Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 02:59
Static task
static1
Behavioral task
behavioral1
Sample
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
Resource
win10v2004-20220812-en
General
-
Target
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe
-
Size
927KB
-
MD5
6d5416776bd0f3854a271722098d719e
-
SHA1
ff6876a938916d3010963136ef8b084f0d703b5d
-
SHA256
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
-
SHA512
3fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
SSDEEP
24576:NZPMSPOdEDGD8Xa6x4LqKMg1tXykjBUyNts4cPq:DOv8XFKLx1tisNFh
Malware Config
Extracted
darkcomet
Guest16
109.104.87.142:2039
DC_MUTEX-X2C2Y2U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
FcUN6bdTNYgc
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
darkcomet
CryptService
bezerkmedia.no-ip.biz:1606
DCMIN_MUTEX-97A2GT7
-
gencode
0n1bb6xQeSjV
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
reg.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\G9hdquLc\\VHExTPh.exe,explorer.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\G9hdquLc\\VHExTPh.exe,explorer.exe" reg.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Executes dropped EXE 5 IoCs
Processes:
CryptService.exe.exemsdcsc.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exemsdcsc.exeCryptService.exe.exepid process 1916 CryptService.exe.exe 616 msdcsc.exe 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1992 msdcsc.exe 1188 CryptService.exe.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1940 attrib.exe 672 attrib.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx \Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx behavioral1/memory/1916-93-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1916-123-0x0000000000400000-0x00000000004B7000-memory.dmp upx \Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx \Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe upx behavioral1/memory/1188-158-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 8 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exemsdcsc.exepid process 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 616 msdcsc.exe 616 msdcsc.exe 616 msdcsc.exe -
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exemsdcsc.exedescription pid process target process PID 1668 set thread context of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 set thread context of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 616 set thread context of 1992 616 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exemsdcsc.exepid process 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe 616 msdcsc.exe 616 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exeCryptService.exe.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription pid process Token: SeDebugPrivilege 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeIncreaseQuotaPrivilege 1916 CryptService.exe.exe Token: SeSecurityPrivilege 1916 CryptService.exe.exe Token: SeTakeOwnershipPrivilege 1916 CryptService.exe.exe Token: SeLoadDriverPrivilege 1916 CryptService.exe.exe Token: SeSystemProfilePrivilege 1916 CryptService.exe.exe Token: SeSystemtimePrivilege 1916 CryptService.exe.exe Token: SeProfSingleProcessPrivilege 1916 CryptService.exe.exe Token: SeIncBasePriorityPrivilege 1916 CryptService.exe.exe Token: SeCreatePagefilePrivilege 1916 CryptService.exe.exe Token: SeBackupPrivilege 1916 CryptService.exe.exe Token: SeRestorePrivilege 1916 CryptService.exe.exe Token: SeShutdownPrivilege 1916 CryptService.exe.exe Token: SeDebugPrivilege 1916 CryptService.exe.exe Token: SeSystemEnvironmentPrivilege 1916 CryptService.exe.exe Token: SeChangeNotifyPrivilege 1916 CryptService.exe.exe Token: SeRemoteShutdownPrivilege 1916 CryptService.exe.exe Token: SeUndockPrivilege 1916 CryptService.exe.exe Token: SeManageVolumePrivilege 1916 CryptService.exe.exe Token: SeImpersonatePrivilege 1916 CryptService.exe.exe Token: SeCreateGlobalPrivilege 1916 CryptService.exe.exe Token: 33 1916 CryptService.exe.exe Token: 34 1916 CryptService.exe.exe Token: 35 1916 CryptService.exe.exe Token: SeIncreaseQuotaPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSecurityPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeTakeOwnershipPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeLoadDriverPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemProfilePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemtimePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeProfSingleProcessPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeIncBasePriorityPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeCreatePagefilePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeBackupPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeRestorePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeShutdownPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeDebugPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemEnvironmentPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeChangeNotifyPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeRemoteShutdownPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeUndockPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeManageVolumePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeImpersonatePrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeCreateGlobalPrivilege 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: 33 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: 34 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: 35 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeIncreaseQuotaPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSecurityPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeTakeOwnershipPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeLoadDriverPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemProfilePrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemtimePrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeProfSingleProcessPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeIncBasePriorityPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeCreatePagefilePrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeBackupPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeRestorePrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeShutdownPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeDebugPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeSystemEnvironmentPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeChangeNotifyPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeRemoteShutdownPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Token: SeUndockPrivilege 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
CryptService.exe.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exepid process 1916 CryptService.exe.exe 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.execmd.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.execmd.execmd.exee82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription pid process target process PID 1668 wrote to memory of 1740 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 1668 wrote to memory of 1740 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 1668 wrote to memory of 1740 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 1668 wrote to memory of 1740 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 1740 wrote to memory of 956 1740 cmd.exe reg.exe PID 1740 wrote to memory of 956 1740 cmd.exe reg.exe PID 1740 wrote to memory of 956 1740 cmd.exe reg.exe PID 1740 wrote to memory of 956 1740 cmd.exe reg.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 988 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1916 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe CryptService.exe.exe PID 1668 wrote to memory of 1916 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe CryptService.exe.exe PID 1668 wrote to memory of 1916 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe CryptService.exe.exe PID 1668 wrote to memory of 1916 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe CryptService.exe.exe PID 988 wrote to memory of 1200 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 1200 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 1200 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 1200 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 824 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 824 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 824 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 988 wrote to memory of 824 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe cmd.exe PID 1200 wrote to memory of 1940 1200 cmd.exe attrib.exe PID 1200 wrote to memory of 1940 1200 cmd.exe attrib.exe PID 1200 wrote to memory of 1940 1200 cmd.exe attrib.exe PID 1200 wrote to memory of 1940 1200 cmd.exe attrib.exe PID 824 wrote to memory of 672 824 cmd.exe attrib.exe PID 824 wrote to memory of 672 824 cmd.exe attrib.exe PID 824 wrote to memory of 672 824 cmd.exe attrib.exe PID 824 wrote to memory of 672 824 cmd.exe attrib.exe PID 988 wrote to memory of 616 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe msdcsc.exe PID 988 wrote to memory of 616 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe msdcsc.exe PID 988 wrote to memory of 616 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe msdcsc.exe PID 988 wrote to memory of 616 988 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe msdcsc.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1668 wrote to memory of 1920 1668 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe PID 1920 wrote to memory of 1564 1920 e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1940 attrib.exe 672 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"3⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe,explorer.exe"5⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
C:\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
C:\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
C:\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exe.lnkFilesize
843B
MD521888d502380704efffe88156af979d3
SHA10070405f49b681624f58f36393c370af2e79635d
SHA256419472d79bd02747e84f4c7df22dacc29c53a7c0759b4fde9ed7abe131e3d610
SHA512c48362dcc7e46886399dfb255b50a4e07b6022c7d9f7011c253d3bb8c0d524b78d10ef41c87e76d04c5d4114468a5e0bc6a27a116f49b82726a6b10f796b1dc7
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
\Users\Admin\AppData\Local\Temp\CryptService.exe.exeFilesize
232KB
MD5b8c99b673301955465e5e7169dba945c
SHA1541f4719f945d9091ef5d24268c0642efa110759
SHA2561fdc072a210cf84642dfa0cc670820d5b11d060783f8c714a284f4c79d01dda4
SHA51265323893af70c369866ab4a8b5fb735cb8297648354bd93fbd1e2b713cfb1119fc37860634907f2e2e0b0f570d2d160ddb1e03c2462439b1471488151eb07ced
-
\Users\Admin\AppData\Local\Temp\e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
\Users\Admin\AppData\Roaming\G9hdquLc\VHExTPh.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
927KB
MD56d5416776bd0f3854a271722098d719e
SHA1ff6876a938916d3010963136ef8b084f0d703b5d
SHA256e82aee5ef07a580114f739b15249703f2147dbc05fa03ba55b5a0abd3e15c9c9
SHA5123fb3335b5f22bd29373d83bede4fb9764f7f3699d43f9339ec4f24e25e07dfdb7b8666fcd223a8ac0bc11b56219c933a29db6a50f9a5105cdb229fb3a0ffd3fb
-
memory/616-98-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/616-126-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/616-160-0x0000000007BA0000-0x0000000007C57000-memory.dmpFilesize
732KB
-
memory/616-159-0x0000000007BA0000-0x0000000007C57000-memory.dmpFilesize
732KB
-
memory/616-161-0x0000000007BA0000-0x0000000007C57000-memory.dmpFilesize
732KB
-
memory/616-92-0x0000000000000000-mapping.dmp
-
memory/672-88-0x0000000000000000-mapping.dmp
-
memory/824-86-0x0000000000000000-mapping.dmp
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/988-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-75-0x000000000048F888-mapping.dmp
-
memory/988-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-83-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-97-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/988-76-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1188-154-0x0000000000000000-mapping.dmp
-
memory/1188-158-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1200-85-0x0000000000000000-mapping.dmp
-
memory/1392-131-0x0000000000000000-mapping.dmp
-
memory/1564-120-0x0000000000000000-mapping.dmp
-
memory/1668-125-0x00000000099E0000-0x0000000009A97000-memory.dmpFilesize
732KB
-
memory/1668-90-0x00000000099E0000-0x0000000009A97000-memory.dmpFilesize
732KB
-
memory/1668-89-0x00000000099E0000-0x0000000009A97000-memory.dmpFilesize
732KB
-
memory/1668-124-0x00000000099E0000-0x0000000009A97000-memory.dmpFilesize
732KB
-
memory/1668-55-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1668-56-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1668-54-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1740-58-0x0000000000000000-mapping.dmp
-
memory/1912-132-0x0000000000000000-mapping.dmp
-
memory/1916-123-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1916-80-0x0000000000000000-mapping.dmp
-
memory/1916-93-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1920-122-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1920-115-0x000000000048F888-mapping.dmp
-
memory/1920-127-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1940-87-0x0000000000000000-mapping.dmp
-
memory/1992-148-0x000000000048F888-mapping.dmp