001.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	7EE000
Size:	8192

Details

Name:	00000019.00000003.18210987810.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	45056

Details

Name:	00000008.00000002.21904446163.000000001E4C2000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1E4C2000
Size:	151552

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Details

Name:	00000008.00000003.17712751489.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000002.21899042173.00007FF5D9807000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5D9807000
Size:	12288

Details

Name:	00000023.00000003.18269060136.0000015B08189000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B08189000
Size:	65536

Details

Name:	00000008.00000003.18504700216.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17685751671.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21755393790.000001681953B000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953B000
Size:	4096

Details

Name:	00000023.00000003.18326028548.0000015B1ACB0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ACB0000
Size:	135168

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	0000002A.00000002.19955366345.0000026502F30000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	26502F30000
Size:	4096

Details

Name:	00000008.00000003.18533486281.000000001D280000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D280000
Size:	45056

Details

Name:	0000002E.00000002.21762756585.00007FF5A2AC2000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2AC2000
Size:	4096

Details

Name:	00000008.00000003.18543261476.000000001D250000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D250000
Size:	20480

Details

Name:	00000019.00000003.18132200589.000001CCFD74A000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD74A000
Size:	8192

Details

Name:	00000019.00000002.21902086122.00007FF5DA702000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA702000
Size:	4096

Details

Name:	0000002A.00000003.19950812195.0000026503150000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503150000
Size:	4096

Details

Name:	00000008.00000003.17619531460.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	28672

Details

Name:	00000025.00000003.18519078405.00000207277FE000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277FE000
Size:	8192

Details

Name:	0000000D.00000002.17942738474.000000007FEF0000.00000002.00020000.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FEF0000
Size:	4096

Details

Name:	00000018.00000002.21890809572.00007DF5D4772000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7DF5D4772000
Size:	4096

Details

Name:	00000019.00000003.18166968547.000001CCFDA7B000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA7B000
Size:	12288

Details

Name:	00000019.00000002.21896502542.000001CCFDA48000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA48000
Size:	65536

Details

Name:	00000008.00000003.18548331257.000000001D2A0000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D2A0000
Size:	4096

Details

Name:	00000008.00000003.17684007583.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18575112511.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002D.00000003.19921054020.000002779C434000.00000004.00000001.sdmp
TargetID:	45
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	2779C434000
Size:	172032

Details

Name:	00000019.00000003.18224778664.000001CCFDA73000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA73000
Size:	28672

Details

Name:	00000008.00000003.18557591551.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002E.00000003.21755298248.0000016819574000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819574000
Size:	12288

Details

Name:	00000008.00000003.18573566106.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18522494910.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	65536

Details

Name:	00000008.00000003.17717672101.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18018304557.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18505027399.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21912958096.00000000207CD000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	207CD000
Size:	12288

Details

Name:	00000008.00000002.21890377787.0000000001617000.00000004.00000020.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	1617000
Size:	69632

Details

Name:	00000008.00000003.17693316106.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19960982197.00007FF5797EE000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5797EE000
Size:	8192

Details

Name:	00000008.00000002.21899736097.000000001D270000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1D270000
Size:	4096

Details

Name:	0000002E.00000003.21754663336.0000016819524000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819524000
Size:	16384

Details

Name:	0000000F.00000002.18021462372.0000000001300000.00000002.00020000.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	1300000
Size:	16384

Details

Name:	00000001.00000002.17633373574.000000000045D000.00000004.00000020.sdmp
TargetID:	1
Dumpstage:	process exit
Regiontype:	heap default
Protect:	page read and write
Base address:	45D000
Size:	65536

Details

Name:	00000008.00000003.17620424264.0000000020770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20770000
Size:	16384

Details

Name:	00000029.00000003.18657995874.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	65536

Details

Name:	00000027.00000002.18541431456.0000016EDFA20000.00000002.00020000.sdmp
TargetID:	39
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	16EDFA20000
Size:	118784

Details

Name:	00000008.00000003.18560592094.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21913058097.00000000207F4000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	207F4000
Size:	4096

Details

Name:	00000008.00000002.21914220341.0000000020A3E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	20A3E000
Size:	8192

Details

Name:	00000029.00000003.18651301353.000001D4525E8000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E8000
Size:	28672

Details

Name:	0000002E.00000002.21763710338.00007FF5A2B5E000.00000002.00020000.sdmp
TargetID:	46
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5A2B5E000
Size:	16384

Details

Name:	00000008.00000002.21887280758.00000000012FC000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	12FC000
Size:	16384

Details

Name:	00000008.00000003.17617214961.000000001E310000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1E310000
Size:	20480

Details

Name:	0000002A.00000003.19953962159.00000265030AB000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030AB000
Size:	16384

Details

Name:	0000000D.00000002.17941755784.0000000000B64000.00000004.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	B64000
Size:	8192

Details

Name:	00000008.00000003.18533832633.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	65536

Details

Name:	00000023.00000003.18343226894.0000015B1ABCA000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1ABCA000
Size:	4096

Details

Name:	00000019.00000002.21891960421.000001CCF8500000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF8500000
Size:	73728

Details

Name:	00000008.00000003.17690903709.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	16384

Details

Name:	00000023.00000003.18295178039.0000015B1AFEB000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AFEB000
Size:	172032

Details

Name:	00000019.00000002.21891543855.000001CCF83D1000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF83D1000
Size:	4096

Details

Name:	00000025.00000003.18517045099.00000207277E1000.00000004.00000001.sdmp
TargetID:	37
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	207277E1000
Size:	4096

Details

Name:	00000008.00000003.18547912807.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18576452240.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17687926569.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18134185761.000001CCFD73C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFD73C000
Size:	4096

Details

Name:	00000019.00000002.21891602454.000001CCF83F0000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCF83F0000
Size:	16384

Details

Name:	00000008.00000003.18018705261.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18519362170.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000003.19923358413.0000026503132000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	26503132000
Size:	4096

Details

Name:	00000008.00000003.17687452810.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000002.21891650065.0000000001800000.00000004.00000040.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	heap private
Protect:	page read and write
Base address:	1800000
Size:	16384

Details

Name:	00000008.00000003.18517285483.0000000001790000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1790000
Size:	65536

Details

Name:	00000019.00000003.18441529740.000001CCFDBEA000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDBEA000
Size:	16384

Details

Name:	00000029.00000003.18639899504.000001D4525DE000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525DE000
Size:	32768

Details

Name:	0000002E.00000003.21755825078.0000016819500000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16819500000
Size:	8192

Details

Name:	00000008.00000003.17687175367.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17686290590.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.18561618366.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18341450740.0000015B1B4D3000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B4D3000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	0000002A.00000002.19961664397.00007FF57983E000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF57983E000
Size:	12288

Details

Name:	00000008.00000003.18576863550.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19960361340.00007FF5796EF000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5796EF000
Size:	8192

Details

Name:	00000019.00000002.21901440065.00007FF5DA6CE000.00000002.00020000.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5DA6CE000
Size:	4096

Details

Name:	00000008.00000003.18558600609.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000008.00000003.17617507978.0000000020550000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	20550000
Size:	94208

Details

Name:	00000019.00000002.21886866169.00000052710FE000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	52710FE000
Size:	8192

Details

Name:	00000019.00000003.18139621965.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	0000000F.00000003.18020090160.00000000058E0000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	58E0000
Size:	65536

Details

Name:	00000008.00000003.18507732111.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	20480

Details

Name:	00000008.00000002.21899806596.000000001D290000.00000040.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	1D290000
Size:	65536

Details

Name:	00000008.00000003.17717193914.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18244765067.0000015B0B6B0000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B0B6B0000
Size:	8192

Details

Name:	00000008.00000003.17716846373.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000019.00000003.18213966036.000001CCFDA9C000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA9C000
Size:	49152

Details

Name:	00000008.00000003.18527416840.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	16384

Details

Name:	00000029.00000003.18649406954.000001D4525E7000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525E7000
Size:	32768

Details

Name:	00000008.00000002.21887359209.000000000133E000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	133E000
Size:	8192

Details

Name:	0000002E.00000003.21753153947.000001681953C000.00000004.00000001.sdmp
TargetID:	46
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1681953C000
Size:	4096

Details

Name:	00000023.00000003.18285552638.0000015B1B281000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1B281000
Size:	98304

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	00000019.00000003.18169348788.000001CCFDA94000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA94000
Size:	4096

Details

Name:	00000023.00000003.18310667601.0000015B1AD99000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AD99000
Size:	262144

Signature Hits	Behavior Group	Mitre Attack
Yara signature match	System Summary

Details

Name:	0000002A.00000002.19961313101.00007FF579820000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF579820000
Size:	16384

Details

Name:	00000029.00000003.18655734635.000001D4525ED000.00000004.00000001.sdmp
TargetID:	41
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D4525ED000
Size:	69632

Details

Name:	00000008.00000003.18558990341.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19959662386.00007FF578FE9000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF578FE9000
Size:	4096

Details

Name:	0000000D.00000002.17941692767.0000000000B5D000.00000040.00000001.sdmp
TargetID:	13
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page execute and read and write
Base address:	B5D000
Size:	4096

Details

Name:	00000008.00000003.18528857165.000000001D240000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D240000
Size:	12288

Details

Name:	00000008.00000000.17218453155.000000007FA70000.00000002.00020000.sdmp
TargetID:	8
Dumpstage:	process new
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FA70000
Size:	4096

Details

Name:	00000023.00000003.18288679273.0000015B1BA7F000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1BA7F000
Size:	258048

Details

Name:	00000008.00000003.18522913054.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	00000023.00000003.18346153630.0000015B1AB4D000.00000004.00000001.sdmp
TargetID:	35
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	15B1AB4D000
Size:	237568

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Yara signature match	System Summary

Details

Name:	00000008.00000003.17690543186.0000000001270000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1270000
Size:	65536

Details

Name:	0000002A.00000003.18687601248.00000265030F4000.00000004.00000001.sdmp
TargetID:	42
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	265030F4000
Size:	262144

Details

Name:	00000019.00000003.18181250432.000001CCFDA26000.00000004.00000001.sdmp
TargetID:	25
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1CCFDA26000
Size:	20480

Details

Name:	00000008.00000003.18546177541.000000001D290000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D290000
Size:	65536

Details

Name:	00000008.00000003.18561198591.000000001D0B1000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1D0B1000
Size:	4096

Details

Name:	0000002A.00000002.19962540910.00007FF5798A7000.00000002.00020000.sdmp
TargetID:	42
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5798A7000
Size:	4096

Details

Name:	00000008.00000003.18514940362.0000000001770000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1770000
Size:	16384

Details

Name:	0000000F.00000002.18023723396.00000000031D4000.00000004.00000001.sdmp
TargetID:	15
Dumpstage:	process exit
Regiontype:	unkown
Protect:	page read and write
Base address:	31D4000
Size:	8192

Details

Name:	00000027.00000003.18538166666.0000016EE0384000.00000004.00000001.sdmp
TargetID:	39
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	16EE0384000
Size:	49152

Details

Name:	00000018.00000002.21893443567.00007FF5BD285000.00000002.00020000.sdmp
TargetID:	24
Dumpstage:	process exit
Regiontype:	unkown image
Protect:	page readonly
Base address:	7FF5BD285000
Size:	20480

Details

Name:	00000008.00000003.17684376216.0000000001220000.00000004.00000001.sdmp
TargetID:	8
Dumpstage:	free memory
Regiontype:	unkown
Protect:	page read and write
Base address:	1220000
Size:	4096

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps