Analysis
-
max time kernel
115s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 11:11
Behavioral task
behavioral1
Sample
b5dfa64f79e3272dd6ccb91a40a3206c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b5dfa64f79e3272dd6ccb91a40a3206c.exe
Resource
win10v2004-20230221-en
General
-
Target
b5dfa64f79e3272dd6ccb91a40a3206c.exe
-
Size
1.5MB
-
MD5
b5dfa64f79e3272dd6ccb91a40a3206c
-
SHA1
ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
-
SHA256
68da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
-
SHA512
c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
SSDEEP
49152:Ug7eMAlDZSskPpc6r1deUNWiP3XtGfAGOw:UJMAlDAdPpF1YbifXtg9
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1324 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 976 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1008 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 304 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 324 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1928 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1028 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 552 1088 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 1088 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/912-54-0x0000000001180000-0x000000000130E000-memory.dmp dcrat behavioral1/memory/912-71-0x000000001B180000-0x000000001B200000-memory.dmp dcrat C:\MSOCache\All Users\wininit.exe dcrat C:\Windows\Temp\Crashpad\Idle.exe dcrat C:\Windows\Temp\Crashpad\Idle.exe dcrat behavioral1/memory/1796-147-0x00000000008A0000-0x0000000000A2E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
Idle.exepid process 1796 Idle.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ipinfo.io 8 ipinfo.io -
Drops file in Program Files directory 7 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\Windows Photo Viewer\de-DE\cc11b995f2a76d b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\56085415360792 b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Drops file in Windows directory 1 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process File created C:\Windows\winsxs\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_b8406654aa00440b\winlogon.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1756 schtasks.exe 552 schtasks.exe 1324 schtasks.exe 304 schtasks.exe 1196 schtasks.exe 1620 schtasks.exe 1960 schtasks.exe 1856 schtasks.exe 1836 schtasks.exe 976 schtasks.exe 1008 schtasks.exe 324 schtasks.exe 1368 schtasks.exe 1812 schtasks.exe 1424 schtasks.exe 1984 schtasks.exe 1584 schtasks.exe 1500 schtasks.exe 1928 schtasks.exe 1884 schtasks.exe 1028 schtasks.exe -
Processes:
Idle.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Idle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Idle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Idle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Idle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Idle.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Idle.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIdle.exepid process 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe 848 powershell.exe 616 powershell.exe 1496 powershell.exe 428 powershell.exe 940 powershell.exe 1360 powershell.exe 1844 powershell.exe 992 powershell.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe 1796 Idle.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Idle.exepid process 1796 Idle.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIdle.exedescription pid process Token: SeDebugPrivilege 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe Token: SeDebugPrivilege 848 powershell.exe Token: SeDebugPrivilege 616 powershell.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 1360 powershell.exe Token: SeDebugPrivilege 1844 powershell.exe Token: SeDebugPrivilege 992 powershell.exe Token: SeDebugPrivilege 1796 Idle.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.execmd.exedescription pid process target process PID 912 wrote to memory of 1844 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1844 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1844 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1496 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1496 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1496 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 428 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 428 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 428 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1360 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1360 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1360 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 848 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 848 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 848 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 940 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 940 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 940 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 992 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 992 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 992 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 616 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 616 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 616 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 912 wrote to memory of 1732 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe cmd.exe PID 912 wrote to memory of 1732 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe cmd.exe PID 912 wrote to memory of 1732 912 b5dfa64f79e3272dd6ccb91a40a3206c.exe cmd.exe PID 1732 wrote to memory of 1244 1732 cmd.exe w32tm.exe PID 1732 wrote to memory of 1244 1732 cmd.exe w32tm.exe PID 1732 wrote to memory of 1244 1732 cmd.exe w32tm.exe PID 1732 wrote to memory of 1796 1732 cmd.exe Idle.exe PID 1732 wrote to memory of 1796 1732 cmd.exe Idle.exe PID 1732 wrote to memory of 1796 1732 cmd.exe Idle.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe"C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\a8e30002-b1b4-11ed-a8b7-cee1c2fbb193\spoolsv.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\smss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\wininit.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pX4FL42xAJ.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\Temp\Crashpad\Idle.exe"C:\Windows\Temp\Crashpad\Idle.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\a8e30002-b1b4-11ed-a8b7-cee1c2fbb193\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\a8e30002-b1b4-11ed-a8b7-cee1c2fbb193\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\a8e30002-b1b4-11ed-a8b7-cee1c2fbb193\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\Crashpad\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\Temp\Crashpad\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\wininit.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5ed958d685a4294d7acec954b699438c7
SHA1b137dad6330b8cad162cb4664ed52ac7bb8245a5
SHA256cbbf8102d4bfb957659c8dafde4934bb5d6d85345636bc71601fe6fbd618d528
SHA512e150a50ca0cc532e64699f61b53c6726ec91f29e792718dd9665defce0b0bd4303649115ce7d69053e928589b5338b02191e8b899fc4ece70649f30cdd6b5c4a
-
C:\Users\Admin\AppData\Local\Temp\CabC41D.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\TarC5AA.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Local\Temp\pX4FL42xAJ.batFilesize
198B
MD5e81ccb34a48eb774d3def5616a25513a
SHA16ce0a967fa0743f6b47e7b543cd7338033b450ea
SHA256ebf0f12df43db2038b5f7dca288da7a68093946d73d5ffce99b69e3bc246f374
SHA512e1763cb90ad320228b555cbe77727461fbbd8b216bcc4647b8c825e92e06694f29ab485b10a2d14c4533bc301d3828b189f0a725030a54a9c8a8fad35c1715d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WY572M707FA5BR6DGB8F.tempFilesize
7KB
MD5725c2c9c07e21f36321b04f8c618a6d4
SHA102e5865a4a8822323c15b265a2d295efa0f244da
SHA256687c328a4b559daf207fe424fbc0349068ca967ba34edee43918c2b82ff99bf4
SHA51231cdd3fedba550e3a3db0d3ce94a604f1a2c072f001fb90a08fc3ed02ab161b821bb020438fe7541219d2ad98ee7e1a40d29dfc3812c9640b0ed69e62d416564
-
C:\Windows\Temp\Crashpad\Idle.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
C:\Windows\Temp\Crashpad\Idle.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
memory/428-129-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/428-133-0x000000000256B000-0x00000000025A2000-memory.dmpFilesize
220KB
-
memory/616-136-0x00000000024CB000-0x0000000002502000-memory.dmpFilesize
220KB
-
memory/616-131-0x00000000024C4000-0x00000000024C7000-memory.dmpFilesize
12KB
-
memory/848-127-0x000000000284B000-0x0000000002882000-memory.dmpFilesize
220KB
-
memory/848-104-0x00000000023F0000-0x00000000023F8000-memory.dmpFilesize
32KB
-
memory/848-126-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/912-57-0x0000000000350000-0x000000000036C000-memory.dmpFilesize
112KB
-
memory/912-71-0x000000001B180000-0x000000001B200000-memory.dmpFilesize
512KB
-
memory/912-64-0x00000000009B0000-0x00000000009BC000-memory.dmpFilesize
48KB
-
memory/912-63-0x00000000009A0000-0x00000000009AE000-memory.dmpFilesize
56KB
-
memory/912-62-0x0000000000990000-0x000000000099E000-memory.dmpFilesize
56KB
-
memory/912-61-0x0000000000750000-0x0000000000758000-memory.dmpFilesize
32KB
-
memory/912-60-0x0000000000740000-0x0000000000752000-memory.dmpFilesize
72KB
-
memory/912-59-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/912-58-0x0000000000580000-0x0000000000596000-memory.dmpFilesize
88KB
-
memory/912-56-0x0000000000340000-0x000000000034E000-memory.dmpFilesize
56KB
-
memory/912-55-0x000000001B180000-0x000000001B200000-memory.dmpFilesize
512KB
-
memory/912-54-0x0000000001180000-0x000000000130E000-memory.dmpFilesize
1.6MB
-
memory/940-135-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/940-138-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/940-130-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/940-143-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/992-132-0x00000000027CB000-0x0000000002802000-memory.dmpFilesize
220KB
-
memory/992-128-0x00000000027C4000-0x00000000027C7000-memory.dmpFilesize
12KB
-
memory/1360-140-0x0000000002600000-0x0000000002680000-memory.dmpFilesize
512KB
-
memory/1360-141-0x0000000002604000-0x0000000002607000-memory.dmpFilesize
12KB
-
memory/1360-144-0x000000000260B000-0x0000000002642000-memory.dmpFilesize
220KB
-
memory/1496-137-0x00000000028CB000-0x0000000002902000-memory.dmpFilesize
220KB
-
memory/1496-134-0x00000000028C4000-0x00000000028C7000-memory.dmpFilesize
12KB
-
memory/1496-102-0x000000001B200000-0x000000001B4E2000-memory.dmpFilesize
2.9MB
-
memory/1796-150-0x000000001B0C0000-0x000000001B140000-memory.dmpFilesize
512KB
-
memory/1796-149-0x0000000000890000-0x00000000008A2000-memory.dmpFilesize
72KB
-
memory/1796-148-0x000000001B0C0000-0x000000001B140000-memory.dmpFilesize
512KB
-
memory/1796-147-0x00000000008A0000-0x0000000000A2E000-memory.dmpFilesize
1.6MB
-
memory/1796-217-0x000000001B0C0000-0x000000001B140000-memory.dmpFilesize
512KB
-
memory/1844-142-0x000000000234B000-0x0000000002382000-memory.dmpFilesize
220KB
-
memory/1844-139-0x0000000002344000-0x0000000002347000-memory.dmpFilesize
12KB