Analysis
-
max time kernel
299s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-02-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
Resource
win10-20231215-en
General
-
Target
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
-
Size
774KB
-
MD5
a775dae66ce141797fe36ee3509c6177
-
SHA1
b822ee79f6cdfe299c70bbb14cb96f9560edb4f6
-
SHA256
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf
-
SHA512
c94d0bfc21d4ac08b13b45aacb30a7411cf59d01139c6a5c78146cfcdafa7375b55f48be4192b331ae47a86e4a591cebe95f2a2878dc963e9160e62c9d42590f
-
SSDEEP
12288:WVScQtCEfpoaOjz2BgoYuqUV7SSO4C2QB5P/ihmeu3XOVDuTF+d3N38Z872:3Ciu/qgZUV7B7siorXOVDh8Z87
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdcc
-
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw
Extracted
vidar
7.6
1b9d7ec5a25ab9d78c31777a0016a097
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
-
profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1148-78-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/1148-79-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/1148-75-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/1612-71-0x0000000000230000-0x0000000000260000-memory.dmp family_vidar_v7 behavioral1/memory/1148-235-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 14 IoCs
Processes:
resource yara_rule behavioral1/memory/2808-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1648-4-0x0000000001DB0000-0x0000000001ECB000-memory.dmp family_djvu behavioral1/memory/2808-8-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2808-7-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2808-26-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-36-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-50-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-49-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-54-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-57-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1612-70-0x0000000000540000-0x0000000000640000-memory.dmp family_djvu behavioral1/memory/2564-80-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2564-157-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 1612 build2.exe 1148 build2.exe 2960 build3.exe 844 build3.exe 2588 mstsca.exe 2684 mstsca.exe 1496 mstsca.exe 1520 mstsca.exe 1476 mstsca.exe 1632 mstsca.exe 1152 mstsca.exe 2796 mstsca.exe 2624 mstsca.exe 1880 mstsca.exe -
Loads dropped DLL 11 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exeWerFault.exepid process 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 488 WerFault.exe 488 WerFault.exe 488 WerFault.exe 488 WerFault.exe 488 WerFault.exe 488 WerFault.exe 488 WerFault.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f71ed4d9-badd-4b1d-8d57-e581e4a9539d\\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe\" --AutoStart" 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 api.2ip.ua 3 api.2ip.ua 4 api.2ip.ua -
Suspicious use of SetThreadContext 9 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 1648 set thread context of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 set thread context of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1612 set thread context of 1148 1612 build2.exe build2.exe PID 2960 set thread context of 844 2960 build3.exe build3.exe PID 2588 set thread context of 2684 2588 mstsca.exe mstsca.exe PID 1496 set thread context of 1520 1496 mstsca.exe mstsca.exe PID 1476 set thread context of 1632 1476 mstsca.exe mstsca.exe PID 1152 set thread context of 2796 1152 mstsca.exe mstsca.exe PID 2624 set thread context of 1880 2624 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 488 1148 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2604 schtasks.exe 1768 schtasks.exe -
Processes:
build2.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 build2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exepid process 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exebuild2.exebuild2.exebuild3.exebuild3.exedescription pid process target process PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1648 wrote to memory of 2808 1648 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2808 wrote to memory of 2604 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe schtasks.exe PID 2808 wrote to memory of 2604 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe schtasks.exe PID 2808 wrote to memory of 2604 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe schtasks.exe PID 2808 wrote to memory of 2604 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe schtasks.exe PID 2808 wrote to memory of 2592 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2808 wrote to memory of 2592 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2808 wrote to memory of 2592 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2808 wrote to memory of 2592 2808 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2592 wrote to memory of 2564 2592 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2564 wrote to memory of 1612 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 2564 wrote to memory of 1612 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 2564 wrote to memory of 1612 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 2564 wrote to memory of 1612 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 1612 wrote to memory of 1148 1612 build2.exe build2.exe PID 2564 wrote to memory of 2960 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 2564 wrote to memory of 2960 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 2564 wrote to memory of 2960 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 2564 wrote to memory of 2960 2564 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 1148 wrote to memory of 488 1148 build2.exe WerFault.exe PID 1148 wrote to memory of 488 1148 build2.exe WerFault.exe PID 1148 wrote to memory of 488 1148 build2.exe WerFault.exe PID 1148 wrote to memory of 488 1148 build2.exe WerFault.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 2960 wrote to memory of 844 2960 build3.exe build3.exe PID 844 wrote to memory of 1768 844 build3.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\f71ed4d9-badd-4b1d-8d57-e581e4a9539d" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exe"C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exe"C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 14527⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exe"C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exe"C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {4C6981F6-B7BD-4666-8493-0056CCEE7C3C} S-1-5-21-452311807-3713411997-1028535425-1000:OZEMQECW\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5c59708a86e78530488f2356251e775a2
SHA117e33e077261cdd9e54d4e58dfb168f15ee93efb
SHA25671719971666e64a4f767e8f9d0b52e822189c4bfb1fe449a0e7c8066c82813c2
SHA51242afd4d2c791ea8cb239130cf4f4d43da0ec39c63049c56796e082282e2ba2f0cd0fd8934b7de3b359ca433b0609ad159fda6f92168168f2d4517f13fbbb3fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5d535beb7cc391119846ab5436e5d9ad4
SHA1d625ebf2690878a95144654da8e7dd1f3006fd87
SHA256db4094f7249be51c03d43225c5eac650670ae2987651aeb3de372c172692b411
SHA512a70d539cc5ac66ae61d92dc3978f209481acfc0b80d337de5a586026820f5ca75d15da4720c3c878e0eeb25c6d343e393ca8d906973e3c621096a4b6392332d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5999158a490cdf53d6dbbc849eae0e76a
SHA1c8ae7a4bdeb9d67f2fbb1e0ba9fbd9b557cb2042
SHA25651308776e693b98bba421ffb287b125d1c2392d193827e7f4e670ee97f13c8d6
SHA512ac09a1fc9b06e33b1e655d7bea127dc39422234c8239a2c4c90e56045f90fe1e9f63f95fea2c75ba03979f8fc30a5a761db8656626c0bdaefbde9a6b520c3933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD5a4cea1aa11d9ac7997d9536aae9bd222
SHA1a2cf0cfe5def81320e5210295ee9965e8859c277
SHA256b22ec25915983fca68fce93c507a0a0543e204d926a7792c0c2f8f3fdb8c864c
SHA5126a72214cad497dc8195f2ef0a21d9976ed670192a3aa76ebe613769e8a98562cde7d93db9651bdb3e56eb6943d5519ba07a5625736d6fd07e91cf6165e7534f5
-
C:\Users\Admin\AppData\Local\Temp\Cab6152.tmpFilesize
45KB
MD5ca53bfaa54fb51fdfa95552e672f41c4
SHA16869d1d83fc1fde57199934ef676217853ccd2d8
SHA2569bd00783dd146f89addc739df3ee35fb7718c5bc3c8ae912f177358703958d6e
SHA512a86d7fe25ef072d9489a681629c78fe5626fcaf268d7ec6e7c0fd88dd54793b9e3a7ba47f1852e4a870703fc11b77e3de0af6ee91da428a203ff6576a09a2496
-
C:\Users\Admin\AppData\Local\Temp\Tar7495.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
327KB
MD5a440f9ecfa63c975fe5d279f24c4cc42
SHA1afe8572465ab16350f564e3a944536204ff29c27
SHA25629917522adfa24818859e19f658aba78032923ff25a0caf77ea3c2ad756d7ca6
SHA5121387c642d45fc774049054cdb79eb7e743e74870b140a75e97edb31ba0986c24a3985550ae10344c1b35591cf6358875a8c204c0dfbdc971f917bdefd475c3fc
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
268KB
MD54a346d432a3cdeb3ee4671bf493cb04a
SHA1b565654b3c488abf40d5f4fb001e440e112991d6
SHA256b43a845bae28a1b1357950b6175b88ef0bf53714dded467419aaf4e7b8a51d04
SHA5129fbdfc94d204a59210d20df94b9e214ad819e887e29ad8248f2889154ad4907ed8c8bc795b4b260014f3c5af016571ea2030ff2b8f83657119935b945f3dcc1c
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
183KB
MD504b1aa2a391192bce4b69279264f1844
SHA1cd2273a0b0ec1100e33db34d1392c91efc5f4125
SHA2569d9bcf18c1c25f1b43ad18d8289c75cee6ec070f682352e88eafd446f86eabe0
SHA512a0eb51721e5d189117296e3c8ff993c21cb9e5f2dbdd7a363c9e7df39eefecaf0a702bc0ac70e045e3f46ff03af252fd156e7fa749821d3f92f103ade27dd26a
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
244KB
MD5a813850e0c3ba3bf7b6a573bc65ccf60
SHA17e3432ead64962d46850097e92a694e599b000f7
SHA25609b1554f3d5fcbfdf10c6ce16dc69660e160e7e916eeb2efc4bd1672092589d5
SHA51282230c88d26d3ceca6fabfc48c542f87ba5aa34e412b5cc3a8a5c2e2226b214e354fc7e1b174b4aec9732fc8f659cf76d444746a53724c3903ad43b9d8385dea
-
C:\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exeFilesize
57KB
MD598ef04ae1abea4a5fc37c4dbcc37db93
SHA137070fdc251bba2e744e6e3a4a4376cf3d51060b
SHA256c0d4f0cd8dcd63aa32a30480f5b95217b9ac12d3905bfa5f3f0cc3d87168016e
SHA512ccac7479a36a23d08ae08bfc72b35c4f4d05683d08075d451eb639f0391569897f9f2dbd0a3f431af3a767a461555c5e1e7e7a09fcf5e40f77e94a7b6a9497eb
-
C:\Users\Admin\AppData\Local\f71ed4d9-badd-4b1d-8d57-e581e4a9539d\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exeFilesize
613KB
MD5384a51b7b2186f65ecd082172b924c20
SHA16931aae541964a43276300c7d6c375e95fde6abe
SHA256ad31a77650184ab805b191e1236f3d6e84a5ba42e37dd21c99ea53f8c89a5a2e
SHA51203081bbe6aedf5a446323175fffa11a195887f59dad9359fdfca864e1c2892296bd847f1d6f95c6e5ec370371c5cc1c4ef0b8204dd0beaacf8b2bfb7c81a5178
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
385KB
MD563e4a9cd7a8b37335b5f18cefc5dd9d2
SHA1c781a30935afc452b108cc78724b60f389b78874
SHA256c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f
SHA5123818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
248KB
MD519847a601413315f5013a97bbc97cdbe
SHA13ee9d0e9e0b683306d8705ebafd72ed97d269f34
SHA256bd2c572763ce75ce51bc351c86e8b3a278a660c451c75249208771e8bfcd14f6
SHA51289bf9da109d05c28584bfa604a255123eeaa223519e145ebf14c2035ffab9d7520d72160ee156b02376eccd29a1ef0a1b730b8be7d93d89f7cb30bc0c0ff1399
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
192KB
MD5241497f2157d99ee5abc745ae46d7639
SHA1eb699928f3a356284475911e24b5d61614a41707
SHA256f84ad237bf8b0fea2bedddc11efd63025fbe01be2f1281441d277efd21bcedb1
SHA5125ee476475cb49d01563bc0b8ca01f113d955c3181a0cbce2be6d939781471823badbca2139a3948a8ffb7752389814a26e827083f75514712a5fdcb2d7db02f7
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
351KB
MD5a552e7319987be10135c6f7971bc328b
SHA102df81572b7bb5e28a7295d684e1aceb039f2283
SHA2563354a2adbb01e270e6e2fd622f0f8ab2f06b187b58f4d1c9405de17454718339
SHA5122fd1d70089c2508df513ddd60b117283e37fcf15e7cced5660889ad912540d7fd61fa7e83f5315c28cfb667ff38de42271d06b1c1db61d900faab03cf6b6dc62
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
187KB
MD56cfe69a8357782f211b6243ec158a95a
SHA18c54f8fcf4709b5242ecd8598b310f11dd3f8055
SHA256642fb72da735f785b6efc5e4e2d674c7102444dee2b379623674d6c815e2a3ca
SHA512ebf76dd6db1b14bb17bb4e6118192a0e21bb1a0be539462adeba70387cd3f7edde03e25a36640b279eecaea93478cfa9d676536ba3e72db2566a0fb58db92b93
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build2.exeFilesize
233KB
MD5681d1d58b9de5a418b9bc2b6052a7e1c
SHA126aff28dd3d508595fa802217acb7baa0429e7c0
SHA2566fe74bee0d749eb6e8cda14f8525c6b027b3d18cbb97a45dfa022e4d2c539fae
SHA5120457707c4ae87cbb93d7261d55cbfbd602c476d4d011f7f0e5f99f29e578c1068c70e4f3808a3174ad12d4f3056e0181f78018ab04623a268b40759b48314cff
-
\Users\Admin\AppData\Local\ab902d54-b684-405f-ad6b-daeeeb8b1de9\build3.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
memory/844-226-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/844-230-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/844-223-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/844-232-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1148-235-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/1148-78-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/1148-79-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/1148-75-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/1148-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1152-335-0x0000000000940000-0x0000000000A40000-memory.dmpFilesize
1024KB
-
memory/1476-305-0x00000000008E0000-0x00000000009E0000-memory.dmpFilesize
1024KB
-
memory/1496-278-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/1612-71-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1612-70-0x0000000000540000-0x0000000000640000-memory.dmpFilesize
1024KB
-
memory/1648-0-0x00000000002F0000-0x0000000000381000-memory.dmpFilesize
580KB
-
memory/1648-2-0x00000000002F0000-0x0000000000381000-memory.dmpFilesize
580KB
-
memory/1648-4-0x0000000001DB0000-0x0000000001ECB000-memory.dmpFilesize
1.1MB
-
memory/2564-56-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-80-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-157-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-36-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-57-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-54-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-49-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2564-50-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2588-250-0x00000000002B0000-0x00000000003B0000-memory.dmpFilesize
1024KB
-
memory/2592-27-0x0000000000360000-0x00000000003F1000-memory.dmpFilesize
580KB
-
memory/2592-29-0x0000000000360000-0x00000000003F1000-memory.dmpFilesize
580KB
-
memory/2592-34-0x0000000000360000-0x00000000003F1000-memory.dmpFilesize
580KB
-
memory/2624-364-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/2808-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2808-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2808-8-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2808-7-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2808-26-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2960-225-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB
-
memory/2960-227-0x0000000000220000-0x0000000000224000-memory.dmpFilesize
16KB