27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

Analysis

max time kernel
71s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00db28e5a7412cf4a6f87f8589244cd1.exe
Size

1.9MB
MD5

00db28e5a7412cf4a6f87f8589244cd1
SHA1

49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7
SHA256

27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c
SHA512

3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba
SSDEEP

24576:mX7tyazXp4qrSJZHJTEyMkbjla5TA3fmpKuUJBU8uQgyfg29H4EG7FhfESrpBrmi:mqR1a5T+fvmr0p4BDfzjmIADb

Score

10^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\", \"C:\\Windows\\Downloaded Program Files\\lsass.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\", \"C:\\Windows\\Downloaded Program Files\\lsass.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\", \"C:\\Windows\\Downloaded Program Files\\lsass.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\00db28e5a7412cf4a6f87f8589244cd1.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\", \"C:\\Windows\\Downloaded Program Files\\lsass.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\00db28e5a7412cf4a6f87f8589244cd1.exe\", \"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\services.exe\", \"C:\\Windows\\Downloaded Program Files\\lsass.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2652	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2652	schtasks.exe	29

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1736	powershell.exe
2412	powershell.exe
2220	powershell.exe
968	powershell.exe
2372	powershell.exe
2192	powershell.exe
2252	powershell.exe
680	powershell.exe
1176	powershell.exe
2592	powershell.exe
2164	powershell.exe
2300	powershell.exe
2448	powershell.exe
2212	powershell.exe
1828	powershell.exe
2204	powershell.exe
1168	powershell.exe
528	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Mozilla Firefox\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Downloaded Program Files\\lsass.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Mozilla Firefox\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Downloaded Program Files\\lsass.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\spoolsv.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\53190a62-69f6-11ef-9f57-62cb582c238c\\sppsvc.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEBA25A07184C41F2B8BEAAD218806EA8.TMP	csc.exe
File created	\??\c:\Windows\System32\se6s8b.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\00db28e5a7412cf4a6f87f8589244cd1.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\5cd9e6c49b21cc	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files\Mozilla Firefox\services.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files\Mozilla Firefox\c5b4cb5e9653cc	00db28e5a7412cf4a6f87f8589244cd1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\lsass.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Windows\Downloaded Program Files\6203df4a6bafc7	00db28e5a7412cf4a6f87f8589244cd1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2356	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2356	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2644	schtasks.exe
1144	schtasks.exe
2968	schtasks.exe
2352	schtasks.exe
2360	schtasks.exe
2392	schtasks.exe
2552	schtasks.exe
2008	schtasks.exe
1140	schtasks.exe
1636	schtasks.exe
2124	schtasks.exe
2396	schtasks.exe
2388	schtasks.exe
2744	schtasks.exe
2132	schtasks.exe
3044	schtasks.exe
2752	schtasks.exe
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe
1120	00db28e5a7412cf4a6f87f8589244cd1.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	00db28e5a7412cf4a6f87f8589244cd1.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	2244	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1456	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	33
PID 1120 wrote to memory of 1456	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	33
PID 1120 wrote to memory of 1456	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	33
PID 1456 wrote to memory of 1748	1456	csc.exe	35
PID 1456 wrote to memory of 1748	1456	csc.exe	35
PID 1456 wrote to memory of 1748	1456	csc.exe	35
PID 1120 wrote to memory of 2448	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 1120 wrote to memory of 2448	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 1120 wrote to memory of 2448	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	51
PID 1120 wrote to memory of 2372	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 1120 wrote to memory of 2372	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 1120 wrote to memory of 2372	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	52
PID 1120 wrote to memory of 1736	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 1120 wrote to memory of 1736	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 1120 wrote to memory of 1736	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	53
PID 1120 wrote to memory of 2592	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	54
PID 1120 wrote to memory of 2592	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	54
PID 1120 wrote to memory of 2592	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	54
PID 1120 wrote to memory of 2192	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 1120 wrote to memory of 2192	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 1120 wrote to memory of 2192	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	55
PID 1120 wrote to memory of 2412	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 1120 wrote to memory of 2412	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 1120 wrote to memory of 2412	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	56
PID 1120 wrote to memory of 2164	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	57
PID 1120 wrote to memory of 2164	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	57
PID 1120 wrote to memory of 2164	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	57
PID 1120 wrote to memory of 2252	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	58
PID 1120 wrote to memory of 2252	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	58
PID 1120 wrote to memory of 2252	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	58
PID 1120 wrote to memory of 2220	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 1120 wrote to memory of 2220	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 1120 wrote to memory of 2220	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	59
PID 1120 wrote to memory of 2212	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 1120 wrote to memory of 2212	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 1120 wrote to memory of 2212	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	60
PID 1120 wrote to memory of 968	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 1120 wrote to memory of 968	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 1120 wrote to memory of 968	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	61
PID 1120 wrote to memory of 1828	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 1120 wrote to memory of 1828	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 1120 wrote to memory of 1828	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	62
PID 1120 wrote to memory of 1176	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	63
PID 1120 wrote to memory of 1176	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	63
PID 1120 wrote to memory of 1176	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	63
PID 1120 wrote to memory of 680	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	64
PID 1120 wrote to memory of 680	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	64
PID 1120 wrote to memory of 680	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	64
PID 1120 wrote to memory of 528	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 1120 wrote to memory of 528	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 1120 wrote to memory of 528	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	68
PID 1120 wrote to memory of 1168	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	69
PID 1120 wrote to memory of 1168	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	69
PID 1120 wrote to memory of 1168	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	69
PID 1120 wrote to memory of 2300	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 1120 wrote to memory of 2300	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 1120 wrote to memory of 2300	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	71
PID 1120 wrote to memory of 2204	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	72
PID 1120 wrote to memory of 2204	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	72
PID 1120 wrote to memory of 2204	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	72
PID 1120 wrote to memory of 1208	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	85
PID 1120 wrote to memory of 1208	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	85
PID 1120 wrote to memory of 1208	1120	00db28e5a7412cf4a6f87f8589244cd1.exe	85
PID 1208 wrote to memory of 2884	1208	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe
"C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fqkslaua\fqkslaua.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43F3.tmp" "c:\Windows\System32\CSCEBA25A07184C41F2B8BEAAD218806EA8.TMP"
    3⤵
    PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\00db28e5a7412cf4a6f87f8589244cd1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lCd73CgphT.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2884
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2356
- - C:\Program Files\Mozilla Firefox\services.exe
    "C:\Program Files\Mozilla Firefox\services.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\00db28e5a7412cf4a6f87f8589244cd1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd1" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\services.exe

Filesize
1.9MB

MD5
00db28e5a7412cf4a6f87f8589244cd1

SHA1
49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7

SHA256
27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

SHA512
3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES43F3.tmp

Filesize
1KB

MD5
f3b32b0f6983572e9b8110714c7e5526

SHA1
71f1d5f33066bd49f8dca20b37ca4c772e00bca2

SHA256
b11cb4037be18db2f23ae15719589a0141e21c7e1add0afc9b00697e99edd62c

SHA512
245f5d043a1d1667d4bb21e97ed75b33ed46d48abef66b17d3d819635ba4f6ee482f87f209350ba84af2e8a1f4bf7c7ddbb1398afebbdb26f58c2b0530570ba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lCd73CgphT.bat

Filesize
173B

MD5
e5d1045dec0006d74210b1f41765ea7c

SHA1
b69ebf1f6f21a94dd6d60ae8c855eb6ded03fd8c

SHA256
92339d7dce82272fdfb2bd0bef701d8a0a8ca9f22a11f855d75b6e3090604747

SHA512
19ab346204b52edde96ef2c3195be4de50636e60c04f623175366264353f8c7510f8f2c7e7be3f45fbfbc7a4f3e2c1334cd81ad3f8548eba27ab9e472236f215

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2bbdcda9fa6a3600d9d441825a9b0db8

SHA1
033b600dbea26bdfa5b2512f329b7019e5e22f63

SHA256
dd7b6f0b633f3d9825ba864831f3b6dba8da69396e40c09afc8910c495085dfb

SHA512
2ea8bfcd932ba34d58847636a315c7557d5148e9919837e1c50b919cc82d44f6c5e4886fee40b7455e66c2a95d66334361a60ac086e90605eed93e7ae2c8ead8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fqkslaua\fqkslaua.0.cs

Filesize
377B

MD5
4875711762048ce24fbc34b171e7d9b9

SHA1
0636eba962d82e9f63832694f6d9a5679d85bea0

SHA256
8d40356a5a0d81cf695f1f15c39668374e6180b1826f851ffd29d8642b16653a

SHA512
9b87496743cf0b6e93a40a0639d8b4bfde80a959c09cc2e80aa44b57440e9a7c5b4852debb76254f71e2b016b8e191ab60f19cda785a6b86397e0f092fe72456

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fqkslaua\fqkslaua.cmdline

Filesize
235B

MD5
5c2ff667088d1ff0ce1b1954a832d6a3

SHA1
45553678d22d2337d039199263e9ba964a9670ac

SHA256
aa734739d0a44f5b58846a7ab019c8620ab05f054be3df5414b594fba5f5c903

SHA512
a988c2e4519642f83c600d85f8dee5635900575686a23789d637109977712b056c9202ee9cd86fa617dd9622e9257384779e1d1e1c83557293b74cf067895901

Download Submit
\??\c:\Windows\System32\CSCEBA25A07184C41F2B8BEAAD218806EA8.TMP

Filesize
1KB

MD5
5140e68cf918fa33b25b58e398ed5f96

SHA1
684cad676ae206d2b97ac9bcb73a9aceb98364ff

SHA256
49b21daa362f8f342c11fb58f281bf9360517ba405109045e777dc70c58030fe

SHA512
85d027d03ba0fbbb756fb8ed70705ad509010411bf8c2b3c478d710070ca07153f1b5d60c53661813740d603957ab654b2bd81f4d5fe0535263176ec85cfe848

Download Submit
memory/680-70-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/1120-33-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-11-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-16-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/1120-18-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/1120-20-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/1120-26-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-12-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-0-0x000007FEF4C93000-0x000007FEF4C94000-memory.dmp

Filesize
4KB

Download
memory/1120-34-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-35-0x000007FEF4C93000-0x000007FEF4C94000-memory.dmp

Filesize
4KB

Download
memory/1120-36-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-14-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/1120-10-0x00000000001E0000-0x00000000001F8000-memory.dmp

Filesize
96KB

Download
memory/1120-8-0x00000000001C0000-0x00000000001DC000-memory.dmp

Filesize
112KB

Download
memory/1120-6-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/1120-49-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-4-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-1-0x0000000000DD0000-0x0000000000FCA000-memory.dmp

Filesize
2.0MB

Download
memory/1120-3-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-72-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-2-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/2244-148-0x0000000000F90000-0x000000000118A000-memory.dmp

Filesize
2.0MB

Download
memory/2372-71-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download