Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 03:56
Behavioral task
behavioral1
Sample
12312de68052a05888a9cf9d804cec6c.exe
Resource
win7-20220812-en
General
-
Target
12312de68052a05888a9cf9d804cec6c.exe
-
Size
2.6MB
-
MD5
12312de68052a05888a9cf9d804cec6c
-
SHA1
ddae2aaadb5b462c95a768d15b9cbb8ddc97571f
-
SHA256
561c42758fa04340f8d121384f586adfe1a032e1dcdf7580e5047a7e7dc42e8c
-
SHA512
02f0c91703a50c57f7ab24b05676933d8ce102a0da608a610b6fb066dffed1a32affe6dcdccb9aeb79c1714b134ada7b2c2a9219f8d3d6ed2cf13b4fa8348630
-
SSDEEP
49152:XpTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:XZpktrvTOqp2Nw3L0gRbfGI8sepeu1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3568 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1100 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 516 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2572 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4032 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3964 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3616 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2860 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2172 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1956 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 620 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4600 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2588 3952 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3376 3952 schtasks.exe -
Processes:
12312de68052a05888a9cf9d804cec6c.exewininit.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe -
Processes:
resource yara_rule behavioral2/memory/3672-132-0x0000000000770000-0x0000000000A14000-memory.dmp dcrat C:\Recovery\WindowsRE\wininit.exe dcrat C:\Recovery\WindowsRE\wininit.exe dcrat behavioral2/memory/5508-202-0x00000000000C0000-0x0000000000364000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
wininit.exepid process 5508 wininit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
12312de68052a05888a9cf9d804cec6c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 12312de68052a05888a9cf9d804cec6c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
12312de68052a05888a9cf9d804cec6c.exewininit.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12312de68052a05888a9cf9d804cec6c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 49 ipinfo.io 48 ipinfo.io -
Drops file in Program Files directory 10 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exedescription ioc process File created C:\Program Files (x86)\Windows Mail\lsass.exe 12312de68052a05888a9cf9d804cec6c.exe File created C:\Program Files (x86)\Windows Mail\6203df4a6bafc7 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\RCXCA63.tmp 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXDA1D.tmp 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXDACA.tmp 12312de68052a05888a9cf9d804cec6c.exe File created C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe 12312de68052a05888a9cf9d804cec6c.exe File created C:\Program Files\Microsoft Office\PackageManifests\eddb19405b7ce1 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\RCXCAE1.tmp 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Program Files (x86)\Windows Mail\lsass.exe 12312de68052a05888a9cf9d804cec6c.exe -
Drops file in Windows directory 6 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exedescription ioc process File created C:\Windows\assembly\services.exe 12312de68052a05888a9cf9d804cec6c.exe File created C:\Windows\assembly\c5b4cb5e9653cc 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Windows\assembly\RCXC155.tmp 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Windows\assembly\RCXC1D3.tmp 12312de68052a05888a9cf9d804cec6c.exe File opened for modification C:\Windows\assembly\services.exe 12312de68052a05888a9cf9d804cec6c.exe File created C:\Windows\diagnostics\dllhost.exe 12312de68052a05888a9cf9d804cec6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4656 schtasks.exe 1100 schtasks.exe 1056 schtasks.exe 4600 schtasks.exe 2572 schtasks.exe 2588 schtasks.exe 3376 schtasks.exe 1956 schtasks.exe 2320 schtasks.exe 2860 schtasks.exe 1552 schtasks.exe 516 schtasks.exe 1644 schtasks.exe 3152 schtasks.exe 1884 schtasks.exe 3956 schtasks.exe 2524 schtasks.exe 2172 schtasks.exe 4556 schtasks.exe 2768 schtasks.exe 3496 schtasks.exe 4900 schtasks.exe 3568 schtasks.exe 3964 schtasks.exe 532 schtasks.exe 620 schtasks.exe 4916 schtasks.exe 1668 schtasks.exe 4160 schtasks.exe 1092 schtasks.exe 4520 schtasks.exe 4032 schtasks.exe 3616 schtasks.exe 2792 schtasks.exe 4052 schtasks.exe 1772 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 12312de68052a05888a9cf9d804cec6c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 1844 powershell.exe 1844 powershell.exe 3592 powershell.exe 3592 powershell.exe 1416 powershell.exe 1416 powershell.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 3128 powershell.exe 3128 powershell.exe 3672 12312de68052a05888a9cf9d804cec6c.exe 1976 powershell.exe 1976 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wininit.exepid process 5508 wininit.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewininit.exevssvc.exedescription pid process Token: SeDebugPrivilege 3672 12312de68052a05888a9cf9d804cec6c.exe Token: SeDebugPrivilege 1844 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 1416 powershell.exe Token: SeDebugPrivilege 3128 powershell.exe Token: SeDebugPrivilege 1976 powershell.exe Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 4804 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 5508 wininit.exe Token: SeBackupPrivilege 4264 vssvc.exe Token: SeRestorePrivilege 4264 vssvc.exe Token: SeAuditPrivilege 4264 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wininit.exepid process 5508 wininit.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.execmd.exedescription pid process target process PID 3672 wrote to memory of 1844 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1844 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1416 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1416 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3592 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3592 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 952 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 952 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3128 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3128 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1976 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1976 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 4804 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 4804 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3176 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3176 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 4296 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 4296 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2200 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2200 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2264 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2264 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1296 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 1296 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2760 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 2760 3672 12312de68052a05888a9cf9d804cec6c.exe powershell.exe PID 3672 wrote to memory of 3720 3672 12312de68052a05888a9cf9d804cec6c.exe cmd.exe PID 3672 wrote to memory of 3720 3672 12312de68052a05888a9cf9d804cec6c.exe cmd.exe PID 3720 wrote to memory of 3548 3720 cmd.exe w32tm.exe PID 3720 wrote to memory of 3548 3720 cmd.exe w32tm.exe PID 3720 wrote to memory of 5508 3720 cmd.exe wininit.exe PID 3720 wrote to memory of 5508 3720 cmd.exe wininit.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
12312de68052a05888a9cf9d804cec6c.exewininit.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12312de68052a05888a9cf9d804cec6c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12312de68052a05888a9cf9d804cec6c.exe"C:\Users\Admin\AppData\Local\Temp\12312de68052a05888a9cf9d804cec6c.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12312de68052a05888a9cf9d804cec6c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SearchApp.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\spoolsv.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\RuntimeBroker.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\lsass.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\services.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQ25hERLBD.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Recovery\WindowsRE\wininit.exe"C:\Recovery\WindowsRE\wininit.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\assembly\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\odt\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\PackageManifests\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\WindowsRE\wininit.exeFilesize
2.6MB
MD570e136ebea49be2795e91753ddaefe90
SHA1d9982aec715226d94d68fc9a581d04ff8eb0fae7
SHA25609c2caf36828764cfe255d92c8a18c66b1f58d0c46c31ff645953eef7933b6da
SHA512c999cddb29b4f7cbb8ece1318d088c0d82c321a620c12536a5647a1802a1a92b29911d8c0e61cfa089a167d16495752ef5154aaee14cb36943aa0137398889b0
-
C:\Recovery\WindowsRE\wininit.exeFilesize
2.6MB
MD570e136ebea49be2795e91753ddaefe90
SHA1d9982aec715226d94d68fc9a581d04ff8eb0fae7
SHA25609c2caf36828764cfe255d92c8a18c66b1f58d0c46c31ff645953eef7933b6da
SHA512c999cddb29b4f7cbb8ece1318d088c0d82c321a620c12536a5647a1802a1a92b29911d8c0e61cfa089a167d16495752ef5154aaee14cb36943aa0137398889b0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Temp\yQ25hERLBD.batFilesize
198B
MD5317a3da345aa06cb7f9f06963912d9cd
SHA1896aed711a7d406a4439ebb2aea3b154fa14d142
SHA2561ee92c8b705c803ae5117a3973a73de5c3b945b28abd8af970be1522e7558fd3
SHA512e961163c6fc79370d6514a294033137a7d58cbdb76c8d425b72d64ff747c8282e894c1e9cd8b66f812312ef2562534764153f0dff125fd308b57b58b12ac2494
-
memory/952-193-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/952-160-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/952-142-0x0000000000000000-mapping.dmp
-
memory/1296-172-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1296-196-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1296-150-0x0000000000000000-mapping.dmp
-
memory/1416-140-0x0000000000000000-mapping.dmp
-
memory/1416-154-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1416-179-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1844-152-0x0000018FEA5C0000-0x0000018FEA5E2000-memory.dmpFilesize
136KB
-
memory/1844-177-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1844-139-0x0000000000000000-mapping.dmp
-
memory/1844-153-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1976-144-0x0000000000000000-mapping.dmp
-
memory/1976-163-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/1976-189-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2200-188-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2200-148-0x0000000000000000-mapping.dmp
-
memory/2200-169-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2264-197-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2264-149-0x0000000000000000-mapping.dmp
-
memory/2264-171-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2760-170-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2760-195-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/2760-151-0x0000000000000000-mapping.dmp
-
memory/3128-143-0x0000000000000000-mapping.dmp
-
memory/3128-157-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3128-181-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3176-167-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3176-182-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3176-146-0x0000000000000000-mapping.dmp
-
memory/3548-165-0x0000000000000000-mapping.dmp
-
memory/3592-141-0x0000000000000000-mapping.dmp
-
memory/3592-178-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3592-156-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3672-134-0x000000001E540000-0x000000001EA68000-memory.dmpFilesize
5.2MB
-
memory/3672-132-0x0000000000770000-0x0000000000A14000-memory.dmpFilesize
2.6MB
-
memory/3672-159-0x000000001CC69000-0x000000001CC6F000-memory.dmpFilesize
24KB
-
memory/3672-162-0x000000001F1B4000-0x000000001F1B7000-memory.dmpFilesize
12KB
-
memory/3672-135-0x000000001CC69000-0x000000001CC6F000-memory.dmpFilesize
24KB
-
memory/3672-136-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3672-161-0x000000001F1B0000-0x000000001F1B4000-memory.dmpFilesize
16KB
-
memory/3672-158-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3672-137-0x000000001F1B0000-0x000000001F1B4000-memory.dmpFilesize
16KB
-
memory/3672-138-0x000000001F1B4000-0x000000001F1B7000-memory.dmpFilesize
12KB
-
memory/3672-133-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/3720-155-0x0000000000000000-mapping.dmp
-
memory/4296-168-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/4296-198-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/4296-147-0x0000000000000000-mapping.dmp
-
memory/4804-145-0x0000000000000000-mapping.dmp
-
memory/4804-166-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/4804-187-0x00007FF9C70E0000-0x00007FF9C7BA1000-memory.dmpFilesize
10.8MB
-
memory/5508-205-0x000000001C3E0000-0x000000001C908000-memory.dmpFilesize
5.2MB
-
memory/5508-202-0x00000000000C0000-0x0000000000364000-memory.dmpFilesize
2.6MB
-
memory/5508-203-0x00007FF9C7120000-0x00007FF9C7BE1000-memory.dmpFilesize
10.8MB
-
memory/5508-204-0x000000001AEB9000-0x000000001AEBF000-memory.dmpFilesize
24KB
-
memory/5508-199-0x0000000000000000-mapping.dmp
-
memory/5508-206-0x000000001E3F0000-0x000000001E5B2000-memory.dmpFilesize
1.8MB
-
memory/5508-207-0x00007FF9C7120000-0x00007FF9C7BE1000-memory.dmpFilesize
10.8MB
-
memory/5508-208-0x000000001AEB9000-0x000000001AEBF000-memory.dmpFilesize
24KB
-
memory/5508-209-0x000000001C3E0000-0x000000001C908000-memory.dmpFilesize
5.2MB
-
memory/5508-210-0x000000001C3E0000-0x000000001C908000-memory.dmpFilesize
5.2MB
-
memory/5508-211-0x000000001C3E0000-0x000000001C908000-memory.dmpFilesize
5.2MB