Analysis
-
max time kernel
303s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-02-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe
Resource
win10-20231215-en
General
-
Target
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe
-
Size
680KB
-
MD5
422a2d14300bd479e24d7fbb9eaf44dc
-
SHA1
24b6005299fd8a3de98a1c5586ea7bf58e1ae528
-
SHA256
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6
-
SHA512
2e60f8690eaaa047f0ef283db87ec930c12769b2581e4cf8ddeedcf8bf101ef6546e91a18bc6d674a7a8a15da032162522a1574ac4a2b29bf4e7c4af6dbd601d
-
SSDEEP
12288:pUGSQNEnmEK1IfCivcDDLEn+ImsVXVoLz1O4DxFqSsI26CdW7/InwbFNbCnp:pYSEnmET7k3wmaYz1bP8W7xbvkp
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdcc
-
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw
Extracted
vidar
7.6
1b9d7ec5a25ab9d78c31777a0016a097
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
-
profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/536-163-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/536-166-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/2056-162-0x0000000000230000-0x0000000000260000-memory.dmp family_vidar_v7 behavioral1/memory/536-167-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/536-317-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-2-0x00000000045A0000-0x00000000046BB000-memory.dmp family_djvu behavioral1/memory/2200-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2200-8-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2200-9-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2200-27-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-40-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-123-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-136-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-137-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-141-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-143-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-144-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-150-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2520-260-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 2056 build2.exe 536 build2.exe 1676 build3.exe 2828 build3.exe 840 mstsca.exe 2796 mstsca.exe 944 mstsca.exe 300 mstsca.exe 968 mstsca.exe 1812 mstsca.exe 2732 mstsca.exe 2020 mstsca.exe 1520 mstsca.exe -
Loads dropped DLL 11 IoCs
Processes:
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exeWerFault.exepid process 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe 2700 WerFault.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7b44613e-bc08-4ad8-8340-ba266b68f9d4\\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe\" --AutoStart" c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 4 api.2ip.ua 9 api.2ip.ua -
Suspicious use of SetThreadContext 8 IoCs
Processes:
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exec7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 1280 set thread context of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 set thread context of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2056 set thread context of 536 2056 build2.exe build2.exe PID 1676 set thread context of 2828 1676 build3.exe build3.exe PID 840 set thread context of 2796 840 mstsca.exe mstsca.exe PID 944 set thread context of 300 944 mstsca.exe mstsca.exe PID 968 set thread context of 1812 968 mstsca.exe mstsca.exe PID 2732 set thread context of 2020 2732 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2700 536 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3068 schtasks.exe 268 schtasks.exe -
Processes:
build2.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 build2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exec7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exepid process 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exec7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exec7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exec7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exebuild2.exebuild3.exebuild3.exebuild2.exedescription pid process target process PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 1280 wrote to memory of 2200 1280 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2200 wrote to memory of 2600 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe icacls.exe PID 2200 wrote to memory of 2600 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe icacls.exe PID 2200 wrote to memory of 2600 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe icacls.exe PID 2200 wrote to memory of 2600 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe icacls.exe PID 2200 wrote to memory of 2528 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2200 wrote to memory of 2528 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2200 wrote to memory of 2528 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2200 wrote to memory of 2528 2200 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2528 wrote to memory of 2520 2528 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe PID 2520 wrote to memory of 2056 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build2.exe PID 2520 wrote to memory of 2056 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build2.exe PID 2520 wrote to memory of 2056 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build2.exe PID 2520 wrote to memory of 2056 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2056 wrote to memory of 536 2056 build2.exe build2.exe PID 2520 wrote to memory of 1676 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build3.exe PID 2520 wrote to memory of 1676 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build3.exe PID 2520 wrote to memory of 1676 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build3.exe PID 2520 wrote to memory of 1676 2520 c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 1676 wrote to memory of 2828 1676 build3.exe build3.exe PID 2828 wrote to memory of 3068 2828 build3.exe schtasks.exe PID 2828 wrote to memory of 3068 2828 build3.exe schtasks.exe PID 2828 wrote to memory of 3068 2828 build3.exe schtasks.exe PID 2828 wrote to memory of 3068 2828 build3.exe schtasks.exe PID 536 wrote to memory of 2700 536 build2.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\7b44613e-bc08-4ad8-8340-ba266b68f9d4" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe"C:\Users\Admin\AppData\Local\Temp\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exe"C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exe"C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 14567⤵
- Loads dropped DLL
- Program crash
PID:2700 -
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exe"C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exe"C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
PID:3068
-
C:\Windows\system32\taskeng.exetaskeng.exe {703B81F3-450C-4CCF-B02F-A04BAE671011} S-1-5-21-3308111660-3636268597-2291490419-1000:JUBFGPHD\Admin:Interactive:[1]1⤵PID:320
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:840 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
PID:268 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:944 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
PID:300 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:968 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2732 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
PID:1520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD58112ab2a9d7578692e66734917d00015
SHA15dc1f7cb2c66c925d195fb98784917d108a001dd
SHA256919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b
SHA512538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD58e941f05eb953f89f05f54dd6142ba9a
SHA1e00ccee35a264f7d30e2eb978414495fc99f9675
SHA2561d763ebebdf72c37ff90ffa268e66a93c8ef08b1f9215a32650123534b542ab1
SHA512fdbe3abc3704a9cde66c3c290d51d191396a11a16a9681e1f1c4677ec4bea1cc347c86b81e5c191d2a9cedb3c28b7021234eb9dc65263c2694c645a0e258da5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5138c10e10b200018183a04497430f8ec
SHA1e3132edb34bd0c8ad39c43b9aba010ab94829021
SHA25694231c3fc72326e2b0bf6a826d09afb7add7c7bfa85d0dcc5598e849567c5e54
SHA51252960981bf0494f5550de189968551901fdcc72628fe7139995c3b2f6f8ca69e726f4d0d9d8a8ec2d340cf50374a50d14bccb5c12fc2a96194a376d7b5b92019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD521b8b880012b4d88c5515f2283e3ce2f
SHA13d45ccec98f13ebe09f01cbac8679150425ecb7a
SHA25600a06ab10678708f3004f1c7df44a2eed24e432d19ea50002da9895216fe81e8
SHA5124fedcb020a4e39e6086f634b80bbf45e276c54ef6ee32cf7c7ac605f8729022b3eb38b04ada9baabeb3777f790c5c4d34c49a1372105bf2700bedb05aa4630aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD57736f0b4a99fc9c2a38cde7e36232135
SHA1db1d039315ff773e4deb8f7a386ce1d876d8e4ea
SHA256adcd9322496ed6480b5f1726abced9ed25aa3c97518f24eeadcefc6771dd8980
SHA512a4d691ada8aa98c396d2a530745b318b831c14b8574c8b1c3604feb2fed9f3cbfbaa653e3de8ab3f6586ef38b7978a43e50a9c3d20436b09fbd22a1f41a1103d
-
C:\Users\Admin\AppData\Local\7b44613e-bc08-4ad8-8340-ba266b68f9d4\c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6.exeFilesize
680KB
MD5422a2d14300bd479e24d7fbb9eaf44dc
SHA124b6005299fd8a3de98a1c5586ea7bf58e1ae528
SHA256c7c2b9ec7d8324162f29a8eb989d749bbd602bc0f166db5bb02ec8f26803f7d6
SHA5122e60f8690eaaa047f0ef283db87ec930c12769b2581e4cf8ddeedcf8bf101ef6546e91a18bc6d674a7a8a15da032162522a1574ac4a2b29bf4e7c4af6dbd601d
-
C:\Users\Admin\AppData\Local\Temp\Cab8BEB.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarB211.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exeFilesize
219KB
MD5fa0bb73dddce292ebd3a3acb805ba77b
SHA131039948e6fcb98d12b78520bd42278c77e74744
SHA256d24fde9c3dd6a0070987a2f1ed1393fc1d6a27c7a7338d8674fe59d82adcd0ef
SHA512bee59374d0d27477c438a9185963012976857446625dc167ba5c18e6ac522c12200cd94060ef0c7622a1de2222ca84eaf329b75d2966626c6bf21aa2c6c8bf9f
-
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exeFilesize
202KB
MD5f9e5060799a017b05e2825f4c61f278b
SHA1da3c0a34f2a88982f809886f6235155940a4c7d5
SHA2568b865b86276d308e41acf8171f14b7da87ce2f7cde24fe4c5b54d96a9d228dfd
SHA5124eb5943d6454c02ab5587788c254994a419c9f59a300a48b28489e7e166e212dca9adf8cc880b5f20ceb3ff78557e7fcecd6a7038de17d866f297bffe760f894
-
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exeFilesize
201KB
MD5c63b12e02fbebb39dea4bbac49a35ad3
SHA17e60df7195c15b84cfc065a917ae0c4c82866601
SHA256c785569a2fcf0e8c17bd7535e0d0c7d731a7055d7d4ea23a752fd1fa0d5f1eb8
SHA5126aab46953c676f958100b4adb3002966493f3df46fa64d1a1224c854cd6e1f6c3f2921e6c8a6f47182fd6eaf89079f9a7d8a09204e8910dfd88b1232239f23cc
-
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exeFilesize
64KB
MD58b6a819c6926597dfa7529b692d7a6cc
SHA150c535e9cca464afd3a589d2231d87ce417d4312
SHA256b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c
SHA512dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9
-
C:\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exeFilesize
19KB
MD5c61c82f968b03f1edb0886efcc3c57bf
SHA141b0480e1e0182da72a848ec9430fb49e0ae3d2e
SHA2560eb48334567323a7f79bcf60b91acb1c507cfc508dcbc501a354df2763e7ed7e
SHA512a8a4bf21477608380432f301a15ac5babeeb676180b6397e9f04a5beaed39789f930c986ab614b9b42f5c1595176f2edf20123124e96c92a9d4db9ad5beaa24f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
128KB
MD553bc6c328281928e94ac312f63f13f05
SHA1d49275ca0cd7f367733a365323b466ad588e5ce0
SHA2567278f0c920ff8dad67e62751745e858817abb1c5b461414162311e57eb833e7c
SHA51248e55739728038066eeb2fca5c20e5c6c25587860b2ac7f021218e66fe7c77894c09e0301c4ceb78b72ebc19d85203d8bd66e8c15a1e1aed9eee58c6d465fb77
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
131KB
MD55766479333e897378690c348b283b806
SHA184498e905309908750fbd2cbe976a8e722cbc80a
SHA2568bf311a065f245c41ed8a4946308c9bee253975bb5b3cdc28fc9381ee8cb2a5e
SHA5121d3a7764a1042c4b10cd8649e3c2973e04f1a749aff3a94672740cc91bf1332064a8acf315bcadef54372ac667f6a6ebbb681b2bd1d5010ba2d8080f76d81d3d
-
\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build2.exeFilesize
385KB
MD563e4a9cd7a8b37335b5f18cefc5dd9d2
SHA1c781a30935afc452b108cc78724b60f389b78874
SHA256c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f
SHA5123818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc
-
\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
\Users\Admin\AppData\Local\b885e183-b0ff-4d1a-9b9b-f9bc1818c474\build3.exeFilesize
256KB
MD5164bc11a628ff1722c833c8e2642aca5
SHA156d2d17695a85b876b736933a7f1cd5cf2acfdb1
SHA256e76e2fa66070991fff3747fd12185ec795651b8506f290a3f1214b0eab40d330
SHA512099d1715e47a2c4ea346b432f186ffb6fcd94f9ec6b28ffcf5047a57b686a0135e765db75150ac14420cb9285fb02c8d390751b239a2a9446219da587a89ce9b
-
memory/536-167-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/536-166-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/536-317-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/536-163-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/536-160-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/840-326-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/944-358-0x0000000000952000-0x0000000000962000-memory.dmpFilesize
64KB
-
memory/968-383-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1280-2-0x00000000045A0000-0x00000000046BB000-memory.dmpFilesize
1.1MB
-
memory/1280-0-0x0000000000310000-0x00000000003A2000-memory.dmpFilesize
584KB
-
memory/1280-7-0x0000000000310000-0x00000000003A2000-memory.dmpFilesize
584KB
-
memory/1280-1-0x0000000000310000-0x00000000003A2000-memory.dmpFilesize
584KB
-
memory/1676-299-0x0000000000980000-0x0000000000A80000-memory.dmpFilesize
1024KB
-
memory/1676-300-0x0000000000220000-0x0000000000224000-memory.dmpFilesize
16KB
-
memory/2056-162-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/2056-159-0x0000000000540000-0x0000000000640000-memory.dmpFilesize
1024KB
-
memory/2200-8-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2200-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2200-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2200-9-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2200-27-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-144-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-141-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-260-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-40-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-150-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-136-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-137-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-143-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2520-123-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2528-28-0x0000000002B90000-0x0000000002C22000-memory.dmpFilesize
584KB
-
memory/2528-39-0x0000000002B90000-0x0000000002C22000-memory.dmpFilesize
584KB
-
memory/2732-414-0x00000000002B2000-0x00000000002C2000-memory.dmpFilesize
64KB
-
memory/2828-307-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2828-305-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2828-302-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB